Regulatory & Compliance

A single frontier product can sit inside several regimes at once. An AI diagnostic tool is a medical device, a high-risk AI system, a data controller and, if it is sold to a bank, part of that bank’s operational resilience perimeter. Each regime has its own definitions and its own regulator.

This unit works out which rules actually apply, in which order, and what each one requires in practice. Sector authorisations and licensing. The AI Act, DORA, NIS2 and the surrounding family of obligations. Compliance programme design that fits how the company works, since a programme nobody follows is evidence against you rather than for you.

Regulator interaction is part of the job: authorisation applications, information requests, inspections, and the conversations that are better had early than in response to a finding.

We also track what is still in draft. Building against a regime that takes effect in eighteen months is far cheaper than retrofitting it, and our Government Relations unit can engage while the text is still moving.

Typical mandates: a regulatory pathway assessment before market entry, an authorisation application, AI Act or DORA readiness, a compliance programme build, or a response to a regulator’s finding.