The technology arrived
before the governance did.
Organisations are deploying AI avatars, voice clones, and digital twins at pace — with minimal governance, unclear accountability, and no framework for managing what happens when something goes wrong.
The EU AI Act is now in force, and the window to retrofit governance into active deployments is narrowing as enforcement activity increases. The risks below are live operational, legal, and reputational exposures — and they accumulate silently until something goes wrong.
Three stages.
One continuous path.
These are not discrete services to be selected from a menu. Each stage builds directly on the previous one. Most organisations follow the full sequence — assessment establishes your baseline, advisory closes the gaps, and the retainer maintains the standard as your deployment and the regulatory environment evolve.
What's Included
- Full assessment against all 18 DPIF controls — 14 CPCs and 4 SPCs
- Context Risk Classification: identifying your deployment's risk tier (Low / Moderate / High / Regulated)
- Prioritised gap analysis with severity ratings (Critical / Moderate / Minor)
- Written remediation roadmap with recommended actions, timelines, and ownership
- SPC maturity infrastructure review against the Scoring Rubric
- 90-minute debrief session with our team
- Written assessment report suitable for internal governance, legal review, or regulatory disclosure
The Outcome
At the end of the Readiness Assessment, your team will know exactly where you stand against DPIF, which controls require remediation and in what order, and what a realistic path to certification looks like for your specific deployment context.
Book this engagement →What's Included
- Systematic gap closure — working through your remediation roadmap control by control
- Template governance documentation: consent frameworks, audit trail specifications, incident response protocols
- Fortnightly advisory sessions throughout the engagement
- Review of draft governance documents and controls implementation
- Pre-certification readiness check against all 18 DPIF controls
- Regulatory alignment review: EU AI Act, NIST AI RMF, applicable jurisdiction-level requirements
- Certification recommendation report on completion
The Outcome
At the conclusion of the Certification Advisory, your deployment will be certification-ready — with all controls implemented, documented, and reviewed by the team that authored the framework. The output is governance infrastructure that operates — not a document for filing.
Book this engagement →What's Included
- Monthly governance review and control monitoring check-in
- Scheduled re-assessments aligned to your deployment's context risk tier requirements
- Priority regulatory alerts: EU AI Act guidance updates, local legislation, enforcement actions
- Direct access to our team for governance questions and incident triage
- Framework version alignment — automatic conformance as DPIF evolves
- Annual certification renewal support
- Quarterly governance maturity report
The Outcome
Continuous governance confidence. Your deployment stays compliant as the framework evolves, the regulatory environment shifts, and your deployment scope changes — without requiring your team to maintain that expertise entirely in-house.
Discuss the retainer →Pricing on request. All engagements scoped individually — contact us to discuss your deployment context.
From first contact
to certification
Most organisations complete the full journey from initial assessment to certification readiness in 10–14 weeks. The process is structured, not open-ended — each step has a defined input, output, and duration.
We did not adopt the standard.
We wrote it.
There is a material difference between working with a consultancy that has read DPIF and working with the organisation that designed, published, and maintains it. The framework's architecture, its control classifications, its non-compensatory assessment logic — we built each of these deliberately, and we know exactly what they require in practice.
When your governance is reviewed by the framework authors, the output carries a different evidentiary weight — with your team, your legal counsel, and any regulator who asks.
Not sure where to start?
The assessment will tell you.
The DPIF Self-Assessment takes five minutes and produces a Governance Readiness Score with a pillar-by-pillar breakdown. It costs nothing, requires no commitment, and gives you and your team a concrete baseline before any engagement begins.
Your results map directly to the 18 DPIF controls across five governance pillars — Identity, Authority, Consent, Disclosure, and Containment. Every score includes a pillar-level breakdown so you know exactly where the gaps are.
Tell us a little about your context first — it helps us make the call as useful as possible.
Takes 30 seconds. Not a pitch. If DPIF is not the right fit, we'll say so.