AI Governance That Protects Your People, Your Data, and Your Business.

Greyguard is an independent AI data governance consultancy helping mid-market enterprises across Europe understand their AI exposure, close their compliance gaps, and build the human accountability structures the EU AI Act requires. We do not sell software. We do not receive referral fees. Our only interest is an accurate picture of your real exposure and a clear plan to fix it.

What This Tool Is

• A free structured self-assessment across 13 governance domains, including conditional sections for financial services, healthcare and software development
• Built from the verbatim text of the EU AI Act, GDPR, DORA, NIS2, MDR, AMLD6, EBA guidelines and PSD2, mapped against supporting standards including ISO 42001 and NIST AI RMF
• Generates a personalised report with a prioritised remediation roadmap - free executive summary; the full verified report is scoped and priced in a 1:1 call with our team

This tool is a starting point. A Greyguard engagement goes deeper, with technical audit, shadow AI discovery, permissions scanning, expert validation, and a full deliverables package your board and regulators can rely on.

Built from the law itself, written for you to understand

Most compliance tools rely on someone's interpretation of what the regulations mean. This one does not.

We start with the source: the verbatim, word-for-word legal text of every regulation that governs the use of AI in Europe, the EU AI Act, GDPR, DORA, NIS2, the Medical Device Regulation, the Sixth Anti-Money Laundering Directive, the EBA guidelines on loan origination, and PSD2.

From that text we identify every concrete obligation an organisation must meet, not the headline themes, but the specific, enforceable requirements set out in the articles. Each obligation becomes a single, focused question.

Then comes the part most tools skip: we translate each question into plain English. A requirement phrased as 'discharge your Article 26(2) obligations regarding human oversight of high-risk systems' helps no one. So instead we ask: 'Have you assigned a named person with the training and authority to monitor each AI system and step in if something goes wrong?' Same legal obligation, answerable by anyone.

Every question carries its source article, the enforcement date, the level of risk, and what is at stake if the answer is no. Nothing is invented, nothing is generic, and nothing is left vague. The questions are developed for review by qualified legal counsel.

The result is an assessment grounded in the actual law, clear enough for your whole team to engage with, and precise enough to show you exactly where you stand, article by article.

For informational purposes only. Not legal advice. greyguardconsulting.com