Title: AI compliance and security: AI Act, ISO 42001 and pentests | AI Heroes URL: https://aiheroes.io/en/compliance Description: Compliance by design: AI Act classification, logging, oversight and European hosting in every build. Already using AI? The AI Act check shows what is missing. Plus ISO 42001 guidance, security reviews and pentests. # Compliance built in from day one. In every build, the AI Act, logging, oversight and hosting are part of the design. Already using AI? The AI Act check shows what still needs to be arranged. Ask for the AI Act check What the rules ask ## What the rules ask of you The AI Act works in layers. Find the layer that fits how you use AI. - Layer 1 · [Everyone who uses AI](https://aiheroes.io/en/insights/ai-literacy) · Since 2 February 2025, Article 4 requires that your people can work with AI sensibly. On top of that, anyone talking to a chatbot has to know it is an AI (Article 50). · AI literacy - Layer 2 · [Organisations using AI in their processes](https://aiheroes.io/en/insights/ai-policy) · You know which AI systems you use and which risk class they fall into, you have an AI policy and you record what each system does. · Writing an AI policy - Layer 3 · [Organisations using high-risk AI](https://aiheroes.io/en/insights/human-oversight) · Human oversight, documentation, registration and a system that demonstrably does what it should. · Human oversight and logging [The AI Act: what your organisation needs to do](https://aiheroes.io/en/insights/ai-act) Updated on 12 October 2026. We check the rules every quarter. ## What is in every build For us, compliance is a design choice. We take care of four things in every build. - Classification · In the start sprint we determine which risk class your application falls into: minimal, limited or high. - Logging and human oversight · Every decision can be traced and a person can step in. For AI customer service that means handing over to a colleague, for a workflow a review step. - [Hosting and data in Europe](https://aiheroes.io/en/self-hosted) · Data that may not leave Europe stays in Europe. Your own servers are an option too. · Self-hosted AI - [A team that can work with it](https://aiheroes.io/en/training) · We train the team on the system it will use, on the job. · AI training for your team ## The AI Act check For organisations that already use AI and are not having anything built. Afterwards you know which layer you are in, what is missing and what comes first. 1. Step 1 · Inventory and classification · We map which AI you use, from ChatGPT and Copilot to AI inside your own systems, and which risk class each system falls into. 2. Step 2 · An AI policy · An AI policy your team actually uses. Want to start yourself? Read [writing an AI policy](https://aiheroes.io/en/insights/ai-policy). 3. Step 3 · Literacy · [AI literacy training](https://aiheroes.io/en/ai-literacy-training) for your team, with a certificate. Ask for the AI Act check What the check costs depends on how you use AI. You know the price before we start. ## Standards, security and certification - [ISO 42001](https://aiheroes.io/en/insights/iso-42001) · The standard for an AI management system: how you organise, monitor and improve your use of AI. We guide you through it. The certificate itself is issued by a certification body. · About ISO 42001 - [Security and ISO 27001](https://aiheroes.io/en/insights/ai-security) · We carry out security reviews and pentests of AI applications ourselves, and build with the requirements of information security in mind. · AI and security - [GDPR and DPIA](https://aiheroes.io/en/insights/ai-and-gdpr) · If your application works with personal data, you carry out the DPIA. On request we provide the technical information you need for it. · AI and the GDPR - Our own certification · We are working towards ISO 42001 and ISO 27001 certification for AI Heroes itself. Once that is complete, it will be on this page. ## We do it ourselves The assistant on this site tells you it is an AI, keeps conversations under a fixed retention policy and hands you over to a person when it does not know the answer. A public page explains how it works. [How the assistant works](https://aiheroes.io/en/legal/ai-assistant) [Read the case](https://aiheroes.io/en/cases/eigen-stack) ## Frequently asked questions ### Does the AI Act also apply to small organisations? Yes. What you need to arrange depends mostly on how you use AI. Article 4 on AI literacy has applied since 2 February 2025 to every organisation that uses AI, large or small. ### What if we only use ChatGPT or Copilot? Then Article 4 applies in any case: your people have to be able to use it sensibly. An AI policy records what is and is not allowed. The AI Act check shows what is still missing for you. ### What are the fines? That depends on the breach, and part of it is set out in Dutch law. We deliberately do not quote amounts here: the rules were still amended in 2026 and we update this page every quarter. The AI Act check gives you the current picture for your situation. ### Can you guide us towards ISO 42001? Yes, as a service. We help you set up and introduce the AI management system. The certificate itself is issued by a certification body. ### Do you carry out pentests? Yes. We carry out security reviews and pentests of AI applications ourselves. ### Are you certified yourselves? We are working towards ISO 42001 and ISO 27001 certification. Once that is complete, it will be on this page. You talk to David Homan Co-Founder, software and compliance David leads the build, from prototype to a system that runs in your own landscape. AI Act classification, logging, security and hosting are built into the design from the start. [The team](https://aiheroes.io/en/about/team) [LinkedIn](https://www.linkedin.com/in/davidnhoman) ## Ask for the AI Act check Or have us build something that is compliant from day one. You hear from us within 24 hours. [info@aiheroes.io](mailto:info@aiheroes.io) [+31 50 200 3373](tel:+31502003373) ### Book an introduction - [Frans Hoorn Business case and scoping](https://calendar.app.google/juFpF3MDmikH4BVS8) - [David Homan Build, hosting and compliance](https://calendar.app.google/GcA1oBNwzyFZtW5W6) - [Jan Brusse Adoption and training for your team](https://calendar.app.google/un3fLvb7ht4f7PBWA)