AI governance consulting is outside help to decide which AI uses your business allows, who approves and watches each one, and what evidence you keep to show it. A useful engagement leaves you with six things: an AI use policy, an inventory of every AI system, a risk class for each system, named human review points, logging and monitoring, and the notices owed to staff and customers. Under the EU AI Act, the heaviest duties for most businesses now start on 2 December 2027.
Two disclosures. ATI Lab builds and runs AI systems for established businesses, so we have a stake in the "who should do this" question answered below; the section on when to hire a separate governance firm is there for that reason. This article was drafted with AI assistance and checked by a person against the primary sources linked in each section on 9 November 2026. It is not legal advice: confirm how your systems are classified with counsel.
What does AI governance consulting include?
AI governance consulting includes six deliverables, and each one answers to a specific framework function or legal duty. The table maps them to the voluntary NIST AI Risk Management Framework and to the articles of the EU AI Act (Regulation (EU) 2024/1689) that create the matching obligation. If a proposal can't tell you which of these you will own at the end, ask before you sign.
| Deliverable | What it is | NIST AI RMF | EU AI Act duty |
|---|---|---|---|
| AI use policy | Which tools staff may use, with which data, and who to ask | Govern | Art. 4 AI literacy measures |
| AI system inventory | Every AI system in use: owner, vendor, purpose, data it touches | Map | Needed before you can classify anything |
| Risk classification | Each system placed as prohibited, high-risk, transparency-only or minimal | Map | Art. 5, Art. 6 and Annex III, Art. 50 |
| Human review gates | A named person who checks a defined output and can stop the process | Manage | Art. 26(2) human oversight (high-risk) |
| Logging and monitoring | Logs kept, quality metrics watched, an incident route | Measure | Art. 26(5) and 26(6), logs kept at least six months (high-risk) |
| Notices | Telling workers, customers and affected people where AI is used | Govern | Art. 26(7), 26(11), Art. 50 |
The deployer duties in the last three rows come from Article 26, which applies to businesses that use a high-risk system made by someone else. Logs under your control must be kept "for a period appropriate to the intended purpose" and for at least six months unless other law says otherwise. For systems that are not high-risk, the same three rows are still good practice: they are how you find out an AI step has started making mistakes.
Does the EU AI Act require AI governance for my business?
The EU AI Act requires some governance from every business that uses AI, and much more from businesses running high-risk systems, which most companies won't have to treat as high-risk until 2 December 2027. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the dates. Pages written before July 2026 still quote 2 August 2026, so check the date on any guide you read.
What applies when, as of 9 November 2026:
- Now: the Article 5 prohibited practices, and the revised Article 4, under which providers and deployers "shall take measures to support the development of AI literacy" among their staff. The Article 50 transparency duties, such as telling people they are interacting with an AI system, apply from 2 August 2026.
- 2 December 2027: obligations for stand-alone high-risk systems listed in Annex III.
- 2 August 2028: obligations for high-risk AI built into regulated products under Annex I, such as machinery or medical devices.
For the industries we work in, two Annex III entries matter most. Point 5(b) covers systems that "evaluate the creditworthiness of natural persons or establish their credit score," with an exception for fraud detection. Point 5(c) covers "risk assessment and pricing in relation to natural persons" for life and health insurance. A business deploying either one must also run a fundamental rights impact assessment under Article 27 before first use. Point 4 adds recruitment, promotion and worker-monitoring systems, which reach every employer.
Our reading of our own work: the five production systems on our published results page (shipment intake from email, email-to-CRM project setup, an ERP support assistant, OCR document processing, and fuel tracking alerts) are operational workflows that don't appear in Annex III. Most AI at a logistics, accounting or legal firm sits in the same place. That lowers the paperwork but leaves the operating controls: someone still has to own each system, check its output and notice when it drifts.
Where does the NIST AI RMF fit in AI governance consulting?
The NIST AI RMF is the structure most AI governance consultants work from, because it is free, voluntary and not tied to any one law. NIST released version 1.0 on 26 January 2023, organised around four functions: Govern, Map, Measure and Manage. It added a Generative AI Profile (NIST AI 600-1) on 26 July 2024 for chat and content-generation systems.
EU businesses use it as the working method and the AI Act as the legal floor. The certifiable option is ISO/IEC 42001, a management-system standard you can be audited against. We cover how a single project maps to NIST, OWASP and ISO 42001 in our AI implementation risk checklist; this article stays with the question of who builds that structure for you.
What makes a human review gate work?
A human review gate works when it is a step that stops the process until a named person approves, rather than a sentence in a policy saying people will review outputs. If nobody can point to where the process halts, there is no gate.
Two examples from our own operation. Every article on this site passes an automated writing check, and a failing result blocks publishing until a person fixes the draft and owns each claim in it. In our internal reporting, a data source that fails to load is shown as failed and never filled in with an estimate. Both rules are small, and both were written down as a step in the pipeline, which is why they hold.
In a client workflow, a gate is designed the same way. For an email intake process that extracts order details into an ERP, it looks like this: fields the system is unsure about go to a named reviewer's queue; the record is not created until that person approves; every approval and correction is logged; and the correction rate is reviewed on a fixed schedule. The log is also the evidence an auditor or a regulator would ask for.
Should you hire an AI governance consultant or an implementation partner?
Hire a separate AI governance consultant when you need independent assurance or legal classification, and let your implementation partner cover governance when your AI is operational workflow automation outside Annex III. The diagram sets out the split we recommend.
The case for a separate firm is independence. An implementation partner reviewing its own builds is likely to find fewer faults in them than an outsider would, and a regulator or auditor will discount that review for the same reason. If any of the three conditions in the diagram applies, pay for the independent view and have your builder work to its findings. The control regimes we describe for banks are a worked example of that split.
The case for the implementation partner is that most governance failures happen inside the running system. A policy binder can say outputs are reviewed while the actual workflow writes straight to the ERP. When the people building the workflow also build the review queue, the log and the monitoring, the policy and the system match. For a firm whose AI handles documents, email and internal support, that usually covers what the law asks today.
Is responsible AI consulting the same as AI governance consulting?
Responsible AI consulting and AI governance consulting overlap almost entirely: "responsible AI" usually names the principles, such as fairness, transparency and human oversight, and "governance" names the policies, owners and controls that enforce them. Some firms sell responsible AI as workshops and principle statements alone. Whatever the label, ask what documents and controls you will hold when the engagement ends.
How do you choose an AI governance consultant?
Choose an AI governance consultant on what they hand over and who stands behind the legal calls. Five questions sort the field:
- Can you see a sample system inventory and risk classification from a past engagement, with client details removed?
- Who signs off on whether a system is high-risk: a qualified lawyer, or a consultant giving an opinion?
- Do they test that the controls exist in the running system, or only review documents?
- Who keeps the inventory current after handover, and how does a new AI tool get added to it?
- Do their materials reflect the Digital Omnibus dates (2 December 2027 for Annex III), or the old 2 August 2026 deadline?
An "AI governance consultant" may be one specialist or a team inside a law, audit or technology firm. For a business with a handful of AI workflows, the second and third questions matter most: you need someone accountable for the classification and someone who checks the system behaves as the policy says.
How ATI handles AI governance in an implementation
ATI builds governance into the work rather than selling it as a separate audit. Every AI strategy and consulting engagement starts by mapping where the hours go, checking whether the data and tools can support automation, and saying plainly where AI should not be used. We build the top-ranked workflow first, measure it against a baseline recorded before work started, and run it in production with monitoring. Team training, using examples from the client's own departments, is how clients meet the Article 4 literacy duty in practice.
What we don't do: we don't certify against ISO/IEC 42001 and we don't give legal opinions on classification. When a use case comes close to Annex III, we say so and the client's counsel or a governance specialist makes the call. If your concern is where data goes when staff use AI tools, our guide to private AI for business covers the deployment options.
Frequently asked questions
What does an AI governance consultant do?
An AI governance consultant helps you list the AI systems you use, classify each one by risk, write the policy that says who may use what, and set up the review points, logs and monitoring that show the policy is followed. Good ones also check that those controls exist in the running systems.
When do the EU AI Act high-risk rules apply?
Under the Digital Omnibus (Regulation (EU) 2026/1744), obligations for stand-alone high-risk systems listed in Annex III apply from 2 December 2027. High-risk AI inside products covered by Annex I follows from 2 August 2028. The prohibited practices and the AI literacy measures already apply.
Do we need an AI policy if staff only use ChatGPT or Claude?
Yes, a short one. It should say which tools are approved, which data may never go into them, and who to ask when unsure. It is also the simplest way to show you have taken measures on AI literacy under Article 4.
What is an AI system inventory?
An AI system inventory is a register of every AI system the business uses, with its owner, vendor, purpose, the data it touches and its risk class. Classification, review gates and audits all depend on it, so it is usually the first deliverable.
Does ISO/IEC 42001 certification make us EU AI Act compliant?
Not by itself. ISO/IEC 42001 certifies that you run an AI management system. The AI Act attaches duties to specific systems and roles, so you still need to classify each system and meet the articles that apply to it.