Applied AI
AI governance and ISO 42001
AI governance is the set of controls, documentation and oversight that lets a business show how its AI systems are classified, tested, monitored and supervised, whether or not a regulation requires it. ISO 42001 is the international standard for AI management systems and is increasingly asked for in procurement. Hexploits builds governance into the delivery of AI systems and maps it to ISO 42001; the EU AI Act specifically is covered on its own page.
A named engineer replies within one working day. A written scope and an indicative price within two.
Who this is for
- Businesses that deploy AI in hiring, credit, insurance pricing, education or infrastructure.
- AI vendors with provider obligations under the Act.
- Compliance functions asked to sign off systems they did not build.
What you get
Deliverables, not slogans. Each one appears in the statement of work.
- An inventory of AI systems with risk classification against the EU AI Act and the reasoning.
- Technical documentation, risk management records and human-oversight procedures for high-risk systems.
- Logging and monitoring that produce the evidence the Act requires.
- A gap analysis against ISO 42001 with a prioritised plan.
- A completed answer to the AI section of customer due-diligence questionnaires.
Our engineers work across the major languages, frameworks and cloud platforms. We build on the stack you already run, with technology choices explained in writing before work begins.
How it is delivered
The same four stages as every Hexploits engagement, applied to this capability.
Stage 1
Inventory and classify
Every AI system, bought or built, is listed and classified. Most SME systems are limited or minimal risk; the ones that are not get the attention.
Stage 2
Gap analysis
Current controls are compared with what the Act and ISO 42001 require, and the gaps are prioritised by deadline and exposure.
Stage 3
Build the controls
Documentation, logging, testing and oversight are built into the systems and the release process rather than kept in a binder.
Stage 4
Monitor
Post-market monitoring, incident handling and periodic review under managed support.
How success is measured
Every engagement agrees its measures and the measurement period in writing before work starts.
- A classified inventory a regulator or customer can be shown.
- High-risk systems with complete documentation before the applicable deadline.
- Due-diligence questionnaires answered from evidence rather than assertion.
Proof
Case studies with numbers, and reviews linked to Google where they were left there.
swarmd.ai · Software vendor · 6 months
Enterprise AI control plane delivered in six months at 75% under budget for a UK software vendor
JobVantage · Recruitment technology · Duration TBC
99.9% availability and sub-100ms responses for a recruitment intelligence platform, at negligible infrastructure cost
Director, IO Solutions
“Fantastic to work with. High level of attention to detail and flawless communication throughout. Would recommend to anyone looking to develop or improve a software product.”
Director, JobVantage
“Working with Hexploits has genuinely been a pleasure, and I see them as my scaling partner for the foreseeable future as JobVantage grows. If you’re looking for a development team who combine strong AI/engineering capability with honesty, flexibility and a real interest in your business, I’d strongly recommend them.”
Questions we get asked
Does the EU AI Act apply to a UK company?
What are the deadlines?
Is this legal advice?
What is ISO 42001?
Related
Sectors where this is most often needed
- Compliance and regulation technology
- Financial services and payments
- Recruitment and HR technology
- Charities and education
- AI technology companies
Reading
EU AI Act High-Risk Series, Part 1: Recruitment & HR Tech
CV screening, candidate ranking and performance monitoring tools are high-risk under the EU AI Act, and one interview-scoring feature is banned outright. What a recruitment business or HR technology vendor has to build by December 2027, and why the commercial effect arrives sooner.
EU AI Act High-Risk Series, Part 2: Finance & Insurance
Credit scoring and life or health insurance pricing are high-risk under the EU AI Act, with a mandatory impact assessment for every deployer. What a lender, insurer or payments business has to build by December 2027, and how to do it once for every regulator.
EU AI Act High-Risk Series, Part 3: Education & EdTech
Admissions, grading and exam-monitoring tools are high-risk under the EU AI Act, and emotion recognition in proctoring is banned outright. What universities, exam boards and EdTech vendors have to build by December 2027, and why institutional buyers are already asking.
EU AI Act High-Risk Series, Part 4: Healthcare & MedTech
Healthcare AI has two EU AI Act deadlines eight months apart, and which applies depends on whether your product is legally a medical device. How to classify correctly, what goes in the technical file, and why health-system procurement is already asking.
EU AI Act High-Risk Series, Part 5: Critical Infrastructure
AI managing power grids, water supply or road traffic is high-risk under the EU AI Act only where it is a genuine safety component, and part of the scope test is still draft guidance. How utilities, operators and their vendors should classify, and what to build if they are in scope.
More in applied ai
Internal AI assistants and copilots for UK businesses
EU AI Act readiness for UK businesses
AI document and email processing
AI decision support and forecasting
Agentic AI workflows with governance
AI sovereignty: private and EU-hosted AI
AI in payments, credit and fraud under the EU AI Act
AI for recruitment: sourcing, screening and matching automation
EU AI Act for recruitment and HR: high-risk hiring AI explained
AI governance readiness for recruitment and HR businesses
Next step
Request a proposal.
Tell us about the system and the sector. A named engineer replies within one working day. A written scope and an indicative price within two working days of a short scoping call.