# AI Governance Buildup: build AI governance in 4–10 weeks > AI Governance Buildup in 4–10 weeks: roles, policies, Art. 4 EU AI Act training and evidence for SMEs. Agreed fixed price from CHF 9'800. - Source: https://www.sidd.swiss/en/services/ai-governance-buildup - Language: en - Last updated: 2026-10-17 - Publisher: SIDD Institute for Data Protection and Data Security, a brand of Priverion GmbH, Zugerstrasse 32, 6340 Baar (ZG), Switzerland EU AI Act · ISO/IEC 42001 · FADP You know what your use of AI still lacks. The Buildup puts your action plan into practice in 4–10 weeks: roles, policies, training and evidence for daily work. We agree the fixed price after an initial scoping call. Agreed fixed price from CHF 9'800 Roles, policies, training with evidence Operational in 4–10 weeks depending on the package Free and non-binding · 30 minutes · confidential under NDA · quote within 24 hours **Responsible for this engagement** **Mohamed Afhim** Senior Associate · Data and data protection law (FADP, GDPR, EU AI Act) Mohamed Afhim leads the Buildup and develops the AI policies and first impact assessments with your business units. The team of Dr. Dominic Staiger signs off the legal assessment and the contract clauses. Mohamed Afhim checks technical controls with the InfoSec team around Oliver Stutz, Co-Founder and head of the SIDD development centre. [LinkedIn profile](https://www.linkedin.com/in/mohamed-amen-a-a53463225/) ## What is an AI Governance Buildup? > **Short definition** > > The AI Governance Buildup puts your AI action plan into practice. It covers the AI inventory, risk register, AI Officer roles, policy set and Art. 4 EU AI Act training. Templates for impact assessments, a clause library for contracts and evidence in the Priverion Platform are added. After 4–10 weeks, executive management accepts the result and your AI Officer takes over. Everything follows ISO/IEC 42001:2023, with no obligation to certify. The prerequisite is a baseline assessment, usually the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check). We also adopt a reliable inventory from another source. If both are missing, the Essentials package first compiles a compact inventory. **The Check shows what is missing. The Buildup puts it in place.** If you want the certificate from the outset, choose the [ISO 42001 implementation project](https://www.sidd.swiss/en/services/iso-42001-ai-governance). The Buildup fits if you first need governance for day-to-day work. ## When an AI Governance Buildup makes sense The Buildup pays off when the need for action is known and implementation stalls. The EU AI Act applies if your AI is placed on the EU market or its output is used there. Without an EU link, the Swiss Federal Act on Data Protection (FADP) applies. EU customers and auditors still measure you against the EU AI Act. 1. **The action plan exists but has not been implemented:** Your [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) is months old. What is missing is a project with a responsible person, deadlines and templates. 2. **AI is used everywhere, but not formally approved:** Marketing works with ChatGPT. Someone has used Lovable to build a tool with customer data. Before the first incident, you need a usage policy, an approval process and an inventory. Where needed, the tool itself is checked by the [Security Review for Vibe-Coded Projects](https://www.sidd.swiss/en/services/vibe-coding-security-review). 3. **You are building AI into your product:** A chatbot or AI agent is used by customers in the EU. Since 02.08.2026, users must be able to tell that they are dealing with AI. Generative systems marketed before then need machine-readable marking by 02.12.2026. It matters whether you develop AI as provider or use it as deployer (Art. 3(3) and (4) EU AI Act). Customers want to see your approval practice in policy and contract. 4. **Customers, auditors or the regulator ask for evidence:** An EU customer wants to see your AI policy and your AI training record. Since 02.08.2026, market surveillance authorities can also demand this record. FINMA expects a central AI inventory with risk classification and clear responsibilities. 5. **A high-risk system is foreseeable, and the deadline is known:** AI that pre-selects job applicants or checks creditworthiness falls under Annex III EU AI Act. The obligations apply from 02.12.2027. That leaves around 13 months: one quarter to build, three quarters of demonstrable operation. What makes us unique ## Law, engineering and AI development in one team Lawyers often lack hands-on experience with AI models, engineers the knowledge of the obligation behind a rule. Our lawyers, engineers and AI developers write the policy set together. **Neither a pure law firm nor a conventional consultancy can deliver this combination.** The result is rules your teams can implement and regulators and customers can follow. ### Deep legal expertise The team of Dr. Dominic Staiger gives every policy and contract clause its legal sign-off. Dr. Staiger is Dr. iur., LL.M. and CIPP/E as well as Attorney at Law (New York) and Solicitor (UK). Mohamed Afhim translates the EU AI Act and FADP into rules your business units apply without legal training. ### Our own software engineers Our development centre has built model access, logging and approvals into the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform) itself. These engineers co-write your policies for development and AI operations. ### In-house AI development We develop and run our own AI systems, such as the legal AI LexCommand. When a provider changes its model, we adapt our own inventory, risk register and policy. ## What we build The Buildup comprises ten building blocks. At the end every building block has an owner, meaning a responsible person in your organisation. - **AI inventory and risk register:** The inventory lists every AI application, the register their risks. For each application we record owner, purpose, data flows, risk class and your role as provider or deployer. A set process keeps the register in the Priverion Platform up to date. - **Roles and RACI:** The RACI table shows who is responsible, who contributes and who is informed. The AI Officer runs governance and reports to executive management. You staff this function internally or by mandate. Roles also include system owners, the DPO, the CISO, and approval and escalation paths. Regular reports document the duty of care of the board and management. - **Policy set:** Your internal AI rules in five to nine documents, depending on the package. At the top sits the AI governance directive (ISO/IEC 42001 clause 5.2). It sets out scope, principles, roles, risk appetite and approval gates before go-live. Four core policies govern AI use, procurement, data, and incidents and reporting. From Standard four more are added: development and MLOps, human oversight, transparency, and model and change management. MLOps means the operation and upkeep of AI models. Every policy is short and names its norm. Executive management puts it into force. - **Development and MLOps policy:** It applies if you build AI features yourself. Every component with a language model needs a threat model, meaning an analysis of possible attacks. It also covers test and approval gates, data provenance and separated environments (ISO 27001 Annex A 8.31). Logging records what a system does. Where needed, the design is reviewed by the [Security Architecture Review](https://www.sidd.swiss/en/services/security-architecture-review). An AI-generated app is reviewed by the [Security Review for Vibe-Coded Projects](https://www.sidd.swiss/en/services/vibe-coding-security-review). The attack test is carried out by the [AI security assessment](https://www.sidd.swiss/en/services/ai-security). - **AI literacy programme under Art. 4 EU AI Act:** We train by role: all employees, power users, development, human oversight and contracted externals. You receive proof of attendance and an annual refresher. Art. 4 has required AI literacy measures since 02.02.2025, but no certificate. We set up the training register, which the Commission says can serve as evidence (Q&A on Art. 4 of 27.07.2026). - **DPIA and FRIA templates with first runs:** DPIA and FRIA are impact assessments for data protection and fundamental rights. The DPIA template follows the FADP and Art. 35 GDPR and adds AI questions. Only certain deployers need a FRIA: public bodies and services, creditworthiness checks and life or health insurance. We run two or three rounds with you and your [external or internal DPO](https://www.sidd.swiss/en/services/data-protection-advisor-switzerland) , who continues the DPIA. - **Technical documentation and logging:** Templates for the technical documentation under Annex IV EU AI Act, with model cards and datasheets. SMEs and small mid-caps may use a simplified version. The requirements provide for logs kept for at least six months. Deployers file the provider's information there for oversight and the DPIA. - **Incident and reporting process:** A runbook connects AI incidents to your reporting channels under Art. 24 FADP and Art. 33 and 34 GDPR. Serious incidents involving high-risk systems fall under Art. 73 EU AI Act. The deadline is 15 days, or 10 days in the event of death. For widespread infringements or critical infrastructure it is 2 days. Since 11.09.2026, products with digital elements are also subject to Art. 14 CRA. The runbook sets out initial assessment, roles, templates and authority contacts. We rehearse it once in a tabletop exercise. - **Clause library for supplier and customer contracts:** On the supplier side, it holds reviewed clauses for data processing agreements under the FADP and the GDPR. They cover training use, data location and disclosure abroad (Art. 16 and 17 FADP). Liability, audit rights, model changes and exit are added. Providers of high-risk systems receive the supplier agreement under Art. 25(4) EU AI Act. The review grid is the EU model clauses for public AI procurement (MCC-AI, version of 05.03.2025). Those who sell AI features receive templates for customer contracts. They cover roles and purpose (Art. 25(1) EU AI Act), transparency (Art. 50) and deployer support (Art. 13). - **Evidence in the Priverion Platform and ISO/IEC 42001 mapping:** Policies, registers, contracts and test results are held in audit-ready form in the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform) , hosted in Switzerland. At the end you receive a gap list against Annex A of the AI management standard ISO/IEC 42001:2023. Plus adds a documentation skeleton for clauses 4 to 10 with a Statement of Applicability. Not included are certification, internal audit, management review, attack testing and ongoing operation. Only an accredited body can certify. After handover, operation passes to your owner or the [external AI Officer](https://www.sidd.swiss/en/services/ai-officer). We do not guarantee compliance. Regulators, customers and auditors can follow our evidence. ## What often remains open after the Check Rules only work if someone maintains them. After a Check, four gaps usually remain open. > **Typical gaps** > > **A policy without an approval process:** Private AI accounts are banned, but nobody can request a tool officially. So teams keep using private accounts. **An inventory without an owner:** After handover, nobody maintains the list from the Check. **Training without a register:** There is no record of who completed which training and when. **Contracts without AI clauses:** The 2022 data processing agreement with the cloud provider covers neither training use nor model changes. ## Why policies alone are not enough Three dated figures on AI policies and shadow AI, meaning AI use without approval. They show patterns, not your case. - **20 %** of organisations with a data breach reported an incident involving shadow AI. Where it was widespread, the breach cost USD 670'000 more on average. 63 % of those affected had no finished AI governance policy yet (IBM Cost of a Data Breach Report 2025, 30.07.2025). - **1 in 3** Swiss SMEs using AI has a clear data protection rule for AI. In firms with 5–9 employees it is only 23 % (AXA SME Labour Market Study 2025, 300 SMEs, 08.10.2025). - **57 %** of employees who use AI conceal it or pass off AI output as their own work. Only 40 % report an employer rule on generative AI (KPMG/University of Melbourne, Trust, attitudes and use of AI, April 2025). The survey covered 48'340 people in 47 countries. ## Service packages You choose the package by number of AI applications, in-house development and regulation. All prices are excl. VAT. We agree the fixed price after an initial scoping call. ### Buildup Essentials Agreed fixed price from CHF 9'800 up to 10 AI applications · 4–6 weeks For SMEs with up to around 50 employees that use AI tools such as ChatGPT without in-house AI development. More than ten applications or no reliable inventory: higher effort. Five to six consulting days including legal sign-off. - Inventory and action plan from the Check, or a compact new inventory - Role model with AI Officer function, system owners and escalation path - AI governance directive and four core policies: AI use, procurement and supplier due diligence, data and retention, incidents and reporting - Half-day training with evidence template, screening for impact assessments (DPIA/FRIA), review grid for supplier contracts - Evidence repository in the Priverion Platform, briefing for executive management ### Buildup Standard Agreed fixed price from CHF 16'500 recommended · up to 25 AI applications · 6–8 weeks For companies with 50–250 employees that build their own AI features or serve EU customers. Example: AI search in your own documents (RAG). EU customers and auditors ask for exactly these rules, clauses and templates. Nine to twelve consulting days including training and legal review. - Everything in Buildup Essentials - Policy set with nine documents. In addition: development and operation of AI models, human oversight, transparency and marking, model and change management. - DPIA and FRIA templates with two first runs. Plus templates for technical documentation and logging. - Clause library for supplier and customer contracts: data processing agreement, EU AI Act obligations, training use, data location, output rights, liability, audit rights. Alignment with the EU model clauses MCC-AI and review of the three most important supplier contracts. - Two training sessions with training register: executive management half a day, employees one day or two half-days. Anyone who misses it receives a recording. - Priverion Platform with evidence, gap list against ISO/IEC 42001 Annex A, 30 days of support after handover, management report ### Buildup Plus Agreed fixed price from CHF 26'000 regulated industries and high-risk · 8–10 weeks For companies with 250–1'000 employees, FINMA-supervised firms and healthcare. Also for groups in CH, EU and UK or with possible high-risk systems. The price depends on the number of these systems and providers. Fifteen to twenty consulting days including legal support. - Everything in Buildup Standard - High-risk readiness by role. For providers developing AI: risk management, documentation, logging, human oversight, post-market monitoring, registration. For deployers using AI: their obligations including informing workers and the FRIA where applicable. If you judge an Annex III system not to be high-risk, we document this under Art. 6(3). - Documentation framework for your AI management system under ISO/IEC 42001 with Statement of Applicability and quantified remaining effort to certification readiness. - Supplier due diligence for up to ten AI providers: questionnaire, risk rating, sub-processors. Up to five contracts reviewed clause by clause, with renegotiation points. - Workshop with the board of directors and executive management, with FINMA alignment where applicable. - 60 days of support after handover An AI Governance Check from the last six months is credited: CHF 1'900 for the Basic Check, CHF 2'900 for the Standard Check. Afterwards, the [external AI Officer](https://www.sidd.swiss/en/services/ai-officer)can take over operation on request. For AI in your own products, the Buildup is also part of the [AI Governance Package](https://www.sidd.swiss/en/services/ai-governance-package). In the [initial consultation](https://www.sidd.swiss/en/contact) we narrow down the scope. ## How we work Six steps, each with an accepted deliverable. Depending on the package, your team invests three to eight workshop half-days, the training days and around one day per week. Without internal owners, governance does not last. ### Free scoping We clarify your AI applications, in-house development, the countries involved and the evidence you need. We agree the fixed price after an initial scoping call. Within 24 hours you receive scope and quote in writing. An existing [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) feeds in directly. ### Kick-off and roles We transfer the inventory and action plan into the Priverion Platform. In a workshop with executive management we clarify owner and risk class per application, approval of new tools and reporting lines. The inventory thus becomes the risk register. ### Policy set We adapt our policy templates in two rounds with your business units. Dr. Dominic Staiger's team signs off every rule legally. With the InfoSec team we check the technical requirements for feasibility. ### Templates and contracts We adapt all templates to your systems. In parallel, we review the most important supplier contracts for renegotiation points: three in Standard, five in Plus. Further contracts are covered by the AI Officer mandate or the AI Governance Package. ### Training and first runs We train executive management, employees and development and record everyone in the training register. First DPIA and FRIA runs and a tabletop incident exercise show whether templates and roles work. ### Acceptance and handover You receive the management report and the gap list. Once executive management has approved the rules, we hand over to your internal owner or the [external AI Officer](https://www.sidd.swiss/en/services/ai-officer). For a certificate, the [ISO 42001 implementation project](https://www.sidd.swiss/en/services/iso-42001-ai-governance) follows on directly. ## Why SIDD What this means for you: ### Every rule with its norm Every rule names its basis in the EU AI Act, the FADP or ISO/IEC 42001. Dr. Staiger's team signs it off. Auditors find the reference without having to ask. ### Workable rules for developers Our engineers check every requirement for feasibility in the code. Whatever does not work, we rewrite before sign-off. ### An owner for every building block A named person in your organisation carries each building block forward. You know the internal time required upfront. Without owners, governance soon lapses. ### Audit-ready evidence Policies, registers, contracts and impact assessments are held audit-ready in the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform) in Switzerland. You can thus answer requests from customers and auditors within a day. ### Confidential, documents kept in Switzerland We hold your documents under NDA and duty of confidentiality on systems in Switzerland. Advice given as attorneys is also covered by attorney-client privilege (Art. 321 of the Swiss Criminal Code). ### Advisory and audit kept separate The Buildup is advisory work, not certification. We may later test a system whose governance we built. In the [AI security assessment](https://www.sidd.swiss/en/services/ai-security) we then disclose this and separate the engagements. ## Check, Buildup and AI Officer compared The three offers build on one another: baseline assessment, implementation, ongoing leadership. | AI Governance Check | AI Governance Buildup | AI Officer | | --- | --- | --- | | Purpose: baseline assessment with inventory, classification and action plan | Purpose: implementing the action plan as a project with acceptance | Purpose: ongoing AI governance as an external mandate | | Deliverable: report, action plan, summary for the board and executive management | Deliverable: roles, policy set, training register, templates, clause library, evidence in the Priverion Platform | Deliverable: maintained inventory, reports to executive management, named point of contact | | Duration: 3–5 weeks | Duration: 4–10 weeks depending on the package, then handover | Duration: ongoing, three months' notice | | Price: from CHF 3'900 (Basic), from CHF 7'500 (Standard), Enterprise on request | Agreed fixed price from CHF 9'800 (Essentials), from CHF 16'500 (Standard), from CHF 26'000 (Plus) | Price: Readiness from CHF 500/month, Governance CHF 1'500–3'500/month, Full mandate on request | | When it makes sense: you need a baseline assessment | When it makes sense: you know the gaps and want to close them | When it makes sense: someone should lead the governance for you permanently | | Internal effort: interviews and documents | Internal effort: 3–8 workshop half-days, about one coordination day per week, owners, sign-offs | Internal effort: points of contact per area, sign-offs | | Next step: Buildup, AI Officer mandate or in-house implementation | Next step: AI Officer internal or external, optionally the ISO 42001 implementation project | Next step: takes over the Buildup deliverables and carries them forward | The typical path runs from the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) via the Buildup to the [AI Officer](https://www.sidd.swiss/en/services/ai-officer). For a certificate from the outset, choose the [ISO 42001 implementation project](https://www.sidd.swiss/en/services/iso-42001-ai-governance). Buildup, AI Officer and security assessments are bundled in the [AI Governance Package](https://www.sidd.swiss/en/services/ai-governance-package). Our tool: LexCommand ## Why we work with LexCommand, our own Swiss legal AI LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform). ### Sovereign in Switzerland The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control. ### No citation, no claim Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible. ### From effort to judgement LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence. ### Three disciplines, one picture We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses. In the Buildup, LexCommand cites the source for every policy and clause: EU AI Act, FADP or ISO/IEC 42001 Annex A. It places matching obligations from several frameworks side by side. Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer. ## Frequently asked questions ### What does the Buildup cost, and how long does it take? Essentials: agreed fixed price from CHF 9'800 in 4–6 weeks. Standard: agreed fixed price from CHF 16'500 in 6–8 weeks. Plus: agreed fixed price from CHF 26'000 in 8–10 weeks. All prices are excl. VAT. We agree the fixed price after an initial scoping call. Your team provides three to eight workshop half-days, around one coordination day per week and one responsible person per building block. ### Do we need the AI Governance Check first? Not necessarily: a reliable inventory from another source also works. The route via the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check) is usually quicker and not more expensive. The Check delivers inventory, classification and action plan from CHF 3'900 in 3–5 weeks. If it is no more than six months old, we credit CHF 1'900 (Basic Check) or CHF 2'900 (Standard Check). ### What distinguishes the Buildup from the ISO 42001 implementation project? For a certificate from the outset, the [ISO 42001 implementation project](https://www.sidd.swiss/en/services/iso-42001-ai-governance) is the direct route. It takes your AI management system under ISO/IEC 42001 to certification readiness, with internal audit (clause 9.2) and management review (9.3). The Buildup builds governance for day-to-day operation and covers more ground: usage rules, contracts, training, development. Buildup Plus delivers the documentation skeleton with Statement of Applicability and quantifies the remaining effort to certification readiness. ### Who runs the governance after handover? After acceptance by executive management, we hand over to a named person in your organisation. This includes a reporting rhythm, a maintenance process and one responsible person per building block. If you lack capacity or expertise internally, the [external AI Officer](https://www.sidd.swiss/en/services/ai-officer) takes over ongoing management and keeps your rules up to date. In the [AI Governance Package](https://www.sidd.swiss/en/services/ai-governance-package) the Buildup is the setup building block, with one contact for governance, security assessments, data protection mandate and contract reviews. ### We have no EU customers. What are we building this for? For obligations that already apply: Art. 21 FADP on automated individual decisions and Art. 22 FADP on data protection impact assessments. Add to this the duty of care of the board and management (Art. 717 or 812 CO). The EU AI Act already applies when the output of your AI is used in the EU (Art. 2(1)(c)). The Buildup assigns every rule to its legal basis, so future obligations also fit into existing roles and registers. ### Our AI policy comes from a template. What does the Buildup add? A template sets out prohibitions, but not approvals, personal data or tools on private accounts. The Buildup adds the approval process, the inventory with owners, the training register under Art. 4 EU AI Act and AI clauses for suppliers. According to the [AXA SME Labour Market Study 2025](https://www.axa.ch/de/ueber-axa/medien/medienmitteilungen/aktuelle-medienmitteilungen/2025/20251008-kmu-arbeitsmarktstudie-2025-ki.html) only a third of Swiss SMEs using AI have a clear data protection rule for it. Essentials aligns your policy with the EU AI Act and the FADP and builds the processes around it in 4–6 weeks. ### We have high-risk candidates under Annex III. Is the Buildup enough? For the preparation, yes: the Plus package covers the obligations of your role as provider or deployer. Before that, the [AI Governance Check](https://www.sidd.swiss/en/services/ai-governance-check)clarifies whether a system is actually high-risk. Annex III obligations apply from 02.12.2027, and from 02.08.2028 for AI in products under Annex I. As of 21.07.2026 the EU Official Journal listed no harmonised standard, so even ISO/IEC 42001 gives no presumption of conformity. ### We are FINMA-supervised. Does the Buildup cover the supervisory expectations? The ten building blocks map onto FINMA Guidance 08/2024, from governance (section 2.1) to explainability (section 2.6). In the Plus package we map every building block to these sections and to FINMA Circular 2023/01 (operational risks). We anchor ongoing monitoring (section 2.4) in model and change management and in reporting to executive management. We do not carry out the independent review (section 2.7) ourselves, because we built the governance. ### How does the Buildup relate to our DPO mandate? Your [external or internal DPO](https://www.sidd.swiss/en/services/data-protection-advisor-switzerland) advises and monitors under Art. 10 FADP. The Buildup adds AI templates for DPIA and FRIA, rules on automated individual decisions and AI clauses for data processing agreements. The role model sets out joint decisions with the AI Officer, for instance on new AI tools involving personal data. If we already act as your external DPO from CHF 500/month, scoping is shorter. *This page does not replace legal advice in individual cases.* On this page - What is the Buildup? - When does it make sense? - Three disciplines - What we build - Typical gaps - Figures and sources - Service packages - Approach - Why SIDD - Offers compared - LexCommand - FAQ --- This document is the Markdown rendition of the page linked above. Please cite the HTML URL.