Complete, regulation-grounded governance and readiness kits for Microsoft 365 organisations — starting with AI, and building on from every next technological shift you need to prepare for.
A new technology or regulation arrives — AI agents today, post-quantum cryptography tomorrow — and the practice is always the same: no budget, no template, no time to build a programme from scratch, while leadership is already asking for an answer. Every kit in this series solves that for one specific, externally dated issue — ready-made, cross-referenced, and yours to rebrand.
Govern the AI and AI agents in your organisation — or lay a sound governance foundation from day one if you are just starting with AI. Policy, risk, security, data and agent management in one coherent, audit-ready system, aligned with ISO 27001, NIST AI RMF and the EU AI Act.
Prepare for the post-quantum cryptography migration before it becomes urgent — structured along the NCSC UK timeline (2028 · 2031 · 2035), with a living vendor tracker for IBM, Google, Microsoft and others.
Make the EU NIS2 directive concrete: scoping, a risk register and the required documentation in one audit-ready package. Built on the ten core risk-management areas and the reporting duties (24-hour early warning · 72-hour notification).
Classify your AI use, document the Article 50 transparency obligations and deliver the legal evidence file a supervisory authority expects.
Not sure which fits you? The AI Governance Kit is for organisations that run AI and AI agents — or are just starting with AI — and want to govern them responsibly from day one. The Quantum Readiness Kit helps you start the move to quantum-safe cryptography in time: you map your cryptographic assets, plan the migration along the NCSC timeline (2028 · 2031 · 2035) and put the plan, with a living vendor tracker, to your board — before quantum-computing risk becomes urgent. The NIS2 Readiness Kit is for organizations already in scope of the EU NIS2 directive that want an audit-ready risk approach and reporting duty.
These documents are written to be read — by an auditor, a board, a supervisor. That remains their primary function.
But organisations are deploying AI agents that themselves need policy, baselines and risk registers as context. An agent without a governed source invents policy, or works from an outdated version. That is precisely the risk governance is meant to mitigate — now also for the system that acts on the organisation's behalf, not just for the person reading it.
Place this kit on SharePoint, give your agents access, and the documents become a knowledge source instead of an archive. The governance you already apply to the documents — version control, ownership, review rhythm — then applies just as much to what your agents treat as truth.
The kit is already built for this. Its layout of short, standalone sections lends itself to use by both people and systems; if you want to optimise it specifically for retrieval by an agent, that is a matter of restructuring, not rewriting.
Two different questions, two different kits.
The AI Governance Kit is a framework: policy, roles, risk management and lifecycle processes for AI, independent of any specific regulation. Meant for organisations that want their AI governance in order, regardless of jurisdiction.
The AI Act Compliance Kit is an obligation: documentation and evidence specifically mapped to the EU AI Act — transparency obligations, risk classification, the legal requirements from the Regulation itself. That Regulation applies within the European Union. Outside the EU it only matters once you place AI systems on the EU market or deploy them as a deployer within the EU.
Does your organisation fall under the EU AI Act as a provider or deployer of a high-risk or GPAI system? Then being compliant is not a choice. The AI Governance Kit supplies the underlying structure; the AI Act Compliance Kit supplies the regulation-specific layer on top. The kits are complementary, not interchangeable.
