Question 1

What is the EU AI Act Exposure Checker?

Accepted Answer

The EU AI Act Exposure Checker is a complimentary interactive diagnostic tool that helps organisations understand how their AI systems may be classified under Regulation (EU) 2024/1689, the EU AI Act. You select your sector and applicable use cases, and the tool returns an indicative risk classification: Unacceptable Risk, High Risk, Limited Risk, or Minimal Risk, along with the key obligations that apply and the relevant article references from the legislation. It takes less than two minutes to complete.

Question 2

How accurate is the EU AI Act Exposure Checker?

Accepted Answer

The tool was built on the final published text of Regulation (EU) 2024/1689 and systematically reviewed article by article against the primary source before publication. All classifications and article citations have been verified. The tool is indicative only. It does not constitute a formal legal determination and final classification must be confirmed by qualified legal counsel. A formal QA record documenting the review methodology is available on request.

Question 3

Is there a charge for the EU AI Act Exposure Checker?

Accepted Answer

No. It is complimentary and requires no registration. It is available at theodoramonye.com/diagnostics.

Question 4

What is the ISO 42001 Readiness Heatmap?

Accepted Answer

The ISO 42001 Readiness Heatmap is a complimentary self-assessment tool that allows organisations to rate their current maturity across the seven operative clauses of ISO/IEC 42001:2023, the international standard for AI Management Systems. It covers Clauses 4 to 10, generates a visual gap report, and identifies priority areas for improvement. It is indicative only and does not constitute certification readiness evidence or a substitute for formal assessment by an accredited body.

Question 5

What should I do after completing the diagnostic?

Accepted Answer

The diagnostic gives you an immediate indicative picture of your exposure or maturity. The logical next step is a structured conversation about what the results mean for your organisation specifically: your sector context, your existing governance infrastructure, and the most pragmatic path to compliance or certification. You can request a discovery call directly from the diagnostics page at theodoramonye.com/diagnostics.

Question 6

Can I share my diagnostic results with my board or compliance team?

Accepted Answer

Yes. The results page is designed to be shared. For a more detailed briefing document suitable for board or audit committee presentation, this is something that can be produced as part of a formal engagement with Theodora AI Advisory.

Question 7

Does the EU AI Act apply to UK organisations?

Accepted Answer

It depends on your activities. The EU AI Act has extraterritorial scope. It applies to providers placing AI systems on the EU market and to deployers using AI systems within the EU, regardless of where they are established. A UK-based organisation that sells products or services into the EU, deploys AI systems affecting EU residents, or operates within EU member states may have obligations under the Act. UK organisations deploying AI domestically are not directly subject to the EU AI Act, though equivalent obligations may emerge under UK AI governance frameworks. Independent legal advice is recommended to confirm your specific territorial obligations.

Question 8

What is the difference between Unacceptable Risk and High Risk under the EU AI Act?

Accepted Answer

Unacceptable Risk AI systems are prohibited outright under Article 5 of the EU AI Act. They cannot be placed on the market or put into service. There is no compliance pathway, only discontinuation. Examples include real-time biometric identification in public spaces and emotion recognition systems in workplace or educational settings. High Risk AI systems are not prohibited but are subject to a mandatory compliance regime before market placement, including risk management, technical documentation, human oversight, and conformity assessment obligations under Articles 9 through 15.

Question 9

What are the penalties for non-compliance with the EU AI Act?

Accepted Answer

Penalties vary by violation type. Prohibited practices under Article 5 carry fines of up to €35 million or 7% of global annual turnover, whichever is higher. Violations of other obligations carry fines of up to €15 million or 3% of global annual turnover. Providing incorrect information to authorities carries fines of up to €7.5 million or 1% of global annual turnover.

Question 10

When does the EU AI Act come into force?

Accepted Answer

The EU AI Act entered into force on 1 August 2024 and applies on a phased basis. Prohibited practices under Article 5 applied from 2 February 2025. Obligations for General Purpose AI models applied from 2 August 2025. Transparency obligations under Article 50 apply from 2 August 2026 and are live today. High Risk AI system obligations under Annex III now apply from 2 December 2027, following the delay introduced through the European Commission's Digital Omnibus package. High Risk obligations for AI embedded in regulated products under Annex I now apply from 2 August 2028. The later dates should not be read as additional slack: transparency duties are already enforceable, and conformity work for Annex III systems takes considerably longer than the remaining runway in most regulated organisations.

Question 11

What is the difference between the EU AI Act and ISO 42001?

Accepted Answer

The EU AI Act is binding legislation. It mandates specific obligations for AI providers and deployers operating in the EU market, with enforceable penalties for non-compliance. ISO 42001 is a voluntary international standard that provides a structured framework for establishing, implementing, and maintaining an AI Management System. The two are complementary. ISO 42001 implementation can support and evidence EU AI Act compliance, particularly for High Risk AI systems, but they are distinct instruments with different scopes and obligations.

Question 12

Who does Theodora AI Advisory work with?

Accepted Answer

Theodora AI Advisory works with leadership teams and boards, from start-ups and scale-ups to large enterprises, across the UK, Ireland and Europe: environments where AI governance carries genuine regulatory, reputational, and fiduciary weight.

Question 13

What does an engagement with Theodora AI Advisory look like?

Accepted Answer

Every engagement begins with a discovery call to understand your organisation's current position, regulatory context, and specific governance challenges. From there, engagements are structured around your needs: a board-level AI governance framework, an EU AI Act compliance programme, ISO 42001 gap assessment and implementation support, or training for practitioners and leadership teams. All work is designed to hold up under regulatory scrutiny, audit, and board challenge.

Question 14

What is the difference between AI governance and AI ethics?

Accepted Answer

AI ethics addresses the values and principles that should guide the design and use of AI: fairness, transparency, accountability, and so on. AI governance is the operational and structural implementation of those principles. It encompasses the policies, frameworks, controls, oversight mechanisms, and accountability structures that make ethical commitments real and enforceable within an organisation. Theodora AI Advisory works at the governance level, translating principles into structures that function in practice.

Question 15

How do I get started?

Accepted Answer

The quickest starting point is one of our three complimentary diagnostics: the AI Oversight Readiness Check, the EU AI Act Exposure Checker or the ISO 42001 Readiness Heatmap. If you are a founder or sit on a board, start with the AI Oversight Readiness Check. Each gives you an immediate, indicative view of where you stand. If you would like to discuss your results or explore working together, you can book a discovery call.

Question 16

Is my data secure?

Accepted Answer

Yes. The Governance Hub was designed with security from the start.

Every account, including yours, uses two-step sign-in, so a password alone is never enough to get in. Access is by invitation only.

Your data is encrypted in transit and at rest.

Your organisation's records are kept separate from every other client's. Access controls enforced in the database itself mean other clients can never see your records. Only your own team and your assigned advisors at Theodora AI Advisory can.

Every change to your governance records is logged with who made it and when, so you have a full audit trail.

We review security regularly, and an independent third-party security assessment is planned. We're happy to share more detail with your IT or security team on request.

Question 17

How does Theodora AI Advisory differ from AI governance software platforms such as OneTrust or Vanta?

Accepted Answer

Vanta, OneTrust, and similar platforms are compliance workflow tools. They automate evidence collection, policy documentation, and audit trails, and they do that well. They are not advisors. Theodora AI Advisory is a strategic advisory practice. The work is fundamentally different in nature.

Platforms cannot advise. No software can tell your board what your AI governance obligations actually are, interpret the EU AI Act for your specific sector and use cases, or design an accountability architecture that will hold up under regulatory scrutiny and board challenge. That requires expertise applied to specific circumstances, not automated workflows.

Platforms cannot exercise regulatory judgement. Determining whether a specific AI system falls into High Risk or Limited Risk under the EU AI Act, understanding how the Medical Devices Regulation interacts with your AI deployment in a healthcare context, or assessing whether your agentic AI system triggers specific obligations are judgement calls that require legal and regulatory knowledge, not software configuration.

Platforms are not sector specialists. Deep experience in pharmaceutical, CRO, and NHS environments means understanding the operating context that shapes how governance frameworks need to work in practice, not just what the framework says in theory.

Platforms operationalise and evidence compliance. Tools like Vanta produce compliance evidence for audit purposes and embed governance into day-to-day workflows. Theodora AI Advisory designs the governance architecture that makes that operationalisation meaningful: starting at board level, embedding accountability into operating models, and preparing leadership to answer hard questions from regulators before those questions are asked.

In practice these are complementary rather than competing. Many organisations will use a compliance platform to operationalise and evidence their governance framework on an ongoing basis. The strategic and governance work that makes that platform meaningful, and ensures it is built on the right foundations, comes first.

If your organisation already uses a compliance platform, the toolkit documents and governance framework can be mapped to your existing control structure as part of an engagement. Theodora AI Advisory can advise on how to align the framework to your platform's architecture, ensuring the strategic foundations and the operational tooling are working from the same governance logic.

If your organisation is at the stage of asking which platform to use, the prior question is whether the governance architecture the platform will operationalise is the right one. That is the conversation Theodora AI Advisory is here to have.

Question 18

What should I look for when choosing an AI governance advisor?

Accepted Answer

AI governance is an emerging field and the range of people presenting themselves as advisors varies considerably in depth, rigour, and relevance to regulated industries specifically. When evaluating an advisor, the following criteria matter.

Regulatory literacy. AI governance in a post-EU AI Act environment requires the ability to read and interpret complex legislation accurately, not summarise it loosely. Look for advisors who can cite specific provisions, explain how they interact, and apply them to your sector context with precision. Ask to see how their tools and frameworks reference the primary legislative text.

Regulated industry experience. General technology or management consulting experience is not the same as understanding how compliance, risk management, and governance infrastructure function inside organisations subject to genuine regulatory scrutiny. Advisors with direct experience inside pharmaceutical, financial services, healthcare, or public sector environments will ask different and better questions.

Governance qualification. AI governance that operates at board level requires understanding of how boards function, how accountability is structured, and how governance frameworks are designed to hold up under challenge. Relevant qualifications include Institute of Directors certifications, governance-focused executive education, or direct experience in formal oversight roles.

Framework specialism. The EU AI Act and ISO 42001 are distinct instruments with different scopes and obligations. An advisor who is genuinely specialist in both, rather than offering a general overview, will be able to navigate the interaction between them and identify what is actually required for your specific situation.

Independence. Choose an advisor with no commercial ties to technology vendors and no commissions, so every recommendation is driven by your needs. Theodora AI Advisory does not resell third-party AI tools or hold commercial relationships with technology vendors. Independent advisors can give you an honest assessment of what you actually need, which may be less than, or different from, what a vendor-aligned consultant would propose.

Theodora AI Advisory was built around all of these criteria. If you would like to assess whether the fit is right for your organisation, the starting point is a discovery call at theodoramonye.com/intake.

FAQ

About the diagnostic tools

About the EU AI Act

About Theodora AI Advisory

Choosing the right advisor