AI Program Complete

An AI programme is three jobs that are almost never held by the same person, and are almost always bought in the wrong order.

EU AI Act Compliance Clock — the law. Sixteen questions per system return the role, the tier, the date that binds it and the live Article 50 duties, then the deployer register, the provider conformity roadmap and the US state overlay. Transparency has applied since 2 August 2026; Annex III high-risk lands 2 December 2027.

Agentic AI Security Program Kit — the systems that can act. An agent is an identity with privileges, and the vector is content it reads rather than access an attacker needs. 27 fields per agent resolving to a blast-radius tier, a guardrail standard with gates on each of read / write / send / delete / execute / pay / spawn, OWASP ASI threat modelling with 18 test cases, and the playbook for the hour after one goes wrong.

Pillar 06 Companion — The 2026 AI Risk Register — where it all lands. A five-plane register spanning inventory, classification, risk, evidence and conduct, with deterministic rule tables for the EU AI Act, NIST AI RMF, ISO 42001, TRAIGA and state ADMT, and scoring where autonomy and blast radius derive from granted tool scopes rather than being typed in.

Why all three. Classification without enforcement is a spreadsheet: you know a system is high-risk and nothing stops it wiring money. Enforcement without classification is guesswork about which systems deserve the controls. And both without a register means neither survives the year — nobody can say who accepted what, on what evidence, when the question comes. The Clock produces classifications the Register already has rule tables for; the agent inventory produces exactly the autonomy and blast-radius facts the Register scores on. They were built to compose.

If you only need two, the EU AI Act + Risk Register Pack is the law and the register without the agent layer.

Offered at Individual Practitioner and vCISO / MSSP. There is no shared middle tier because the agent kit's is a Team License while the other two sell an Organization License — buy those two directly if organisation scope is what you need.