Home Programs AI Risk & Governance
Program
Audit-ready AI — before the deadlines, not after
We build the inventory, risk classification, controls and operating model that let you scale AI — including agents — with confidence under the EU AI Act, ISO/IEC 42001 and India’s DPDP Act.
Last reviewed: 29 September 2026
Key dates
2 August 2026
EU AI Act transparency obligations (Article 50) apply
13 May 2027
India DPDP Act: full data-fiduciary obligations apply
2 December 2027
EU AI Act high-risk obligations (Annex III) apply, as amended by the Digital Omnibus
2 August 2028
EU AI Act obligations for AI in regulated products (Annex I) apply
AI is spreading faster than your ability to govern it
AI now arrives through every channel: platform features switched on by default, tools adopted by teams, models built by vendors, and agents that can take actions across systems. At the same time, regulators in the EU and India have set dated obligations, and customers are adding AI questions to security reviews. Most organisations cannot yet answer a simple question: what AI do we use, and who is accountable for it?
- Unknown AI in use across the business
- Agents acting with broad, human-level permissions
- Regulatory dates approaching without a named owner
Governance done well speeds AI up. It tells teams what is allowed and how to get approval quickly.
Why governance programs stall
| Where it stalls | What it costs | Our answer |
|---|---|---|
| A policy document without controls | Rules nobody can follow or evidence | Controls built into platforms, pipelines and approvals |
| Governance as a blocker | Shadow AI and workarounds | Tiered approvals — a fast lane for low-risk use |
| A one-off assessment | Drift as models, vendors and uses change | Continuous monitoring and periodic review |
What the program covers
| Workstream | What you get |
|---|---|
| AI inventory and classification | A register of AI systems and use cases, classified by risk and regulatory scope |
| Policy, roles and decision rights | AI policy, RACI, approval workflow and an AI governance forum |
| Agent governance | Identity, least-privilege permissions, action limits, logging and human approval for agents |
| Evaluation and testing | Test sets, quality thresholds and red-teaming for priority use cases |
| Data protection alignment | GDPR and DPDP alignment for AI use cases, including notices and consent where required |
| Third-party AI due diligence | Vendor assessment questions and contract clauses for AI suppliers |
| AI literacy | Role-based awareness and training for staff who use or oversee AI |
How the program runs
1
Governance Readiness Assessment
3–4 weeks
Inventory, regulatory scoping, gap analysis and a prioritised plan.
2
Design
3–6 weeks
Policy, roles, control set and approval workflows, mapped to the frameworks that apply to you.
3
Implement
2–4 months
Controls configured in your platforms, evidence templates, training and the first review cycle.
4
Operate
Continuous monitoring and periodic reviews, in-house or through our managed services.
Mapped to the frameworks that matter to you
EU AI Act
for organisations placing AI on the EU market or using AI in the EU
ISO/IEC 42001
the international AI management system standard
India DPDP Act and Rules
for personal data processed in India or relating to people in India
GDPR
for personal data of people in the EU
ISO/IEC 27001 and NIST AI RMF
for security and risk alignment
Sector guidance
for example, financial-services regulators’ expectations on AI, model risk and outsourcing
SynAdopt implements governance and controls. We do not provide legal advice and work alongside your legal counsel on interpretation.
Know where your AI stands before the regulators ask.
See it in practice
Blueprint
Governed HR operations automation
How onboarding and compliance documentation can be automated across HR systems with audit-ready records.
View the blueprint
How to start and how it grows
1
Governance Readiness Assessment
3–4 weeks
Your AI inventory, regulatory exposure and a dated plan.
2
Implementation
2–4 months
Controls, policies and training in place; evidence ready for audit.
3
Managed governance
Ongoing monitoring, reviews and reporting through AI Operations & Managed Services.
Commercial options: fixed-fee assessment · fixed-fee implementation · monthly retainer.
Questions about AI governance
Does the EU AI Act apply to a company based in India?
It can. The Act applies to providers placing AI systems on the EU market and to deployers using AI in the EU, and it can also apply where an AI system’s output is used in the EU. Indian companies with EU customers, subsidiaries or AI-enabled products sold into Europe should assess their exposure.
What changed with the Digital Omnibus?
The Digital Omnibus on AI, in force since 27 July 2026, moved the main high-risk obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for AI embedded in regulated products. Other obligations, including prohibited practices, general-purpose AI rules and transparency obligations, were not deferred.
Do we need ISO/IEC 42001 certification?
Not legally. ISO/IEC 42001 is a voluntary standard. Many organisations use it as the structure for their AI management system and certify later if customers or regulators value it. We design governance so certification remains an easy option.
How do we govern AI agents specifically?
Treat each agent like a new employee with limited authority: give it its own identity, the minimum permissions it needs, clear action limits, full logging and human approval above agreed thresholds. Test agents before release and monitor them continuously.
How does India’s DPDP Act affect AI projects?
AI projects that process personal data must meet the Act’s requirements on notice, consent or legitimate use, purpose limitation, security safeguards and data-principal rights. With full obligations applying from 13 May 2027, AI use cases involving personal data should be assessed now.
Get a dated plan for audit-ready AI
- 30 minutes with a senior lead
- No sales script — a working conversation
- A clear view of where AI can pay back first