AI Governance Model

Know what your AI actually does. Clear AI rules and documents built from what you really use, typically within one to three weeks.

Problem

Know what your AI actually does

We write your AI governance documentation from what you really have in use. No maturity assessment, no slide deck. Four short workshops, and then documents your leadership, architects and staff actually use. A platform build needs budget, a security review and a named owner before anyone has agreed what AI is for. Governance needs none of that, and it answers the question your board is already asking.

  • • Nobody can say which AI tools are in use, or on what data
  • • Security or data protection blocking every pilot
  • • EU AI Act on the agenda with no owner
  • • Agents going live with no one accountable for them

Approach

Five documents, each with a reader

Not one thick policy nobody opens. Each document is written for the people who have to use it, and built from your own workshop answers rather than our template. Platform-neutral by construction: nothing in them presumes Bedrock, Foundry or Vertex.

00 · Assessment

Provider or deployer? What counts as high risk for you, and which deadlines apply. A short document everything else depends on. For legal and management.

01 · Governance model

Roles and responsibilities, lifecycle, risk tiers, human oversight, deviations, traceability and AI literacy. For leadership and auditors.

02 · Technical principles

Agent identity, action permissions, logging, testing, rollback and the emergency stop. Autonomy level is a decision, not a setting. For architects and developers.

03 · Staff guideline

Which tools you may use, what you may put into them and what you stay responsible for yourself. Plain language, one page. For everyone.

R · System register

Not a document but a register you keep up: system, owner, risk tier, autonomy level, obligations and next review. For the governance owner.

EU AI Act

What applies to you, and when

The dates your governance model has to plan for, as they stand after the Digital Omnibus on AI.

  1. In force

    2/2025

    Prohibitions and AI literacy

    Prohibited practices banned. Providers and deployers must support AI literacy among their staff.

  2. In force

    8/2025

    General-purpose AI

    Obligations for providers of general-purpose AI models.

  3. In force

    8/2026

    Transparency

    People must be told when they are dealing with AI, and some AI-generated content must be marked.

  4. Ahead

    12/2027

    High-risk systems, Annex III

    Obligations for standalone high-risk systems, such as AI used in recruitment, credit or critical infrastructure.

  5. Ahead

    8/2028

    High-risk in regulated products

    Obligations for AI embedded in products already covered by EU product-safety law, Annex I.

Dates per Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which moved the high-risk deadlines (summary). Your assessment document says which of these actually bind you.

What This Takes From You

About ten hours of your people

Typically one to three weeks from first meeting to signed-off documents, depending on how fast your people can meet. You bring the people and the answers. We write the documents.

2 hours

Orientation for leadership

Scope, current AI use, and an honest look at the shadow AI already happening.

4 × 2 hours

Four workshops, 35 questions

Strategy and risk, data and residency, controls and oversight, roles and cadence.

1 day

We write the documents

Drafted from the workshop record, reviewed with you and signed off by a named business owner.

Price And Next Step

The register decides what gets built

Starting from €4,000, typically within one to three weeks. If the model says build, the AI Landing Zone is priced against your own register, not our template. If it says wait, you still have the answer you needed.

System register

Tells us which models, which data and which regions. It sizes the landing zone.

Risk tiers

Tell us which guardrails are mandatory rather than nice to have.

Technical principles

Become the controls the platform enforces: identity, permissions, logging and rollback.

FAQ

Common questions

Do we need a cloud platform first?
No. There are no cloud prerequisites and no landing zone needed. That is the point.
Is this a maturity assessment?
No. There is no maturity score and no slide deck. You get five working documents built from what you actually use.
What isn't included?
Technical implementation, legal review, DPIA authoring, certification or audit, and company-wide AI literacy training. Vendor and model selection is limited to a recommendation.
What keeps the documents current?
Managed AI. Policies are one of the things it runs: new tools and agents are checked against your rules before use, and the platform’s controls stay in line with them.

Explore More

What comes next

Ready to Get Started?

Let's discuss how Cloud2's AI Governance Model service can help you achieve your goals.

Cloud Infrastructure