The RIA Gap Analysis is a service that evaluates an organization's level of compliance with the requirements of the European Union Artificial Intelligence Act (RIA or AI Act). Its objective is to identify regulatory, organizational, and technological gaps, as well as to define a prioritized compliance roadmap aligned with the entity's context.
EU AI Act · RIA · Gap Analysis · AI Governance · Compliance
RIA Gap Analysis and
Action Plan
We identify the organization’s degree of alignment with the Artificial Intelligence Act (AI Act) and define a prioritized roadmap to achieve regulatory compliance.
Gap Analysis
Assessment of compliance level with the RIA
AI Classification
Inventory and categorization of artificial intelligence systems
Action Plan
Prioritized regulatory compliance roadmap
Service
What is the RIA Gap Analysis?
Methodology
How we work
01Project launch
We begin the project by defining the scope, planning, and activities necessary for its execution. As a result, a common framework and a validated scope are established, which will serve as a reference throughout the evaluation.
02Definition of the evaluation scope
The objective of this phase is to identify, analyze, and classify the artificial intelligence systems present within the organization in order to obtain a complete view of the AI ecosystem and determine the applicable regulatory obligations under the Artificial Intelligence Act (AIA).
During this stage, a detailed analysis of the AI solutions used by the organization is carried out, whether developed internally or provided by third parties, with the aim of establishing the scope of the assessment and defining the associated compliance requirements.
03Compliance analysis and gap analysis
The purpose of this stage is to analyze the artificial intelligence systems used by the organization, understand their impact on business processes, and determine the applicable obligations under the Artificial Intelligence Act (AIA).
Through interviews with the involved areas, workshops, and the review of relevant documentation, a detailed view of the organization's AI environment is obtained, along with the processes in which these systems are involved and the control measures currently in place.
04Development of the action plan
Once the compliance assessment is completed, an Action Plan is developed, aimed at achieving an appropriate level of alignment with the Artificial Intelligence Act.
The plan identifies the measures necessary to address the identified gaps and strengthen the organization's artificial intelligence governance model.
05Results
The project concludes with the preparation of a comprehensive executive report that provides a clear overview of the organization's status and a practical roadmap for moving toward compliance with the Artificial Intelligence Act:
- Work plan and project scope
- Preliminary inventory of AI systems classified by risk level
- Compliance status report with identified gaps and risks
- Prioritized action plan with implementation roadmap
- Recommendations for continuous improvement and AI governance
- Executive presentation of the results obtained, review of findings, and joint validation of the proposed roadmap
Scope of service
What this service covers
Inventory and classification of AI systems
Identification of the organization's AI systems, whether developed internally or provided by third parties, and their classification according to their risk level in compliance with the EU AI Act.
Compliance level assessment
Analysis against the Regulation regarding governance, transparency, risk management, human oversight, traceability, and cybersecurity, through interviews, workshops, and document review.
Gap identification
Detection of regulatory, organizational, and technological gaps with respect to the requirements of the Artificial Intelligence Act.
Suppliers and third parties
Analysis of the suppliers and third parties involved in the organization's AI solutions.
Action plan and roadmap
Prioritized plan based on regulatory risk, impact, complexity, and timelines, with the compliance roadmap and measures to strengthen AI governance.
Report and presentation of results
Executive report on compliance status, and presentation of conclusions and joint validation of the roadmap.
What our clients say
Organizations that trust us
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental to strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance our cybersecurity maturity more quickly.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every way. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services provided by Internet Security Auditors give us support, security, and the peace of mind that all our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that the PCI-CPP standard requires four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company wants to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
FAQ
Frequently Asked Questions
What is the Artificial Intelligence Act (AIA)?
The AI Act is the European Union's first comprehensive regulatory framework for artificial intelligence. Based on a risk management approach, it classifies AI systems according to their level of impact and establishes proportional obligations, with more demanding requirements for systems considered high-risk. It affects organizations that develop, market, integrate, or use AI solutions with effects in the European market.
Which organizations need this service?
Any public or private organization that develops, markets, integrates, or uses artificial intelligence solutions and whose systems have effects in the European market. The AI Act affects providers, deployers, importers, distributors, and authorized representatives of AI systems.
What are the project phases?
The project is structured into two main phases: Phase I (Gap Analysis) includes the kickoff, scope establishment with an AI system inventory, and compliance environment analysis with gap identification. Phase II (Action Plan) includes the development of the prioritized action plan with a roadmap and the executive presentation of results.
What documentation is provided upon completion?
A work plan is provided, along with an inventory of AI systems classified by risk level, a compliance status report with identified gaps and risks, and a prioritized action plan with the AI Act compliance roadmap, including priority criteria, estimated effort, responsible parties, and dependencies.
How does it relate to ISO 42001 and the EU AI Act?
The AI Act Gap Analysis evaluates specific compliance against the Artificial Intelligence Act. It is complementary to the implementation of ISO 42001 (AI Management System) and other AI governance services. Organizations that already have an AIMS according to ISO 42001 will have a more advanced starting point for AI Act compliance.
Contact
Do you need to assess your level of compliance with the AI Act?
Tell us about your situation and our team will contact you to provide guidance or schedule a technical call.
Request information
Global Presence
Our offices
Bogotá
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
25
years of experience in cybersecurity
Contact us