Artificial intelligence
Agents act at scale. Do you know what they are doing?
Almost every organization can list its AI agents. Almost none can say, with evidence, what they do, what they are worth and how far one mistake can go. That is what we measure, and then help build and govern.
New · FZ AI Auditor
Are your AI agents doing what they should, and are they worth what they cost?
An evidence-based audit of the scope, value realized and blast radius of your deployed agents.
The EU AI Act calendar has changed
The Digital Omnibus (Regulation (EU) 2026/1744) is in force. These are the dates to know, based on Orrick's 29 July 2026 summary. Check them with your legal advisers and the text in the Official Journal.
| 2 December 2026 | Article 50(2) transparency (synthetic content) for systems placed on the market before 2 August 2026; new Article 5 prohibitions (non-consensual intimate imagery and child sexual abuse material). |
|---|---|
| 2 December 2027 | Obligations for Annex III high-risk systems (instead of 2 August 2026). Systems already on the market are covered only if substantially modified after that date. |
| 2 August 2028 | Obligations for Annex I high-risk systems (regulated products). Deadline for the Commission's delegated act on sector overlaps. |
| 2 August 2030 | Compliance for AI systems intended for public authorities. |
Source: Orrick, “EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes”, 29 July 2026. This page was corrected on 29 October 2026: it previously described the calendar without dates. Orrick: EU AI Act Update, Digital Omnibus Finalizes 8 Compliance Changes
AI strategy and adoption
Most organizations do not have too few AI ideas. They have too many pilots, and no way to tell which one paid off.
Most organizations already use AI, often without knowing it. We start from your vision and constraints to choose a few high-value use cases, then support their real adoption by teams.
Vision workshop
We run a workshop that aligns leadership on goals, limits and the acceptable level of autonomy for your first agents. Getting this alignment early avoids the late disagreements that often derail AI initiatives partway through.
Use case portfolio
We score each idea on value, feasibility and risk to choose which ones go first, rather than starting several directions at once. A tighter portfolio delivers visible results faster than a long list that never gets finished.
Roadmap
We sequence pilots, data foundations and governance over 12 to 18 months, factoring in your budget constraints and regulatory deadlines. The roadmap stays alive: it gets revised at every milestone rather than being fixed from day one.
Adoption and training
We train the relevant teams, help build an internal community of practice, and set up real usage metrics. Adoption is measured by what teams actually use day to day, not by the number of licenses activated.
What you get
- AI vision statement approved by leadership
- Prioritized use case portfolio
- 12- to 18-month roadmap
- Training plan and adoption metrics
AI agent design and build
An agent is a new employee with a login and no common sense. Give it a scope, a manager and an off switch.
An agent is not just an assistant: it acts in your systems. We design each agent with its scope, tools, access rights, human approval points and metrics, then evaluate it before production.
Design
We define tasks, tools, accessible data and each agent's autonomy level with the business teams before writing a line of code. This step avoids building an agent that is technically impressive but poorly aligned with the real need.
Build
We build on the platform of your choice, including Microsoft Foundry and Copilot Studio, without locking you into a single ecosystem. The platform choice follows your existing constraints rather than our preferences.
Evaluation and testing
We build representative test sets, run prompt injection attack tests, and track quality metrics over time. An agent that works once in a demo is not yet an agent ready for production.
Production
Each agent gets its own identity, complete logging of its actions, active monitoring and a ready-to-use rollback plan. These guardrails let you increase autonomy gradually, as trust builds.
What you get
- Agent design brief
- Working, documented agent
- Evaluation and security report
- Operating and shutdown procedures
AI governance, risk and compliance
A policy nobody follows is worse than none: it creates the illusion of control. Keep it short enough to be followed.
AI governance extends what you already do in security and risk management. We set up a proportionate framework: what is allowed, what needs approval and how usage is monitored.
Acceptable use policy
We write clear rules for staff, the data they can share with an AI tool, and the list of approved tools. The policy stays short and understandable, so it is actually followed rather than worked around.
Inventory and shadow AI
We list the AI tools and agents actually in use across your organization, official or not, often adopted by teams before leadership even knows about them. This inventory is the essential starting point for any credible governance.
Risk classification
We classify your use cases under the EU AI Act and your own risk criteria, to identify which ones need special attention. This classification then guides the level of control and approval required for each new project.
Management system
We align your governance framework with ISO/IEC 42001 and the NIST AI RMF, two recognized frameworks that structure AI risk management. This alignment also makes future compliance demonstrations to clients or auditors easier.
What you get
- AI acceptable use policy
- AI system register
- Classification and approval method
- Compliance roadmap
Platform and alignment
Why a resilience firm?
AI agents are becoming critical systems: they have access, make decisions and can fail. We treat them that way, with identity, limits, monitoring and a recovery plan from the start.
Frequently asked questions
Where should we start?
With our vision questionnaire: it prepares the workshop and surfaces gaps between participants' expectations.
Can an agent act on its own?
Yes, within defined limits. We recommend starting with agents that propose actions and increasing autonomy as trust builds.
Does the EU AI Act apply to us?
Whether it applies depends on your role (provider or deployer) and your use cases, including outside the EU if your systems are used there. Its obligations phase in over time, and the calendar has changed: since the Digital Omnibus (Regulation (EU) 2026/1744), high-risk obligations for Annex III systems apply from 2 December 2027 and for Annex I systems from 2 August 2028, instead of 2 August 2026. We help with inventory and classification, alongside your legal advisers.