03 · Nómos
How to govern the use of artificial intelligence spread across the company.
Who can use it, for what, with what limits, and who answers if it gets something wrong. With the documentation to show customers, banks and auditors.
The call is included and comes before any commitment. The scope of the oversight is defined there, on the systems you actually have in use.
AI comes into the company without anyone having decided where to take it. A tool here, an experiment there, an automation started by IT without management knowing.
The result is a set of unconnected initiatives, with no shared priority and no assigned responsibility.
The problem isn’t technological: it’s one of governance.
Where it breaks
Three things nobody has written down anywhere.
No shared direction.
Management has never answered the question together: where do we want to take AI, and in what order.
Responsibilities not assigned.
Who supervises the systems in use, who steps in if something goes wrong, who ensures people have the skills. It is almost never written down.
Compliance as a reaction.
People move when an audit arrives. At that point the work is double: fixing and proving.
What Nómos does
Six things, and they run all year round.
-
It finds the processes that burn resources.
Nómos is worth as much as the processes it identifies are critical. Twenty-five years inside industrial operations serve to establish where to look and in what order.
-
It writes the rules for widespread AI.
Who can use AI, in which department, for what. Who authorises a price, who approves a document, where a human signature is needed.
-
It classifies the systems by risk.
Every AI system in use is mapped to the obligations that apply to it, with a remediation plan in order of priority.
-
It does the service check.
Periodic audits, decision log, human supervision at critical points, risk dashboard. Not a one-off audit: ongoing oversight.
-
It trains and certifies.
Sessions by level, with a certificate, for the AI literacy obligation of art. 4 of the AI Act, in force since February 2025.
-
It protects management.
The formal documentation to put on the table of the board, the banks and the auditors.
The portal
The oversight is seen from a single page.
Every AI system in use has its own row. The portal reads the files and doesn’t touch them: the document stays the document, the portal is the view of it. It runs where your data runs, without calling external servers.
If a file can’t be read, the total declares itself partial.
What it shows
- The status of every system, from build to production.
- The AI Act classification and the obligations that follow from it.
- The calendar of checks, with overdue deadlines highlighted.
- The incident log.
- The signatures collected and those still pending.
The documentation
What you put on the table when someone asks you to account for it.
A customer qualifying its suppliers, a bank, an auditor. The question is always the same: who is accountable for these systems, and how do you prove it.
- The AI Act classification of every system in use.
- The system sheet: what it does, on what data, with what limits.
- The usage procedures by department, with who authorises and who approves.
- The decision log: who decided what, and when.
- The register of risk assessments.
- The certificates from the training sessions.
On the deadlines
There is no emergency to chase.
Today: October 2026
-
February 2025
in force
AI literacy obligation
Art. 4: anyone working with these systems must be trained.
-
27 July 2026
in force
Digital Omnibus
Pushes back the obligations on high-risk systems.
-
December 2027
from here on
Annex III obligations
Systems classified as high-risk.
The Digital Omnibus, in force since 27 July 2026, has moved the obligations on the high-risk systems of Annex III to December 2027.
However, the AI literacy obligation of art. 4 remains in force since February 2025, and the fact remains that documenting after the fact costs more than documenting while building.
A clarification
Nómos makes sense above all on the AI systems we didn’t build ourselves.
An auditor who certifies their own work is not an auditor.
The commitment
Annual oversight fee, periodic audit and protection for management.
Book the qualification call (30 min)
Thirty minutes in which we look at which AI systems are already running in the company, who started them and what is worth documenting first. If there is nothing to oversee, we tell you.
- Thirty minutes, no commitment. Michele Balsamo runs it.
- We look at your ERP and at the process that costs you the most.
- If there is no net return, we are the ones who tell you not to go ahead.