AI governance: why evidence belongs with an independent third party

Six questions, and nobody to answer them

The ones an executive team asks as soon as AI enters day-to-day operations.

1. Which AI systems do we have? Including the ones nobody declared: individual accounts, features switched on by a software update.
2. Who is accountable? A named person. It is the first thing an inspector asks for, and rarely what they find.
3. What do they do? On which cases, how often, for how many people. And who actually uses them.
4. What risk do they create? The risk class depends on the use: screening applications and summarising a meeting carry different obligations.
5. Do they behave as intended? Nobody reviews the AI's answers. Drift is found too late.
6. Can we prove it? At an inspection, good intentions are not enough: you need dated evidence, with the name of who produced it.

The first two questions are settled with an AI register. The last one, with a file of AI Act compliance evidence.

Provider and deployer: two separate responsibilities

The EU AI Act separates two roles. The provider develops an AI system and places it on the market under its own name. The deployer uses an AI system under its own authority, in a professional capacity (Article 3).

The vendor answers for its product. You answer for how you use it. For high-risk systems, Article 26 requires you in particular to assign human oversight to competent people, to monitor operation and to keep the logs for at least six months. Article 50 sets transparency obligations. No vendor tool carries these obligations on your behalf.

Why native tools are not enough

Every major vendor now ships its own control tower. These tools are useful. They do not answer the question a regulator will ask you.

• Each control tower sees only its own ecosystem. Four vendors, four dashboards, four definitions of compliance. None sees the other three.
• Whoever sells the AI cannot grade it. A vendor that evaluates its own agents is judge and party. That is not an accusation, it is a position.
• Evidence is judged by how it holds up over time. A dashboard shows the state of today. Evidence shows what was true on a given date, who established it, and that it has not been altered since.

Native tools govern each AI from the inside. A third party sits above them, on the company's side, and consolidates what they produce into one registry, one score, one evidence file. 56North sells no model, no integration and no cloud.

The regulatory clock

The AI Act applies in stages. Regulation (EU) 2026/1744, the Digital Omnibus on AI, postponed the rules for high-risk systems.

Fines reach €35M or 7% of worldwide turnover for prohibited practices, and €15M or 3% for breaches of deployer obligations (Article 26) and transparency obligations (Article 50), whichever is higher; for SMEs, whichever is lower (Article 99).

Control, prove, operate

Software alone proves nothing. You also need people who test, and a team at the helm. The three components can be bought separately.

• The Cockpit, the software, available: registry, five-dial score, monthly flight report.
• Human in the Loop, activated on engagement with Isahit: testing and review by trained people.
• The Factory, set up with a subscription with Wikolabs: connecting and maintaining the AI already in place.

Where to start

With the map. A fixed-price assessment lists your AI systems, their classification, and what would be missing in front of an inspector. The 30-minute first conversation is free.