You can't govern what nobody has counted.

Often yes. It reaches providers and deployers whose systems are used in the EU or whose outputs are used there, regardless of where you're incorporated — the same extraterritorial logic as GDPR. The practical trigger is usually simpler than the legal test: an EU customer asks you to evidence compliance in a procurement round. The register tells you where you stand in about three weeks.

Because the artefacts these frameworks demand are technical ones. Accuracy and robustness testing, logging, human oversight, post-market monitoring — those are engineering deliverables, and law firms rightly won't build them. We work alongside your counsel: they own the legal interpretation, we build and evidence the controls. If you need an opinion on liability, we'll tell you to ask a lawyer.

Proportionately, and less than the alternative. Most systems in a typical register are low-risk and should carry almost no process — the point of tiering is to concentrate effort where it matters. What does take real work is the handful of consequential systems, and those are the ones where an incident would cost you far more than the controls. Teams that wire evals into CI early usually ship faster afterwards, because they stop hand-testing every release.

SOC 2 covers how you handle data and run your security programme. It says nothing about whether a model's outputs are accurate, biased, or appropriately overseen — which is precisely what AI-specific frameworks and enterprise AI questionnaires ask about. They complement each other; ISO 42001 is the closest analogue on the AI side, and it maps cleanly onto a SOC 2 programme you already run.

It usually turns up something surprising, and that's the value. Common finds are a team pasting customer data into a consumer chatbot, a vendor whose terms allow training on your inputs, or an automated decision affecting people with no oversight path. Every one of those is far cheaper to fix in a planned sprint than during an incident, and none of them is unusual.

No — certification comes from an accredited body, and no consultancy can issue it. What we do is build and evidence the management system so the audit is a formality rather than a project: controls implemented, documentation written, evidence collected in the form auditors expect. We'll also tell you honestly whether certification is worth pursuing for your market, because for plenty of companies it isn't.