CONSUVATION guides you through AI inventories, risk classification, and the training obligation under Art. 4 AI Act — with personal consulting and our own software solution: a complete AI management system, scalable to companies of any size and requirement profile.
From the first inventory to a certifiable AI management system — we bring the technical depth, you keep the decision-making authority.
Structured capture of all AI systems used in the company, including shadow AI, and risk classification according to the four risk classes of the AI Act.
Building a certifiable AI management system with a statement of applicability, a maturity dashboard, and controls aligned with the standard.
Target-group-specific training concepts for users, executives, and IT to demonstrably embed AI literacy across the organization.
Risk management system, human oversight, and documentation for high-risk applications — particularly in HR and credit scoring.
Internal AI policies for the safe use of ChatGPT, Copilot & co., including protection of trade secrets.
Audit-proof documentation so you can respond promptly to inquiries from market surveillance authorities.
Whether personal support from our consultants, our own software solution for implementing AI Act requirements, or both together: CONSUVATION offers a complete AI management system — precisely scalable for companies of any size, from a single application to a group-wide AI portfolio.
Individual consulting from certified professionals (CISA, CISM, CRISC, CGEIT) — for companies who want to partially outsource responsibility.
Our own software solution for the complete implementation of AI Act requirements: a full AI management system — scalable for companies of any size and requirement profile, from a single mandate to a corporate group. Hosted & developed in Germany, GDPR-compliant.
The combination is most effective: our consultants configure the software precisely for your company and hand over a system you can then maintain independently — including ongoing updates as legal requirements change.
All packages are guide prices for a typical mid-sized company and are tailored to your company size and system landscape during the initial consultation.
Initial assessment & prioritization
Project-based, approx. 2–3 consulting days
Full implementation support
Duration approx. 8–12 weeks
Ongoing support
Individual mandate, retainer available
For small teams & single mandates
Up to 10 AI systems, 3 users
For mid-sized companies & external DPOs
Up to 50 AI systems, unlimited users
Corporate groups
Unlimited systems & clients
All prices are calculated individually based on your company size, number of systems, and desired scope — plus statutory VAT. After the initial consultation, you will receive a concrete, non-binding quote. Software hosting & development take place in Germany.
Not every AI system is regulated equally strictly — your obligations depend on the risk posed by the application in use.
6 questions, 3 minutes. You'll receive both a risk assessment of your AI application and your organizational maturity level. The evaluation runs entirely in your browser — no data is transmitted to us or third parties.
We clarify your starting point, affected systems, and your role (provider/deployer) in a 30-minute initial meeting.
Joint collection of all AI systems, including shadow IT, and comparison against AI Act requirements.
Classifying each application into the four risk classes and deriving concrete, prioritized measures.
Building policies, an AI policy, an ISO/IEC 42001 AIMS structure, and audit-proof evidence documentation.
Employee training under Art. 4 AI Act as well as regular updates as legal requirements change.
CONSUVATION works exclusively with experienced senior consultants. With over 25 years of experience in information security, we are among the pioneers of the industry — our experts were among the first certified auditors for BS 7799, the British standard widely considered the direct precursor to today's ISO 27001.
Our consultants combine this unique foundational knowledge with current practical experience in ISO 27001 and ISO 27701 — as consultants, certified auditors, and active members of ISO working groups for both standards. Because information security and data protection are inextricably linked under the AI Act — training data, data quality, and system security depend on one another — we consider ISMS (ISO 27001) and PIMS (ISO 27701) together from the outset, rather than in isolation.
This insider knowledge from over two decades flows directly into your AI Act implementation — for maximum legal certainty and conformity with the standards.
Consultants, auditors & ISO working group members — deep first-hand knowledge of the standards for information security and data protection.
A proven approach from risk classification to a certifiable AI management system.
Specialized expertise in data security & compliance — proven in practice.
Our consultants hold the most respected international ISACA certifications — from IT audit to security management to IT governance.
Looking ahead: For established management systems such as ISO 27001, TISAX, and CADIS, compliance with relevant legal requirements has long been a must for a successful audit — auditors specifically check whether applicable law is being followed. It is foreseeable that AI Act implementation will likewise become a firm prerequisite for a successful audit within these systems. Documenting AI Act compliance early helps you avoid evidence gaps later on in ISMS, TISAX, or CADIS audits.
Many AI systems run on infrastructure that also falls under NIS2. We consider both regulatory frameworks together.
An established ISMS significantly simplifies meeting the AI Act's requirements for data quality and security.
AI training and operation almost always involve personal data — we align AI Act compliance with GDPR requirements.
AI in production lines and quality assurance, aligned with TISAX requirements (advisory/preparation).
Three terms that are often confused in practice. Here's how they relate to each other.
As of: 30 July 2026
The "AI Act" is Regulation (EU) 2024/1689 — the world's first comprehensive legal framework for artificial intelligence. It defines how AI systems may be developed, placed on the market, and used within the EU.
As an EU regulation, it applies directly in all member states — without needing to be transposed by a national law.
"KI-Verordnung" (short: KI-VO) is simply the official German name for the same Regulation (EU) 2024/1689 — content-wise identical to the "AI Act". Both terms are used interchangeably in consulting, the press, and specialist literature.
The substantive obligations (risk classification, transparency, conformity assessment) arise directly from the AI Act itself.
The AI Market Surveillance and Innovation Promotion Act (KI-MIG) is Germany's implementation act for the AI Act. It creates no new substantive obligations but instead regulates the national supervisory structure: it designates the Federal Network Agency (Bundesnetzagentur, BNetzA) as the central market surveillance and single point of contact, sets out the fine procedure, and establishes AI regulatory sandboxes.
The Bundestag passed it on 11 June 2026, the Bundesrat approved it on 10 July 2026; promulgated in the Federal Law Gazette, it entered into force on 29 July 2026.
Official legal texts for further reading:
Yes. "AI Act" is the original English name, "KI-Verordnung" (KI-VO) is the official German term for the same regulation (EU 2024/1689).
Yes. Simply using an AI system in a professional context — such as a purchased chatbot or HR software — makes you a deployer with your own obligations.
The Digital Omnibus pushed back the original deadline to at least 2 December 2027, and to 2 August 2028 for products regulated under Annex I. Prohibited practices, however, have already applied since February 2025.
Up to €35 million or 7% of global annual turnover for prohibited practices, up to €15 million or 3% for high-risk violations — whichever amount is higher.
It provides an initial, non-binding assessment of the risk class of your AI application. It does not replace individual legal advice or a formal conformity assessment.
Start with our free self-check, or arrange a non-binding initial meeting with our consulting team directly.
This page is for general information purposes only and does not replace legal advice. Sources: EUR-Lex, German Bundestag, Federal Ministry for Digital Affairs and State Modernisation (BMDS). As of: 30 July 2026. A service provided by CONSUVATION.