AI governance path

The AI Governance Roadmap: Where Are You, and Where Do You Start?

Five steps, from finding your AI to certifying it. Find the line below that sounds like you and start there. You only buy the next step when the last one has done its job.

Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.

Book a scoping call See the path

The AI governance path

Where are you on the path?

Find the line that sounds like you. That is where you start.

Step	Start here if…	What you get	Where to buy
1 Assess EU AI Act Readiness Assessment	You don't know where AI is being used in your business, or whether the EU AI Act applies to you.	An inventory of your AI EU exposure check and your role Risk classification Gap review A board action plan	Start here
2 Plan Executive AI Strategy Day	You know where AI is used, but not what to fix first or what to fund.	One day with the leadership team Priorities with named owners A 90-day plan the board can fund	Start here
3 Build AI Governance Foundations	You have a plan, but no AI register, no AI policy and no training.	An AI register A risk assessment An AI use policy Training for executives, managers and staff An annual review	Start here
4 Implement EU AI Act Implementation	You have the basics, but your AI isn't classified under the Act and you can't evidence control of your high-risk uses.	Every AI use classified Data and supplier review An evidence file Risky uses fixed Quarterly board reporting to 2 December 2027	Start here
5 Certify ISO/IEC 42001	Clients, tenders or insurers are asking for independent proof.	A gap check against the standard An AI management system A route to independent certification	Start here
All steps Fractional Chief AI Officer	Nobody on your board owns AI and you want it run for you.	A named Chief AI Officer Every step run for you A quarterly report to the board	Start here

FAQ

Frequently asked questions

Do we have to do every step?

No. Start at the line that sounds like you. If you already have a register and a policy, you may go straight to EU AI Act Implementation. Not every organisation needs ISO 42001 certification.

Where should we start if we are not sure?

With the EU AI Act Readiness Assessment. It finds where AI is used and whether the Act applies, which tells you the next step.

Is ISO 42001 a replacement for the earlier steps?

No. ISO/IEC 42001 builds on them. Foundations and EU AI Act Implementation sit before it, and everything done in those steps carries into the AI management system.

Can someone run the whole path for us?

Yes. A Fractional Chief AI Officer runs every step and reports to the board each quarter.

Next step

Not sure where you are on the path?

Tell us what governance you have today. We will reply personally with the step we would start from, usually within one working day.

Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.

AIPEX provides governance and strategy advice, not legal advice. AIPEX is not a certification body and does not certify organisations.