AI governance

Grip on AI risks, responsibilities and the EU AI Act

Where AI is used, roles, risks and obligations need to be clear. Vedeum classifies your applications under the AI Act and helps you set up the governance around them.

Book an introductory call

Responsibility starts with policy. Control is proven in practice.

We help define policy, set clear boundaries and structure your governance, so you can use AI and account for how you use it. Embrace innovation with confidence.

AI governance in eight steps

Inventory

We map which AI applications are used or developed across your organisation, including applications that weren’t officially procured.

Determining your role

We determine whether your organisation is a provider, a deployer, or both for each application: obligations under the AI Act differ by role.

Classification

We classify each application under the AI Act’s risk categories: prohibited, high-risk, limited-risk or minimal-risk. Providers of general-purpose AI models, including generative AI, face additional, separate obligations.

Risk analysis

For high-risk applications we map the risks and determine whether a FRIA (Fundamental Rights Impact Assessment) is needed. This mainly applies to public bodies, organisations providing public services, and certain financial-sector entities.

Governance

We define roles, decision-making, monitoring and review, matched to the risk category of your applications.

Documentation

We prepare the technical documentation and records the AI Act requires, so you can demonstrate this to regulators.

Oversight

We set up human oversight for AI applications that require it.

Review

We periodically check whether classification, governance and documentation are still up to date, and adjust where needed.

EU AI Act

The four risk categories of the AI Act

The AI Act links obligations to the risk of an application. Vedeum maps this out for each of your applications.

Prohibited
Applications with an unacceptable risk, such as social scoring. These may not be used.
High risk
Strict requirements for risk management, documentation and human oversight. For certain deployers, such as public bodies and parties assessing creditworthiness, a FRIA can be mandatory.
Transparency obligations
People must know they are dealing with AI, for example with chatbots or AI-generated content.
Minimal risk
No specific obligations under the AI Act, as with spam filters. Voluntary codes of conduct are possible.

Separate obligations also apply to providers of general-purpose AI models, including generative AI, regardless of the risk category of the application the model is used in.

AI Act non-compliance: fines up to €35 million

Or 7% of your global turnover. Immediate impact on financial and executive accountability.

€7.5 million

or up to 1% of global annual turnover for providing incorrect or misleading information.

€15 million

or up to 3% of global annual turnover for non-compliance involving high-risk AI.

€35 million

or up to 7% of global annual turnover for the use of prohibited AI practices, such as social scoring.

Source: EU AI Act, Article 99

Book a no-obligation introductory call

Tell us where your organisation stands. We will think through the first steps with you.