Your board, your clients, or a regulator will ask to see your AI governance.
What will you show them?

Most organisations using AI have no written policy, no oversight rules, and no documented answer. Valorial builds yours — from first AI policy to full EU AI Act compliance.
Book a status call (60 min, no charge)
EU AI Act  ·  High-risk obligations from Dec 2, 2027  ·  Governance questions arrive sooner

Built on IFC safeguard methodology, stress-tested in international arbitration and CAO investigations over 25 years.

Start here

Start here: The AI Governance Status Check

One fixed-scope engagement, whatever your starting point. You receive a written status report covering three layers: whether your AI policy and oversight rules hold up in practice, where your organisation stands against EU AI Act obligations, and your gaps ranked by severity — with a sequenced action plan your management can execute. No prerequisites. Works whether you have a full compliance team or no written policy at all.

Book a status call (60 min, no charge)
Path A

Governance Foundations

For organisations building responsible AI use from the ground up. Most clients start here.

  • AI use policies and employee guidelines, written for your actual use cases
  • Vendor and procurement AI rules
  • Human oversight and escalation design
  • Team training, in-house or remote
  • Grievance and feedback channels for people affected by your AI
Path B

EU AI Act Compliance Track

For deployers of high-risk systems under Annex III: credit scoring, candidate screening, insurance underwriting, education assessment, public services, biometrics.

  • Risk classification and compliance audit
  • Fundamental Rights Impact Assessment (FRIA) built on scored, weighted methodology
  • Third-party AI due diligence
  • Documentation and post-market monitoring readiness

If a FRIA we deliver fails Article 27 content requirements, we revise it at no charge.

Not sure which path fits? That is what the status call answers.

Regulatory Deadline
2027
December 2

Enterprise procurement questionnaires, board risk committees, and insurance underwriters ask for AI governance evidence now — independent of any Brussels timeline. The December 2027 date defines when regulators fine you. Your market decides much earlier whether it trusts you.

The Omnibus shifted the Annex III date to December 2, 2027. It is not yet law; until Official Journal publication, August 2, 2026 remains binding. Transparency obligations under Article 50 stay on the original schedule.

Non-compliance: Non-compliance with deployer obligations, including Article 27 FRIA, carries fines of up to EUR 15M or 3% of global annual turnover.
Book a status call (60 min, no charge)
About
Dorothee Georg, founder of Valorial

Most FRIA guidance produces questionnaires. Questionnaires satisfy checkbox audits and collapse under regulatory investigation.

Development finance solved this decades ago: scored severity, weighted likelihood, cumulative impact, documented mitigation adequacy. Valorial applies this tested methodology to Article 27. Every conclusion carries an auditable justification.

Dorothee Georg · 15+ years at KfW Development Bank, IFC, and the World Bank · Lecturer, Sciences Po Paris

LinkedIn →
Not sure where you stand?
Methodology Paper

From Safeguards to Fundamental Rights: Applying IFC Proportionality Methodology to EU AI Act Article 27 Assessments

Article 27 mandates FRIA content but not methodology. Existing questionnaire-based approaches produce documentation without analytical rigor. This paper applies IFC PS1 proportionality methodology — developed over 25+ years in development finance — to produce scored, weighted FRIA outputs that withstand regulatory scrutiny.

Request the working draft → Working paper · 2026 · SSRN publication forthcoming
Get started

Book a status call.

One hour. You leave with your governance maturity picture, your three most critical gaps, and a clear first step. No sales pitch.

We practice what we advise.

This website sets no cookies, runs no trackers, and loads no analytics. We collect your data only when you hand it to us, and we tell you exactly what happens to it. If we treat your data this way before you are a client, you know how we will treat your compliance file when you are one.

Read our privacy notice →