AI Governance and EU AI Act Compliance
encorp.ai helps companies in Bulgaria and the EU govern AI responsibly — AI policies, an AI risk register, AI literacy under Article 4 of the EU AI Act and oversight by leadership. In the Encorp AIM method governance starts in week 1 — policies and data are checked in week 1, AI literacy training follows in week 3 and a draft AI policy in week 4 — and continues every month in AI Ops.
AI without governance is a regulatory and reputational risk. We set up policies, oversight, and risk control that scale with your AI footprint — built for the European regulatory context, not retrofitted from US frameworks.
- Aug 2024EU AI Act enters into force
- Feb 2025Prohibited AI practices ban
- Aug 2025GPAI obligations + governance bodies
- Aug 2026Transparency rules apply
- Dec 2027High-risk uses in key areas
- Aug 2028High-risk systems in regulated products
Are you ready for the next deadline?
| Who it is for | Companies that use or implement AI tools, agents or automated solutions |
|---|---|
| What you get | An AI policy, an AI risk register, vendor rules and a training plan |
| First result | An AI risk register within 30 days |
| AI literacy | Training with a certificate of completion of AI literacy training (Article 4 of the EU AI Act) |
| Price | on request |
| Encorp AIM phase | From week 1: policies and data (week 1), AI literacy (week 3), draft AI policy (week 4), monthly updates in AI Ops |
What does the EU AI Act require from companies?
The EU AI Act sets obligations according to the risk of the AI systems a company develops or uses. Since February 2025 Article 4 applies, requiring companies to ensure a sufficient level of AI literacy among staff who work with AI systems. Other obligations depend on whether a system falls into a high-risk category and whether the company is a provider or only a deployer. So the answer starts with how exactly the company uses AI.
The first step is knowing which AI systems the company uses and for what. That is why we start with a register of AI systems and risks, an AI policy and rules for choosing vendors. What Article 4 requires is explained in the guide AI literacy under Article 4 of the EU AI Act. This information is not legal advice.
How does AI governance connect to Encorp AIM?
In Encorp AIM, AI governance starts in week 1, not after deployment. It rests on three pillars: the AI policy (who uses what, and which data never goes into AI tools), AI literacy for everyone in scope (a requirement of the EU AI Act) and data control (managed accounts and a security check of every PoC). In week 1 we review policies and data, in week 3 we run the AI literacy training, in week 4 you have a draft AI policy, and in AI Ops it is updated every month.
When solutions go into production in phase 3 (Deployment, weeks 11–12), their rules are already in place: who is responsible for each solution, which data it uses, how results are checked and what happens when something goes wrong — and every process has a process owner. AI literacy under Article 4 is covered in phase 1 through AI training for companies. The AI Director owns the result end to end, governance included, and after go-live the work continues in AI Ops, where the audit trail is collected. The method is described on AI transformation for companies · the Encorp AIM method.
AI without governance is a regulatory and reputational risk you can't see — until you do.
The EU AI Act is now in force. Bulgarian and EU enterprises that deployed generative AI, AI agents, or model-driven decisions need policy, oversight, and risk control that hold up under audit. Tooling is the easy part — governance is what separates a compliant AI footprint from a board-level liability.
A complete AI governance program — not a policy PDF
We don't sell templates. We embed with your team, map your AI footprint, classify by risk, and stand up the policies, controls, and oversight cadence you need.
EU AI Act mapping & classification
Full inventory of every AI system — internal, vendor, embedded — classified by risk tier (prohibited, high, limited, minimal).
AI policy templates
AI usage policy, vendor policy, generative-AI policy, model-risk policy. Bilingual (EN/BG), Bulgaria + EU-aligned, ready to deploy.
AI risk register & model lineage
Single source of truth for every model, prompt, dataset, and decision — auditable, queryable, and continuously updated.
Prompt injection & data residency review
Practical security audits aligned to OWASP LLM Top 10 plus EU data-residency and GDPR overlap analysis.
Board-level AI oversight
Quarterly review cadence with KPI dashboards, incident reports, and forward-looking risk assessment for your executive team.
Fractional AI Governance partner
We operate as your outsourced Head of AI Governance — owning policy, register, vendor assessment, and the board cadence on a fractional basis.
Why this matters — and what it costs to ignore
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI law. It applies a risk-based framework: the more impactful the AI system, the stricter the obligations. Bulgarian companies are in scope the moment they place AI on the EU market, deploy AI in their operations, or use AI to make decisions affecting EU citizens — including off-the-shelf tools like ChatGPT used in production.
Compliance is not optional. Some AI Act obligations already apply, transparency rules come into application in August 2026, and high-risk AI obligations phase in across 2027–2028 depending on the use case. Companies caught without proper governance face enforcement actions, market access restrictions, and reputational damage that compounds quickly in B2B sales cycles where compliance reviews are now standard procurement gates.
Penalties for non-compliance
EU AI Act · Art. 99Banned outright — social scoring, real-time biometric ID in public spaces, manipulative AI, emotion recognition in workplaces and schools.
AI in HR, credit scoring, education, critical infrastructure, law enforcement, medical devices. Requires risk management, data governance, transparency, human oversight, post-market monitoring, and CE-marking-style conformity assessment.
Chatbots, deepfakes, emotion recognition outside workplaces. Transparency obligations — users must know they're interacting with AI; AI-generated content must be labelled.
Spam filters, AI in video games, recommendation engines without sensitive impact. Voluntary codes of conduct only.
Most Bulgarian companies have at least one high-risk or limited-risk system in their AI footprint and don't know it yet. We translate the regulation into something operational: a risk register, policies your team will actually follow, and a quarterly review cadence that keeps your board informed and audit-ready.
From audit to ongoing oversight
First measurable artefacts within 30 days. Full board-level cadence operational within 60. Then we run the program — or hand it back to your team.
AI inventory & risk classification
We map every AI system — internal builds, vendor tools, embedded features — and classify each by EU AI Act risk tier.
- Comprehensive AI inventory
- Risk classification report
- Gap analysis vs EU AI Act
Policy set & risk register
We deliver the policies, the AI risk register, and vendor assessments — drafted for your business, reviewed with legal and engineering.
- AI usage + vendor + GenAI policies
- AI risk register with controls
- Top-10 vendor assessments
Oversight cadence & training
We set up the quarterly board cadence, train executives and managers, and run the first review with your leadership team.
- Board AI dashboard
- Executive AI training
- First quarterly AI review
Fractional governance partner (optional)
We operate as your outsourced Head of AI Governance — running quarterly reviews, updating the risk register, assessing new vendors, owning audits.
- Quarterly board reviews
- Continuous risk register updates
- Audit & incident response support
What you get out the other side
Concrete artefacts and a working oversight motion — not a 200-page report you'll never reread.
Pair AI Governance with
Governance is the foundation. These pair well to extend its reach across your AI footprint.
AI Director
Strategic AI leadership without the C-suite price tag — owns AI strategy, policy, AI risk register, and EU AI Act alignment.
AI Training
Practical, role-specific AI training for executives, ops, and engineering teams — with privacy and EU AI Act compliance baked in.
Fintech
AI automation and governance for Bulgarian and EU fintechs and banks — KYC, fraud detection, document processing, and regulatory-aligned LLM deployment.
AI governance writing
Practical guides and analysis on the EU AI Act, AI policy, and risk management.
AI Adoption Services After Meta Drops Token Counts
AI adoption services matter more when companies stop rewarding token counts and start measuring results. Meta’s policy shift shows why impact-first rollout beats usage-first metrics.
AI Content Generation Detection Becomes a Workflow Decision
AI content generation detection is shifting from niche software to workflow policy as Pangram's funding, platform adoption, and public scoring reshape trust decisions.
Agent Training Environments Get Adaptive With EnvHarness
Agent training environments are shifting from fixed benchmarks to adaptive worlds. EnvHarness shows teams how to target policy weaknesses without rebuilding simulators.
AI governance — common questions
What is AI governance?
How does the EU AI Act apply to my Bulgarian company?
Do I need an AI policy if my team only uses ChatGPT?
What's the difference between AI governance and AI security?
How do I set up board-level AI oversight?
How long does an AI governance implementation take?
What does AI governance cost?
Can encorp.ai be our outsourced AI governance partner?
Get your AI risk under control in 30 days.
Book a free 30-minute AI governance review. We'll map your AI footprint, identify your top 3 risks, and recommend a starting point — no commitment.
No sales pressure · Free 30-min consultation · Bilingual delivery (EN/BG)