AI governance and operating model.
Who may use AI for what, who reviews, who approves: roles, rules and approval paths under the EU AI Act and ISO/IEC 42001.
- IdeaDepartment submits it
- ClassificationPurpose, role, risk class
- Assessment
- Data protection
- IT security
- Works council
- Approvalresponsible person, with a signature
- OperationTraining, usage, costs
- Scheduled reviewafter 3 to 24 months
Scheduled review leads back to classification
- AI policy
- Roles with named owners
- Approval path
- AI register
Prioritising use cases.
We look at the process, find the bottleneck and decide which AI application is implemented first, and why.
- 2Enquiry
- 3Technical review
- Bottleneck9Costing
- 2Write the quote
- 1Dispatch
- Bottleneck in the process
- Ranking of applications
Interim AI lead.
ontoconsult takes on the role of AI lead until it is filled in house, and trains the person who holds it afterwards.
- Role filled from day one
- a trained person in house
AI Management System.
The software for it: every use of AI is recorded, classified, approved and documented, with a date for scheduled review.
- Sales writing assistantapproved
- Incoming goods inspection assistantapproved with conditions
- Applicant screeningblocked
- Reported browser extensionunder review
- Register
- Evidence files
- Approvals
- Scheduled reviews
Deadlines of the AI Act.
The EU AI Act applies in stages. The AI Omnibus of July 2026 moved deadlines and rewrote Article 4. Spacing follows the calendar.
- Entry into forceObligations follow in stages.
- Prohibited practicesFor example, social scoring and emotion recognition in the workplace
- General-purpose AI modelsObligations for providers of general-purpose AI models
- AI OmnibusArticle 4 revised, high-risk deadlines postponed
- TransparencyFor example, chatbot notices and labelling of AI content
- As of 5 Oct 2026
- High risk, Annex IIIFor example, recruitment and creditworthiness
- High-risk AI in productsAI as a safety component, for example in machinery
Legal status as of 2 October 2026. Sources: Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744. Overview, no legal advice.
Talks in this field.
As a talk, keynote or training session, for leadership teams, teams and events.
The EU AI Act in practice
Management and leadershipWhat the EU AI Act requires of a mid-sized company, what the AI Omnibus changed and in which order to proceed.
The tool is in place. Why does nobody use it?
Management and people developmentWhy AI roll-outs fail at adoption and what helps: start from a concrete problem and meet people where they are.
Questions and answers.
01What does agentic organization mean?
A company in which people and AI agents work together, with clear rules on who may do what: which AI is used for what, who approves, what evidence exists and how staff are trained. The basis for this is AI governance.
02What does the EU AI Act require of a mid-sized company?
That depends on its role. A company using AI is a deployer: avoid prohibited practices, meet transparency requirements and ensure human oversight and logs for high-risk systems. Companies incorporating AI into their own products become providers and have substantially more obligations, for machinery from 2 August 2028.
03Do we need a dedicated AI lead?
The EU AI Act does not require one. Someone still has to keep the register, approvals and scheduled reviews. Until the role is filled in house, ontoconsult takes it on and trains the person who will hold it.
04Do we need ISO/IEC 42001 certification?
The EU AI Act does not require it. ISO/IEC 42001 provides a useful framework for an AI management system; certification can follow if customers require it. We build the system; an independent body certifies it.
Let’s talk about your project.
A 30-minute call, online, no obligation. We work out where to start.