Most AI governance guidance assumes you built the model. The reality in almost every enterprise is the opposite: AI arrives embedded in SaaS products, as API calls to foundation models, and as features enabled by default in tools already in use.
This whitepaper addresses that reality directly. It sets out where accountability sits between provider and deployer under the EU AI Act and ISO 42001, what a deployer can and cannot delegate, and the specific evidence a deployer must hold.
It includes a vendor question set covering training data, retention of prompts and outputs, evaluation evidence, sub-processors, model change notification and exit — the questions traditional security assessments do not ask.
Why it is structured the way it is, and the failure patterns it was designed around.
Most AI impact assessments are too heavy to trigger or too light to matter. A twelve-question threshold, a full template that forces the analysis before design locks, and what ISO 42001 auditors actually examine.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 1.3, revised 2 July 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
PDF · 38 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Role determination is the first decision and the one most often got wrong. A practical walkthrough of provider versus deployer obligations for Indian firms serving European customers.
You cannot govern an AI inventory you do not have. Four discovery methods that surface built, bought and embedded AI — including the tools nobody put through procurement.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
