Provenance is being established in the EU and expects to begin work in 2027

What Provenance does

Compliance you can act on.

Each piece of work below is a defined job with a clear end — you know what you get, how long it takes and what it costs before anything begins. Under deadline on one deal? Start there.

01

EU AI Act

You are putting AI into your product.

The EU AI Act places duties on the companies that build and use AI. The heaviest duties, for high-risk systems, are due from December 2027 — but the questions start now, from customers, from your board, from procurement.

We work out whether and how the Act touches your AI, build the assessments it needs, and leave you with policies and evidence your own people can keep up.

Ask about this

What you get

  • An inventory of your AI use and the data behind it
  • The facts your lawyers need to classify each system under the Act
  • One combined data-protection and fundamental-rights assessment, where both are required
  • Internal AI policies, a short literacy session, and a 90-day plan with named owners

Planned length

Two to four weeks, with a shorter version in about two.

Planned fee

Roughly €1,500 to €3,000.

02

GDPR & DPO

You need a DPO, not a hire.

The GDPR has applied since 2018, and it still decides whether a deal closes and whether a complaint becomes a fine. Many growing companies need a data protection officer’s work long before they need a full-time one.

Provenance can act as your outside data protection officer, or put one gap right — your records, your data-subject requests, privacy by design — and then keep it current month to month if you want.

Ask about this

What you get

  • A named data protection officer or privacy lead, or a one-off cleanup
  • Records of processing, kept simple and current
  • A working way to handle requests from individuals and authorities
  • Privacy built into new projects from the start

Planned length

Ongoing, or two to three weeks for a one-off review.

Planned fee

Monthly from about €500; one-off reviews from about €1,500.

03

Data transfers

A customer wants proof your data is safe.

Send personal data outside Europe — to a US cloud, a support team in India, anywhere — and you have to show it travels safely. Customers and regulators now ask to see the paperwork, not just hear that it exists.

Provenance maps where your data comes from and where it goes, and gathers the evidence behind each transfer as plain documented fact. Whether a transfer is lawful stays a question for your lawyers, and they will have the file to answer it.

Ask about this

What you get

  • A register of your data sources and the terms behind them
  • A map of every transfer and the mechanism it relies on
  • The factual file for a transfer assessment: data types, encryption, access controls

Planned length

Two to four weeks.

Planned fee

Roughly €2,000 to €2,500.

SourceSupport ticketsCollected under the customer contract, which allows use to improve the service.
Documented
UseTraining the assistantHealth and payment details removed before training; the step is logged.
Documented
TransferA processor in the USStandard clauses signed; the transfer assessment is not yet on file.
Gap · by 31 March

04

DORA & NIS2

A bank or insurer sent you DORA terms.

If you supply software or services to banks, insurers or other essential-service operators in Europe, their duties under DORA and NIS2 flow down to you — usually as a stack of operational promises inside a contract your delivery team has never priced.

Provenance sets each requirement beside what you can honestly show today, and prices the gap. Your team commits to what it can keep, and your lawyers negotiate from facts instead of fear.

Ask about this

What you get

  • Each requirement mapped to your evidence, with the cost of closing each gap
  • The data your customer needs for its register of suppliers
  • An incident-notification runbook matched to your customer’s timelines
  • An exit and handover plan

Planned length

Three to four weeks, in two phases.

Planned fee

Roughly €2,000 to €4,000.

05

Data Act

The Data Act changes who can use your data.

The EU Data Act changes who may use the data that connected products and cloud services generate. For many businesses it is a new set of rights to claim and duties to meet, and it is easy to miss until a partner raises it.

Provenance works out what the Act means for your products and your contracts, and sets out in plain terms what you can ask for and what you have to provide.

Ask about this

What you get

  • A plain read of where the Data Act touches your business
  • Your rights and duties as data moves to and from partners
  • The points your lawyers should carry into contracts

Planned length

Two to three weeks.

Planned fee

Roughly €1,500 to €2,500.

06

EU representative

“Who is your EU representative?”

If your company is based outside the EU but has customers or users inside it, the law often needs someone established in Europe to answer for you — under Article 27 of the GDPR, and, as the AI Act takes effect, under that too.

Once Provenance is established in the EU, it can be that named representative, with the records and the request-handling behind it. A portal gives you a mailbox; this gives you a senior person who also understands your systems. Provenance never acts as both your representative and your data protection officer.

Ask about this

What you get

  • A named representative in the Union
  • The record of processing the role requires
  • A clear route for requests from individuals and authorities

Planned length

One to two weeks to set up, then year by year.

Planned fee

About €1,000 to set up; roughly €600 to €2,400 a year by company size.

07

Prove what you sell. Verify what you buy.

A buyer’s questionnaire is blocking the deal.

Sometimes it is not a programme you need — it is one deal, stuck. A buyer has sent a security, privacy or AI questionnaire, or wants data-protection schedules, and a date is set.

Provenance answers the questions against your real evidence, writes the factual schedules your lawyers turn into contract terms, and tells you plainly where the honest gaps are. It never acts for both sides of the same deal.

Ask about this

What you get

  • The completed questionnaire, each answer tied to its proof
  • The factual content for the contract schedules — no clause wording
  • An honest list of gaps, each with a date you can commit to
  • A reusable pack, so the next deal moves faster

Planned length

One to three weeks.

Planned fee

Roughly €2,000 to €4,000.

What it will cost

Planned, and in plain sight.

Provenance has not opened, so these are planned figures, not a price list. They are here because no one should have to book a call just to learn whether something is affordable. Every figure excludes VAT, and the fee for your work is the one written into your agreed scope.

See how a piece of work runs

Not open yet — worth writing anyway

Tell Provenance what you are working on.

Provenance opens in 2027. Write now and you join the first group of clients, at the founding rate — and you will hear the day the calendar opens. A few lines about the company, the deal or the product, and what is blocking you, are enough. Hemant reads every message himself.

hemant@provenancelda.eu