AI Governance and Regulatory Compliance

What We Deliver

"EU AI Act compliance is not a compliance exercise — it is a governance design challenge. The organisations that get it right will have a structural advantage in public sector AI procurement."

— Dr Stylianos Kampakis, Managing Director, Tesseract Academy

AI governance is now a legal obligation, not an optional enhancement. Regulation (EU) 2024/1689 (the EU AI Act) — the world's first comprehensive AI law — classifies AI systems by risk level and imposes mandatory requirements for high-risk systems, including algorithmic impact assessments, human-in-the-loop controls, bias monitoring, and technical documentation. For UK public sector bodies procuring or developing AI systems that interact with EU citizens or are placed in EU markets, compliance is mandatory. UK government guidance on algorithmic transparency and the ICO's Explaining Decisions Made with AI create parallel obligations under UK law.

Tesseract Academy delivers end-to-end AI governance programmes covering the full compliance lifecycle. We begin with a risk classification assessment — mapping AI systems against EU AI Act Annex III categories and NIST AI RMF risk dimensions — and produce a governance roadmap with prioritised remediation actions. We then support implementation of algorithmic transparency disclosures aligned to the UK AI Framework, bias audit protocols, Data Protection Impact Assessments (DPIAs), and human-in-the-loop control design. The Department for Science Innovation and Technology (DSIT) and the UK AI Safety Institute set the policy context within which our governance programmes operate.

Our open-source AI governance platform (open-governance, available on GitHub) provides 48 governance tools covering automated risk classification, compliance matrices against EU AI Act, NIST AI RMF, and ISO 42001, bias and hallucination monitoring, policy enforcement gates, and audit-ready reporting. The platform is designed for public sector use and can be self-hosted to avoid data leaving organisational boundaries — an important consideration for systems handling personal or classified information. The Alan Turing Institute and NESTA have both called for open, auditable governance tooling of precisely this kind; our platform directly responds to those recommendations. Crown Commercial Service (CCS) and Cabinet Office procurement teams have engaged with this tooling as a reference implementation for algorithmic transparency.

We contributed expert analysis to the Financial Conduct Authority's consultation on stablecoin regulation in 2025, demonstrating our capability to engage at the frontier of AI and financial technology regulation. We are Cyber Essentials certified and operate ISO 27001-aligned information security controls, meeting the security baseline required for contracts involving personal data or government OFFICIAL classification. Our services are procurable via Crown Commercial Service (CCS) RM6200, and NHS England, HM Treasury, and Office for National Statistics (ONS) clients can access our governance services through standard framework routes.