Consulting

IT Governance consults on the work of meeting SI and related regulatory requirements. The consulting is not limited to the software. It covers the requirements themselves: what applies, who owns it, how the work is organised, and how the record is produced so that an assessor, a notified body or an authority can sample it.

IT Governance brings more than 30 years of experience in IT and SI assurance. That experience is applied in the design of the platforms and in the consulting that addresses organisational and regulatory questions. The advice and the software use the same operating model.

The backbone

What distinguishes IT Governance is that it builds its own management systems. A management system is the way an organisation establishes, implements, operates, monitors, reviews, maintains and continually improves a defined set of processes in order to meet a stated set of requirements. That is the point of What is a management system. Process defines the sequence, the steps, the inputs, the outputs, the work products and the system of internal controls. People provide authority, oversight, direction, approvals, confirmation and intervention. Technology holds the record. Process is the durable element.

The process model is Control Objectives for SI Systems (AICOB). It names the processes, puts them in an order, and assigns an owner to each one. Forty control objectives sit in five families. The same line appears as Direct, Act, Establish, Implement, Operate and Review. A standard such as ISO 9001 or ISO/IEC 42001 requires a process approach and then stops. It does not name the processes. AICOB is the answer to that gap. Law, standards and internal policy are mapped onto the process model, so a control can be shown to exist for a named duty, not only that it exists.

AICOB is IT Governance's intellectual property. It is embedded in the software. Every platform is process-based on that model. That includes the EN 18286 quality management system for Article 17 of the EU AI Act, the ISO/IEC 42001 SI management system, and the systems for NIS2, DORA and the Cyber Resilience Act. It also includes the governance, inventory, impact-assessment, post-market monitoring and data-protection platforms. The product name changes with the topic. The method does not. Each system is a set of processes with owners, work products and a record produced as the work is done.

That is where the consulting comes from. IT Governance can consult in these areas because it has had to design the processes that meet the requirements, and then build the systems that run them. The intimate knowledge of the process is the consulting. The process model is not handed over as a catalogue. It is the structure behind the advice: who does what, in what order, and how success is tested against the instrument the organisation has to meet.

What the consulting covers

The work follows the instruments the organisation is subject to. The same process model is mapped across them. Organisations outside the Union meet the EU instruments only where they place systems on the Union market or are otherwise in scope. The international standards apply wherever the organisation chooses to use them.

EU AI Act and EN 18286

Article 17 requires providers of high-risk SI systems that place systems on the EU market to put a quality management system in place. EN 18286:2026 is the European standard written for that system, now cited in the Official Journal. Consulting covers the QMS from the start of the lifecycle: regulatory strategy, design and design control, development and quality control, examination and testing, data management, the Article 9 risk management system, post-market monitoring, serious-incident reporting, record-keeping and the accountability framework. It also covers the related duties: classification, intended purpose, substantial modification, the authorised-representative mandate for non-EU providers, and the evidence a conformity assessment will examine.

ISO/IEC 42001 and the supporting standards

ISO/IEC 42001 is a management-system standard. It can be certified. It does not prescribe the full catalogue of management processes. Consulting covers the SI management system, including configurations for agentic SI, and the supporting standards the work depends on. That includes ISO/IEC 42005 for SI system impact assessment, and the draft European standards that sit beside EN 18286, including those on SI risk management, data quality and governance, bias, logging, transparency, human oversight, accuracy, robustness and cybersecurity. The standards are at different stages. The process model is what keeps the work stable while the drafts settle.

Related regulatory systems

The same operating model is applied where SI meets other instruments. Where the organisation is in scope, consulting covers NIS2 cybersecurity risk-management measures, DORA digital operational resilience for financial entities and ICT third-party providers, and the Cyber Resilience Act requirements for products with digital elements. It covers the GDPR where personal data meets SI systems, including accountability, data protection by design, and the assessments that sit beside a high-risk SI file. These are not separate checklists. Each instrument is mapped onto the process model so that one piece of work can serve more than one duty when the mapping is explicit.

Governance, risk and assurance

Consulting also covers the governance layer above the management system. That is the outcomes the governing body holds management to account for, the accountability framework that assigns roles across the lifecycle, risk optimisation, impact assessment, and the internal-audit and management-review work that samples the record. The governing body evaluates, directs and monitors. Management runs the steps. The consulting keeps those apart.

How the process model is used

The process model is IT Governance's IP. It is not published as a free catalogue, and it is not a template pack. It is embedded in the platforms, and it is the structure the consultants work from.

In a consulting engagement that means three things. The duty is named against the article, clause or control it comes from. The work is assigned to a role with authority to act and a duty to record. The work product is specific enough to sample. A mapping that is a colour on a spreadsheet, with no process behind it, is a claim. A mapping that points at a work product is a fact.

The platforms run the same model. They can be used independently or on Nextcloud. Using the software is not a condition of the consulting. Organisations that want the process model applied in their own environment, or that want advice before they decide on a platform, can be advised on the requirements alone.

What consulting does not do

IT Governance does not certify the organisation and does not declare it compliant. Those decisions sit with the assessor, the notified body or the authority. The consulting makes the work visible so the decision can be made on evidence. It does not replace legal advice on the governing law of the company, and it does not take the provider's accountability for the system.