AI Governance Gap Analyzer
So... where does your AI governance really stand?
Here's a secret: in many organizations, governance quietly hasn't kept pace with AI adoption. If that's you, you're not behind. You're normal. But "normal" won't impress a regulator, so let's look at two things together: what the law expects of you (EU AI Act risk tiers, plus your Swiss and UK obligations, depending on where you operate) and what you can actually do today (24 capabilities across 6 dimensions). The space between those two? That's your risk. And it's fixable.
Give us 7 honest minutes, and you'll walk away with:
✔ A clear picture of which rules actually apply to your AI (EU, Switzerland, UK), not someone else's
✔ A maturity score across 6 governance dimensions, weighted for your industry
✔ Your priority list: where exposure is high and capability is low
✔ Practical next steps and a 90-day plan you could start Monday
✔ A polished PDF report, built right in your browser. Your answers never leave it. Promise.
The rulebooks we test against
Different countries call it different things: an Act, an ordinance, a guidance note, or a voluntary framework. Here is the map, so you know exactly what is in scope:
🇪🇺 European Union
EU AI Act (Reg. (EU) 2024/1689, as amended by the 2026 Digital Omnibus): bans (Art. 5), high-risk duties (Arts. 8–15 & Annex III), transparency (Art. 50), general-purpose AI (Arts. 51–55), AI literacy (Art. 4). Plus the GDPR (Reg. 2016/679), the Copyright Directive (2019/790, TDM opt-outs) and product laws such as the Medical Device Regulation (2017/745).
EU member states
The AI Act applies identically in all 27 member states. But each country appoints its own enforcers and penalties, and national labor, consumer and anti-discrimination laws add their own layer. The main markets:
Germany: the Federal Network Agency (BNetzA); a national implementation law (KI-MIG) is in progress. France: still finalizing its designation as of mid-2026; the CNIL is expected to lead. Italy: the first country with its own national AI law (Law 132/2025); AgID accredits, and the cybersecurity agency ACN supervises and sanctions. Spain: a dedicated AI agency, AESIA, working with the AEPD. Netherlands: the Authority for Digital Infrastructure (RDI). Poland: a new central AI commission (KRiBSI). Belgium and Ireland split enforcement across many sector regulators. Operating elsewhere? Check that country's designated authority.
🇨🇭 Switzerland
No AI Act, by design (Federal Council decision, 12 Feb 2025). Instead there is the FADP (Federal Act on Data Protection 2020, in force 2023; Arts. 21–22 on automated decisions and impact assessments), FINMA Guidance 08/2024 for banks and insurers, sector laws, and the Council of Europe AI Convention (CETS No. 225). The implementation bill is expected end 2026.
🇬🇧 United Kingdom
No AI Act either. A principles-based, sector-led approach (2023 White Paper: safety, transparency, fairness, accountability, contestability) enforced by existing regulators such as the ICO, FCA, CMA and MHRA (19 regulators asked in Jan 2026 to publish AI plans). UK GDPR + Data Protection Act 2018 govern AI using personal data. The Regulating for Growth Bill (2026) adds sandboxes ('AI Growth Lab'), not general AI duties.
First, what world do you work in?
Your sector changes what regulators care about. We will tailor everything to it.
And where do the rules reach you?
This decides which laws show up in your report. Not sure? Pick "EU + Switzerland" (or the + UK version). Over-checking beats under-checking.