EU AI Act Compliance: From Zero Governance to Audit-Ready

About the Client

This case study illustrates a systematic approach to AI-system inventory, risk classification and remediation under the EU AI Act. The scenario shows how a representative engagement would run — no client outcome is claimed. Illustrative scenario, not a specific client engagement.

Size: Representative: 1,000–20,000-employee industrial manufacturers

The Challenge

Reach a defensible EU AI Act position for AI systems across plants — inventory, risk classification and audit-ready documentation — before the August 2026 obligations bite.

• An indicative portfolio: dozens of AI systems across plants — visual quality inspection, predictive maintenance, production scheduling, worker-safety monitoring — with no central inventory
• A worker-safety monitoring system likely lands in Annex III high-risk territory and lacks the required risk-management documentation
• Vision inspection models retrained by line engineers with no change-control or logging of the kind Article 12 requires
• A predictive-maintenance vendor cannot produce the technical documentation the Act requires of providers
• Human-oversight arrangements (Article 14) exist in practice on the line but are documented nowhere
• The board wants a defensible answer before the August 2026 enforcement date

My Solution

A representative engagement would run end-to-end — from system inventory through technical measures, documentation, and ongoing monitoring — sized to an industrial plant portfolio.

The engagement would start with complete AI system discovery and risk classification, implement the required technical measures (bias testing, explainability, human oversight) and compliant documentation for each high-risk system, and establish an AI governance office with clear roles, processes, and audit trails.

Implementation Phases

• 3 weeksDiscovery & ClassificationComplete AI system inventory across all business units. Risk classification per Annex III. In the modelled portfolio, 12 high-risk systems are prioritised.
• 5 weeksTechnical Measures ImplementationLogging and change-control for retrained vision models, explainability where the Act requires it, and documented human-oversight workflows for the line.
• 3 weeksDocumentation & GovernanceTechnical documentation per Annex IV, an AI risk-management system, and a model registry with automatic documentation.
• 2 weeksAudit Preparation & TrainingA mock audit with external counsel, and training for the AI governance team on ongoing compliance.

MLflow (Model Registry) · SHAP/LIME (Explainability) · Fairlearn (Bias Testing) · Great Expectations (Data Quality) · Evidently AI (Monitoring) · Confluence (Documentation) · ServiceNow (Governance) · Python · SQL

Results & Impact

Illustrative outcome: a classified inventory, per-system remediation plans, and governance a hostile auditor could follow — owned by the manufacturer's team. No client outcome is claimed.

Services in a Representative Engagement

EU AI Act Compliance · Production Readiness Review · AI Governance Implementation · Technical Documentation · Training & Capability Transfer

Facing a Situation Like This?

Every engagement starts with a 30-minute diagnosis. Describe your situation, and I will tell you — honestly — whether I can help and how fast.