ZERYON SYSTEMS Talk to us
AI governance · EU AI Act · NIS2

AI governance you can prove.

"Did we document everything?" is not the question that counts when it matters. The question is: "Are we ready — and can we prove it?" We make AI and cyber risk controllable, auditable and demonstrable — for the EU AI Act and NIS2.

Book a call → See GARION
Why now

Two frameworks, one question: can you prove it?

NIS2 has been in force in Germany since 6 December 2025 and affects around 29,500 companies across 18 sectors — with duties for risk management, BSI registration and reporting deadlines (24-hour early warning, 72-hour report).

For the EU AI Act, prohibitions and GPAI rules already apply. The Digital Omnibus (Regulation (EU) 2026/1744, Official Journal of 24 July 2026) rewrote Art. 4 on AI literacy: companies take measures to support their staff's AI literacy, no specific level is required. The high-risk obligations under Annex III apply from 2 December 2027; they are postponed, not removed.

As of November 2026. Guidance, not legal advice. Primary sources: BSI (NIS2) and EUR-Lex (EU AI Act).
What we mean by it

A governance layer above your systems.

AI governance is not another tool and no replacement for SIEM, SOC or your lawyers. It is the layer that answers the board's one question — "Can we prove it today?". Concretely we build:

Living risk register

AI and cyber risks with named owners and review cycles — instead of spreadsheets nobody maintains.

Evidence vault

Evidence with a validity lifecycle: expired = visible gap, not silent "green".

Reporting clocks

NIS2 deadlines (24h / 72h) that document themselves — including escalation and log.

Human review & audit log

Roles, approvals, fallbacks and a complete, traceable audit log for every AI decision.

Explainable readiness index

A number you can defend — traceable down to the single piece of evidence, board-ready as a report.

Annex IV readiness

Structured preparation of the Annex IV technical documentation — a multi-month effort, made plannable.

We don't just talk governance. We run our own system.

GARION is our AI governance and readiness system: local, deterministic, auditable. It shows which AI is in use, which evidence is missing, and whether you are leadership-ready for the EU AI Act and NIS2.

See GARION → Book a call
FAQ

Common questions on AI governance, EU AI Act & NIS2

Do I need AI governance as a mid-sized company?
As soon as your staff use AI, you need at least a simple form of it: you know which AI tools run in the company, who is responsible for them and which data may go in. How far beyond that you need to go depends on the use. A chat tool for writing needs less than an agent working in your accounting. Guidance, not legal advice.
Where do I start with AI governance?
With an AI inventory: a list of which AI tools and AI features are used in the company, with an owner per line. Next comes a usage policy. We work out both with you in a one-day workshop.
Do we have to train our staff on AI?
As amended by the Digital Omnibus, Art. 4 of the AI Regulation requires providers and deployers to take measures to support their staff's AI literacy. A specific level is not required. Training with a documented record is an obvious measure, more on the AI training page. Guidance, not legal advice.
What does AI governance cost?
A workshop that produces your AI inventory or first policy costs €2,900 net for one working day. Consulting starts at €1,800 net, a consulting day costs €2,400 net. For ongoing operation there is our system GARION. All prices plus VAT.
What is AI governance?
The steering layer above your AI systems: named owners, roles and approvals, human review, logging and evidence. It answers whether you control your AI and cyber risk — and can prove it.
Am I affected by NIS2?
Germany's NIS2 implementation act has applied since 6 December 2025 and affects around 29,500 companies across 18 sectors. Whether you are affected depends on sector and size — we make affectedness and evidence needs visible. Guidance, not legal advice.
What does the EU AI Act currently require?
Prohibitions and the rules for general-purpose AI models already apply. Art. 4 on AI literacy was rewritten by the Digital Omnibus (Regulation (EU) 2026/1744) and requires measures to support AI literacy, not a specific level. High-risk obligations under Annex III apply from 2 December 2027. As of November 2026, guidance, not legal advice.
Do you make us "compliant"?
No. We don't replace lawyers or auditors. We make readiness visible before it's missing — as a solid basis for your compliance work.
How does this relate to GARION?
GARION is our own AI governance and readiness system: local, deterministic, auditable. This page shows the approach — GARION is the proof that we ship it.
Book a slot

Book your intro call online.

Pick a time that suits you — simple and direct.

The call takes place via Zoom — you’ll receive the link automatically by email after booking.