Service · Wolff Applied AI
A lean governance framework for AI in mid-sized companies — oriented on the EU AI Act and GDPR.
In 3–5 weeks, the starter package creates a lean, mid-market-suitable governance framework for AI use — oriented on the EU AI Act and GDPR, deliberately practical rather than overly bureaucratic. We capture actual AI use, set up an AI inventory, create a signature-ready usage policy, a role and RACI model, as well as a risk and approval logic aligned with the EU AI Act. A short awareness briefing makes the rules workable within the team.
In many organisations, AI is already in use — often uncoordinated, via private or unapproved services ("shadow AI"); depending on the survey, around 50–75 % of employees use generative AI without formal approval. Since 2 February 2025, the obligation to ensure employees’ AI competence applies (Art. 4 EU AI Act), and further transparency obligations under Art. 50 are planned from 2 August 2026 — without a documented framework, this diligence can hardly be evidenced. Regulated clients, public procurement bodies and auditors increasingly ask for evidence. Available templates are often either too legally heavyweight or too superficial — what is needed is an applicable, maintained framework that fits mid-sized companies.
4 phases, 4 gates — you decide at every transition.
In a structured kickoff with IT, compliance/data protection and management, we clarify goals, scope and non-goals (explicitly not legal advice). Through short interviews and a questionnaire, we capture actual AI use — without sanctions and including "shadow AI".
We build up the AI inventory/register and populate it with the applications and data types actually in use. Each application receives a risk class (minimal/limited/high, aligned with the EU AI Act) with a documented rationale; in parallel we define the approval and review process.
We create the signature-ready AI usage policy (dos/don’ts, data classes, approval channels, labelling) and a role and RACI model with clear escalation paths. In up to two feedback rounds, we incorporate feedback until the documents are ready for approval.
We finalise a short awareness briefing (slides + handout) and hand over the framework in a session that includes a demo of the approval process. The AI leads are briefed on maintaining the register.
Maintainable template and initial population of the AI applications actually in use, with data types, provider, risk class and responsible persons — as an evidence basis.
Understandable policy with principles, dos and don’ts, data classes, approval channels and labelling guidance, ready for approval by management.
Responsibility matrix for AI leads, coordination, data protection, IT and departments including escalation paths — lean and without new full-time positions.
Comprehensible logic for classifying applications into minimal, limited and high risk (aligned with the EU AI Act) with criteria, examples and rationale fields.
Documented workflow for new AI applications (request, review, approval, registration) including a short form and triggers for a renewed review.
Slide deck and handout for a short employee briefing on rules, data classes, labelling and reporting channels.
The base package stands on its own. Optional modules dock on now or later — you decide how far you go.
Beyond the included awareness briefing (slides and handout), we run compact live sessions for your employees and make the new rules tangible in everyday work. A complete competence programme in the sense of Art. 4 EU AI Act remains reserved for the AI Training Programme.
We extend the stocktaking and AI inventory to further sites or subsidiaries, including additional interviews and register entries. The base package is designed for one main site; this module cleanly covers grown group or multi-site structures as well.
Once a year, we jointly review whether the policy, role model and register still match actual AI use and the current legal situation, and update them as needed. This keeps the governance framework alive instead of becoming outdated after rollout.
Credit: A preceding AI Potential Analysis, AI Strategy Sprint or EU AI Act Quick Check is credited proportionally if commissioned directly.
Note: not legal advice. Content with a legal dimension (e.g. EU AI Act, GDPR, ISO/IEC 42001) is professional orientation, not legal counsel.
You receive a clear, individual proposal before any engagement. Under § 19 UStG no VAT is charged; any ancillary costs (e.g. model/hosting/API fees, travel) are not included.
Next step
Let us clarify in a free intro call whether this offer fits your situation — honestly and without sales pressure.As a follow-up we then recommend AI Training Programme.
Non-binding · online or on site · reply < 24 h
