Direct answer: an AI governance consultant has to understand three things at once: risk classification and role determination under the AI Act, building an ISO 42001 management system, and the technical requirements of data governance and model validation. Knowing only one of them usually ends in technology without records, or a system that classifies the risk level wrongly. The AI Act's high-risk obligations have been postponed to 2 December 2027 (stand-alone systems) and 2 August 2028 (AI embedded in products), but they have not been cancelled.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Risk classification | Which risk class is my AI system in? On what basis? |
| Role determination | Am I a provider or a deployer? How do the obligations differ? |
| Management system | Which procedures and records does ISO 42001 require? |
| Technical validation | How do I demonstrate data governance, bias and robustness? |
| Overlap with other regulations | My product contains AI: how are the CRA and the GDPR handled together? |
| Who leads | Who actually runs the engagement? What are their qualifications? |
| Named cases and reference customers | Can you provide named cases or reference contacts in my industry and at my scale? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Risk classification: every AI system is inventoried and classified against the AI Act
- Role determination: roles and obligations are determined from the actual use case
- Management system: an AI management system with impact assessment and human-oversight procedures
- Technical validation: legal, process and technical expertise are planned together
- Overlap with other regulations: the link to Article 12 of the CRA, and an integrated system for personal data and AI
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced; consultants hold ISO 42001 lead-auditor credentials
When you may not need a consultant
If you only need technical work such as model testing or bias evaluation, an AI engineering team or a test laboratory may be the more direct route.
Related questions
- How should budget and timeline be planned? ISO 42001 and AI Act budget and timeline
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.