For firms that build, buy or sell AI: ISO/IEC 42001, the EU AI Act, SOC 2, ISO/IEC 27001 and the buyer security reviews that decide enterprise deals, alongside your compliance function or as outsourced senior support.
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money, cryptoasset and consumer credit firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
Firms that build, buy or sell AI now answer to two audiences: the regulator, through the EU AI Act and sector rules, and the enterprise buyer, through certification and security review. We advise on ISO/IEC 42001, the EU AI Act, SOC 2 and ISO/IEC 27001, and on the client and buyer reviews that decide enterprise deals.
The support runs alongside an existing compliance function or as outsourced senior support. The firm has advised regulated businesses on authorisation, compliance and regulator engagement since 2013, and engagements are led by senior specialists from first assessment through certification and ongoing assurance, so clients work directly with the people doing the work.
AI systems, policies and evidence assessed against the standard being measured, with the gaps and what certification or client review will require.
A full register of the AI the firm develops, buys or embeds, each system classified by risk with an accountable owner.
The AI management system designed and set up: scope, risk methodology, statement of applicability, controls and supporting evidence.
The annual internal audit ISO/IEC 42001 and ISO/IEC 27001 require, carried out independently and reported to management or the board.
Evidence and staff prepared for the Stage 1 and Stage 2 audits, with the firm attending alongside you through to certification.
The systems in scope identified, classified by risk category, and the obligations and documentation each attracts mapped.
CAIQ, SIG, due diligence and bespoke AI questionnaires answered from approved evidence, with reusable answers for later reviews.
Governance, risk assessment, human oversight, data governance, third-party AI and incident handling policies prepared and reviewed.
Evidence kept current between audits: control re-testing, evidence refresh, regulatory change monitoring and questionnaire responses.
| Deliverable | What it contains | Who relies on it |
|---|---|---|
| AI inventory and risk register | Every AI system the firm develops, buys or embeds, with risk classification and owner | Board, buyers, auditors |
| Readiness assessment | Gaps against ISO/IEC 42001, the EU AI Act and buyer requirements, prioritised | Board, compliance |
| AI management system | Scope, risk methodology, statement of applicability, controls and evidence | Certification body |
| Internal audit report | Findings, severity, owners and closure evidence | Board, certification body |
| EU AI Act scoping memo | Systems in scope, risk category, obligations and documentation by system | Board, legal |
| Questionnaire answer library | Approved answers and evidence for CAIQ, SIG, due diligence and AI questionnaires | Sales, buyers |
As amended by the Digital Omnibus on AI, approved by the Council of the EU on 29 June 2026.
| Date | What applies | Source |
|---|---|---|
| 1 August 2024 | The EU AI Act enters into force | Regulation (EU) 2024/1689 |
| 2 February 2025 | Prohibited AI practices and AI literacy duties apply | AI Act, Article 113 |
| 2 August 2025 | Obligations for general-purpose AI models and the governance framework apply | AI Act, Article 113 |
| 2 December 2027 | Obligations for high-risk AI systems listed in Annex III apply, including credit scoring and insurance pricing | Digital Omnibus on AI |
| 2 August 2028 | Obligations for high-risk AI built into products covered by Annex I apply | Digital Omnibus on AI |
The Act reaches firms outside the EU that place AI systems on the EU market or whose AI output is used in the EU. ISO/IEC 42001 certification runs on its own cycle: a Stage 1 and Stage 2 audit by an accredited certification body, annual surveillance audits and recertification every three years, with an internal audit each year. Our guides on ISO/IEC 42001 certification and AI governance for financial services cover each step.
Yes, where a firm places an AI system on the EU market, puts it into service in the EU, or uses AI whose output is used in the EU. UK and US firms selling to EU customers are in scope for those systems.
From 2 December 2027 for the high-risk systems listed in Annex III, which include credit scoring and life and health insurance pricing, and from 2 August 2028 for high-risk AI built into regulated products, following the Digital Omnibus on AI.
Certification is issued by an accredited certification body. We prepare the AI management system and the evidence, prepare staff for the Stage 1 and Stage 2 audits and attend them with you through to certification.
ISO/IEC 42001 and ISO/IEC 27001 both require an internal audit each year, which the certification body cannot perform. We carry it out with a team independent of any implementation work and report to management or the board.
They share a management system structure. A firm certified to ISO/IEC 27001 or reporting under SOC 2 reuses its governance, risk and evidence processes, and adds the AI-specific controls, impact assessments and lifecycle requirements.
Yes. We answer CAIQ, SIG, due diligence and bespoke AI questionnaires from approved evidence, and build a library of reusable answers that shortens every later review.
A reply within three business hours and a written proposal on scope, cost and timing the same day.