The AI Act's obligations arrive in stages, and the practical questions arrive earlier than the deadlines: which systems in the organisation count as AI, which risk category each falls into, in which role — provider, deployer, importer, distributor — the company acts, and whether the vendors behind embedded AI capability will carry their share of the compliance burden. Boards, customers and investors are already asking; "we are looking into it" stops being an acceptable answer well before enforcement begins.
Who this is for
Companies that develop AI systems; companies that procure or embed AI capability in their products and operations; boards and investors who need AI oversight that would survive scrutiny.
What we do
- Build the AI inventory and risk classification — with documented reasoning, because "not high-risk" is a conclusion that needs a written basis.
- Analyse roles and obligations across the AI value chain, per system and per arrangement.
- Design and run AI Act readiness programmes, proportionate to actual exposure.
- Put working AI governance in place: policies that map to operational processes, human oversight, logging, monitoring and incident handling — not a policy PDF.
- Negotiate the AI contract terms that compliance depends on: information duties, cooperation, audit rights, accuracy commitments and model-change protection.
- Equip boards: reporting formats, oversight questions and accountability structures for AI.
Why Cabo Advisory
For companies that already run structured GDPR and information-security programmes, the AI Act is an extension of a familiar discipline — and that is precisely our ground. Our partners wrote a comprehensive guide to the GDPR, teach information security at university level, negotiate AI contracts in practice, and sit on technology-company boards. We treat AI governance as an operational, contractual and board matter at once, because it is one.