Monika Stawasz is an independent AI governance consultant based in Poland, working with regulated organisations across the European Union and the United Kingdom. She is a lawyer and an ISO/IEC 42001:2023 Lead Auditor. Her work covers ISO/IEC 42001 implementation and certification readiness, EU AI Act obligations, and the governance of generative and agentic AI. She translates regulatory requirements into controls that engineering teams can implement, and works directly with the teams that build and run the systems.
What I do
I advise organisations that deploy AI and organisations that build it. Legal and regulatory analysis, management system implementation, and work with the teams that deliver AI, especially systems that act through tools and through other agents.
You do not have to build models to fall within the scope of an AI management system. Under the AI Act, obligations depend on your role, the system concerned and how it is used. Working that out comes first.
What you end up with. An AI register your own teams keep current, and a risk classification they can apply without calling me. Release gates with criteria in them, and a name next to every control. Records a certification body will accept, produced by the work itself.
→ Services
→ ISO/IEC 42001 implementation and certification readiness
→ Governance for AI agents and agentic systems
→ The first ninety days of an implementation
Selected experience
| Area | Experience |
|---|---|
| AI inventory | 130+ AI systems in one group’s register, built from nothing |
| AI risk classification | Four tier enterprise risk model, integrated with procurement and product governance |
| Shadow AI | Identified and brought into an approval route through intake and acceptable use |
| AI vendor governance | Contracts with international AI vendors, including limits on data use and model training |
| ICT third-party risk | End to end vendor onboarding for financial institutions: due diligence, KYC, DORA, AI Act risk classification, security ratings, SOC 2 reports |
| EU AI Act | Provider and deployer determination, use case classification, obligations mapping |
| ISO/IEC 42001 | Lead Auditor, 2026. Certification readiness programme in progress |
| Agentic AI | Governance across the agent lifecycle in a multi agent enterprise platform |
| Corporate governance | Eight years, 180 entities and 35 jurisdictions, before AI |
Where AI governance goes wrong
The policy nobody in engineering knows about. An AI policy gets approved at group level and does not reach the people writing the code. When an auditor asks how a specific requirement from that policy shows up in a team’s daily work, there is no process step to point at.
Advice written without understanding the system. An AI Act analysis produced from a summary comes back with recommendations your architects will not apply: they do not answer to how the system actually works. The team sets it aside, and you find out at the audit.
A ready-made documentation pack instead of audit readiness. A purchased pack — policy, procedures, templates — gives you documents. It cannot give you the step in your process where each document gets produced, or the person who owns that step.
Start here
Write to me. I will tell you where to start, and whether the work needs someone from outside.