Compliance built in from day one.
In every build, the AI Act, logging, oversight and hosting are part of the design. Already using AI? The AI Act check shows what still needs to be arranged.
What the rules ask of you
The AI Act works in layers. Find the layer that fits how you use AI.
-
Everyone who uses AI
Since 2 February 2025, Article 4 requires that your people can work with AI sensibly. On top of that, anyone talking to a chatbot has to know it is an AI (Article 50).
AI literacy -
Organisations using AI in their processes
You know which AI systems you use and which risk class they fall into, you have an AI policy and you record what each system does.
Writing an AI policy -
Organisations using high‑risk AI
Human oversight, documentation, registration and a system that demonstrably does what it should.
Human oversight and logging
What is in every build
For us, compliance is a design choice. We take care of four things in every build.
-
Classification
In the start sprint we determine which risk class your application falls into: minimal, limited or high.
-
Logging and human oversight
Every decision can be traced and a person can step in. For AI customer service that means handing over to a colleague, for a workflow a review step.
-
Hosting and data in Europe
Data that may not leave Europe stays in Europe. Your own servers are an option too.
Self-hosted AI -
A team that can work with it
We train the team on the system it will use, on the job.
AI training for your team
The AI Act check
For organisations that already use AI and are not having anything built. Afterwards you know which layer you are in, what is missing and what comes first.
- Step 1
Inventory and classification
We map which AI you use, from ChatGPT and Copilot to AI inside your own systems, and which risk class each system falls into.
- Step 2
An AI policy
An AI policy your team actually uses. Want to start yourself? Read writing an AI policy.
- Step 3
Literacy
AI literacy training for your team, with a certificate.
Standards, security and certification
-
ISO 42001
The standard for an AI management system: how you organise, monitor and improve your use of AI. We guide you through it. The certificate itself is issued by a certification body.
About ISO 42001 -
Security and ISO 27001
We carry out security reviews and pentests of AI applications ourselves, and build with the requirements of information security in mind.
AI and security -
GDPR and DPIA
If your application works with personal data, you carry out the DPIA. On request we provide the technical information you need for it.
AI and the GDPR -
Our own certification
We are working towards ISO 42001 and ISO 27001 certification for AI Heroes itself. Once that is complete, it will be on this page.
We do it ourselves
The assistant on this site tells you it is an AI, keeps conversations under a fixed retention policy and hands you over to a person when it does not know the answer. A public page explains how it works.
Frequently asked questions
Does the AI Act also apply to small organisations?
Yes. What you need to arrange depends mostly on how you use AI. Article 4 on AI literacy has applied since 2 February 2025 to every organisation that uses AI, large or small.
What if we only use ChatGPT or Copilot?
Then Article 4 applies in any case: your people have to be able to use it sensibly. An AI policy records what is and is not allowed. The AI Act check shows what is still missing for you.
What are the fines?
That depends on the breach, and part of it is set out in Dutch law. We deliberately do not quote amounts here: the rules were still amended in 2026 and we update this page every quarter. The AI Act check gives you the current picture for your situation.
Can you guide us towards ISO 42001?
Yes, as a service. We help you set up and introduce the AI management system. The certificate itself is issued by a certification body.
Do you carry out pentests?
Yes. We carry out security reviews and pentests of AI applications ourselves.
Are you certified yourselves?
We are working towards ISO 42001 and ISO 27001 certification. Once that is complete, it will be on this page.
Ask for the AI Act check
Or have us build something that is compliant from day one. You hear from us within 24 hours.
