Your teams already use AI, and perhaps your products do too. We make sure it happens securely, in line with data protection and fit for the AI Act: with clear rules for internal use and concrete safeguards for AI in your systems. Concrete risks, concrete measures, no hype.
Four situations we currently see in almost every company.
GenAI assistants have arrived in daily work, often via private accounts and without approval. That is not misconduct by your teams; it is a sign that clear rules are missing. Shadow AI does not disappear through bans, but through good alternatives with guardrails.
Prompts contain customer data, source code and internal information. Without an inventory and clear rules you can guarantee neither data protection nor confidentiality, and chances are you only find out once something has happened.
Prompt injection, data leakage through model outputs, manipulated training data, a vulnerable model supply chain: AI features bring their own attack surface that classic security testing does not cover.
Prohibitions, transparency obligations, high-risk requirements: which of these apply depends on how and where you use AI. The good news: the key deadlines are in 2027 and 2028. There is still time for a structured approach.
Rolling out AI internally and building AI into products are different tasks with different risks. We cover both, separately or together.
Governance for daily work: turning uncontrolled use into structured, productive AI adoption.
Security for AI features: understand the attack surface before others do.
From first overview to established governance, in clear steps and without a big-bang project.
The AI readiness & risk check creates clarity within days: which AI is in use, how it is classified under the AI Act and data protection law, and where your biggest risks lie.
In the AI security assessment we model the threats to your AI applications based on OWASP LLM/ML and derive prioritised safeguards, technically concrete rather than abstract.
AI policy, approval processes and security gates in the development process: governance that works in daily practice and connects to ISO 27001 and ISO/IEC 42001.
Workshops and developer enablement, so that secure AI use does not depend on two experts but becomes routine for your teams.
Clear fixed price, defined scope, fast start. Each package can be booked individually.
€1,900
The baseline: we inventory your AI use, classify it under the AI Act and data protection law, and name your biggest risks.
€6,400
For AI in your systems and products: we model the threats to your AI application and derive concrete safeguards.
from €4,900
Copilot, Cursor & co. safely in your development process: a clear policy, security gates and protection against hallucinated or malicious packages.
from €1,600
Bring your team up to speed: AI risks, AI Act obligations and governance, compact and practical.
All prices excl. VAT. The entry point is deliberately lightweight: the readiness check takes a few days and requires no preparation on your side.
The AI Act arrives in stages. None of the deadlines is cause for panic, but governance and evidence need lead time.
The AI Act's prohibitions apply, for example against manipulative systems and social scoring. No practical impact for most companies.
Transparency obligations for providers of general-purpose models. Relevant mainly for model providers, less so for users.
AI-generated content must be labelled. Relevant for everyone who publishes GenAI content.
The requirements for high-risk AI under Annex III apply, after the postponement from May 2026. Affected are defined use cases such as recruitment or critical infrastructure.
AI in product-regulated areas, including medical devices, must meet the high-risk requirements.
Start now and you work without time pressure: first overview and rules, then hardening, then evidence. Our packages are built in exactly that order.
AI security needs both: a technical understanding of the attacks and regulatory classification. We bring both.
Security testing and development practice on one side, regulatory affairs and quality management on the other: we assess AI risks technically and classify them legally. Our partner Dan Gora is a reviewer of the OWASP Top 10 for LLM Applications.
We build AI governance so that it fits ISO 27001 and prepares the path to ISO/IEC 42001, without parallel structures.
For MedTech we bring the combination of AI security and MDR experience: from the Annex I timeline to alignment with the conformity assessment.
You work directly with the specialists, without the overhead of a large consultancy.
In our experience bans do not work; they just push usage out of sight. The effective path: an inventory first, then a clear policy with approved tools and defined data classes, plus a short training. That turns shadow AI into controlled, productive AI use. This is exactly the core of our readiness check.
Very likely yes, but usually more mildly than feared. If you only use AI internally as a tool, your focus is on transparency and labelling obligations plus data protection. The high-risk obligations affect defined use cases (Annex III) and product-regulated AI (Annex I). Classifying your concrete use cases is part of the readiness check.
Not immediately, and not everyone. ISO/IEC 42001 is the management system for AI and becomes relevant mainly for larger organisations and in tenders. What makes sense today is building your AI governance so that it is 42001-ready, especially if you already have ISO 27001. Then the path is short later on.
That depends on the tool and the contract: with free consumer accounts, inputs may be used for training; business agreements usually rule that out. That is why tool selection, data classes and contract terms belong in the AI policy. In the readiness check we examine exactly that and give a concrete recommendation per tool.
It is the foundation, but it does not cover AI-specific attacks. Prompt injection, jailbreaks, data leakage through model outputs or manipulated dependencies in the model supply chain follow different patterns than classic vulnerabilities. The OWASP Top 10 for LLM applications provides an established testing framework for this, and it is what we follow in the AI security assessment.
In a free intro call we clarify where you stand and whether the readiness check is the right entry point. No strings attached, and no hype.
info@actsecure.eu