Technology

SaaS companies that embed AI in products used by EU customers are classified as AI system providers under the EU AI Act, regardless of where the company is incorporated. The applicable obligations depend on the risk classification of the AI system — general-purpose AI has transparency and documentation obligations, while high-risk AI (such as AI used in HR, credit assessment, or safety-critical applications) is subject to conformity assessments, technical documentation, EU database registration, and post-market surveillance. DOT’s AI Product Compliance programme delivers the full compliance framework within six to ten weeks.

DOT’s MLOps Maturity Assessment evaluates your current machine learning development and deployment practices across six dimensions: data management and feature engineering, model training and experimentation, deployment pipeline automation, model monitoring and drift detection, governance and audit trail, and team structure and capability. The output is a maturity score across each dimension, a target-state architecture design, and a prioritised remediation roadmap. The assessment is typically completed within three weeks.

AI red-teaming is structured adversarial testing of AI systems — applying the same methodology used in traditional penetration testing to the specific attack surface of AI models. It covers prompt injection (manipulating AI behaviour through crafted inputs), data poisoning (corrupting training data to influence model behaviour), model extraction (replicating proprietary models through inference attacks), and adversarial input attacks (inputs designed to cause misclassification). DOT recommends AI red-teaming for all customer-facing AI systems, all AI systems that process personal data, and all AI systems involved in consequential decisions.

Yes, and this is the approach DOT recommends for most technology companies pursuing both certifications. The control frameworks of SOC 2 (Trust Service Criteria) and ISO 27001 (Annex A controls) have significant overlap, meaning that evidence collected for one framework can frequently be mapped to the other. DOT designs a unified control framework that satisfies both simultaneously, reducing total evidence collection effort by approximately 30% compared to managing the programmes independently.

DOT’s DevSecOps engagement embeds security controls at the earliest stages of the development lifecycle — integrating static application security testing (SAST), software composition analysis (SCA), and infrastructure-as-code scanning directly into the CI/CD pipeline. These automated controls identify vulnerabilities at the point of code commit rather than post-deployment, eliminating the manual security review bottleneck and reducing remediation cost by an estimated 6× compared to post-deployment vulnerability management.