Novus Point — London & Dubai
Novus Point is an advisory firm working with B2B clients from London and Dubai — strategic consulting, AI governance and AI automation.
Principal-led on every engagement, with advisers in AI, law, security and data brought in under the firm's direction where the work needs them.
Request a 30-minute diagnostic How the audit works
enquiries@novus-point.co.uk — or the short form at /contact. Either way, your enquiry is answered at principal level. No intake queue.
Where the Act stands today
What we do
Most firms will sell you strategy or sell you technology. The gap between the two is where money is lost. We work across both, which means the governance question gets asked before the build starts, not after the regulator does.
01 — Strategic consulting
Strategy, financial advisory, technology and talent. The work is board-facing: options set out plainly, trade-offs named, a recommendation you can put your name to. Built on eleven years of running an operating business in the UK market.
Read the practice — strategic consulting Talk to us about strategy02 — AI governance
Regulation (EU) 2024/1689 is in force and its penalty provisions under Article 99 are enforceable. Most organisations do not yet know which of their systems the Act actually touches. We sort that first — inventory, classification, and a written position on where you stand.
Read the practice — AI governance The EU AI Act, in detail Talk to us about governance03 — AI automation
We build our own AI products, Hadar and Operark, and test our methods on them before we advise you. Automation designed from the start to be documented, auditable and explainable, because the alternative gets switched off.
Read the practice — AI automation Talk to us about automationEU AI Act — Regulation (EU) 2024/1689
The Act is written to protect safety and fundamental rights while keeping AI adoption open. Read that way, most of the work is classification: deciding what you actually run, and which category it falls into. Almost nobody starts there. That is the whole problem.
Applied 2 February 2025
01
The Article 5 prohibitions have applied since 2 February 2025. This is the shortest list and the first thing to clear.
Applied 2 February 2025
02
Article 4 has applied since the same date, 2 February 2025. It is an obligation about your staff, not your software, which is why it is routinely missed.
From 2 December 2027
03
Those obligations apply from 2 December 2027. That is time to prepare properly — and no time at all if the inventory has not been done.
Applied 2 August 2025
04
Article 99 penalties are enforceable. What protects you is documentation, and documentation is built before it is needed, not after.
Dates as the Regulation stood on 27 August 2026. Still ahead: 2 December 2026 (new Article 5 prohibitions, and the Article 50(2) marking deadline for generative systems already on the market), 2 December 2027 (Annex III high-risk systems) and 2 August 2028 (Annex I high-risk systems). The full application calendar, with every date and its provision, is on the practice page.
We sort that first
We will not promise you compliance. No adviser can — the regulator decides that, not us. What we can give you is an accurate picture of where you stand and a defensible order of work. In most cases that is what was missing.
The audit
The audit is the firm's entry product, and it is how the AI work begins: three steps, built so that you can stop after any one of them and still be further ahead than when you started.
Strategic consulting enters through the same door — the diagnostic call scopes it, and where the question is a board decision rather than an AI exposure, we say so and scope that instead. Step one is free. Step two is a fixed fee, agreed on the diagnostic call before anything is written, and produces a document you own. Step three only happens if the document says it should.
01
Five questions, and most of the half hour is us listening. What AI do you actually run — including the tools bought on a departmental card and the ones your suppliers operate on your behalf? Who inside the organisation touches them, and on whose authority? Did you build them or buy them? What have you already committed to in contracts, tenders and board minutes? And if someone asked you to evidence any of it tomorrow morning, what would you hand them?
You leave the call with a straight answer: whether your exposure is material, where it sits, and whether this is worth taking further. If it is not, we say so on the call. Nothing follows unless you ask for it.
Outputa straight answer: whether the exposure is material, and where it sits
02
A short document — short enough that a board will actually read it — in four parts.
Inventory. Every AI system in use, named, with its owner, its supplier, its purpose and the data it touches. This includes the tools nobody procured and the AI features that arrived inside software you already licensed.
Classification. Each system placed against the EU AI Act's categories, and each placement reasoned in writing rather than merely asserted, so that it can be defended to a regulator, challenged by your own counsel, or revised when the system changes.
Exposure. What follows from the classification: which obligations attach to you, which are already live, which arrive later, and what doing nothing actually costs. That includes the general-purpose model obligations, which have applied since 2 August 2025 and can catch anyone distributing or fine-tuning a general-purpose model — the live obligation most often missed. Penalties run to EUR 35m or 7% of global annual turnover for prohibited practices, and to EUR 15m or 3% for most other breaches.
Order of work. Sequenced and honest about it: what to do first, what can wait, what needs a board decision and what needs only an owner and a date. Costed where costing is possible, flagged where it is not.
The document is yours. Take it to your general counsel, your auditor or another firm — it is written to survive that.
Outputone document, four parts — inventory, classification, exposure, order of work
03
Scoping starts from the position document, not from a sales conversation. The order of work is already written down, so the proposal is an argument about sequence and cost, not about what the problem is. Everything is priced before it starts: discrete work as a fixed fee against a named scope, and the number on the proposal is the number on the invoice for that scope. If the scope changes, we re-price in writing and you agree it before the work continues — no variation arrives on an invoice. Where the work is genuinely open-ended — a governance function that has to be stood up and then run — we say so and price it as a retained arrangement rather than dressing it up as a project.
We take a limited number of engagements each quarter, because senior-led means what it says: the principal who ran your diagnostic runs your engagement. That constraint is the reason we tell people at step one when we are not the right firm. If the position document shows small exposure and a short order of work, you do not need us to execute it — and it will say so.
Outputa proposal priced against a named scope, before any work starts
The audit tells you which of these you are in. It is often more than one.
Regulation (EU) 2024/1689 has been in force since 1 August 2024, and it is now enforcing rather than approaching — the dates are set out in the timeline above. The work starts with classification rather than with remediation, because you cannot remediate what you have not named, and you cannot answer a regulator, a client or an insurer by describing your intentions. What the audit produces is a written account of what you run and which category each system falls into, reasoned well enough to be argued with.
Read the practice — EU AI Act complianceA deadline is a date. Governance is what still works the week after it. This is the operating layer: who owns each system, who may approve a new one, what is logged, what is reviewed and on what cycle, and what authorises a person to stop the thing. We build it so that the evidence is a by-product of running the business rather than a project someone has to mount the week a regulator, a client or an insurer asks. Where a client wants an external frame for that work, ISO/IEC 42001 — the first international management-system standard for artificial intelligence — is the one worth building towards. It is a management-system standard, not a route to AI Act compliance, and we are careful not to sell it as one.
Read the practice — AI governanceWe build our own AI products, Hadar (a CRM for Dubai real-estate brokerages) and Operark, and test our methods on them before we advise you. That changes the advice we give. Automation is designed from the first sprint to be documented, logged and explainable, because retrofitting an audit trail onto a working system costs more than building it in. An agent that cannot show its reasoning to the person who has to answer for it gets switched off eventually — and rarely at a convenient moment.
Read the practice — AI automationHow we deliver
Step one is thirty minutes and costs nothing.
The other half of a scope
Every firm publishes what it does. The useful half is the part that tells you when to stop reading — so here it is, before you spend half an hour on a call.
Compliance
No adviser can — the regulator decides that, not us. What we give you is an accurate picture of where you stand and a defensible order of work.
Certification
We are not a certification body and we do not audit for one. ISO/IEC 42001 is a management-system standard, not a route to AI Act compliance, and we are careful not to sell it as one.
Scope
Whether the Act reaches you is a question of fact about your systems, your users, your suppliers and the markets you sell into. Half an hour and your own list settles it. A page cannot.
Implementation
Plenty of recommendations end at the board decision and are executed by your own people or by another firm. That is a good outcome, not a lost one.
Recommendations
The document states what would have to be true for the recommendation to be wrong, so that a disagreement can be about evidence rather than about who is more senior. If we do not hold it, we do not sign it.
Fit
If what you need is twelve people in four countries at once, a large firm is built for that and we are not. We say so on the diagnostic call, at step one — not after the invoice.
The firm
Jakub Piórkowski
Founder & Principal · London & Dubai
Novus Point is deliberately senior-led: the principal who takes your first call is the principal who runs the engagement. Behind the firm is an operating record — eleven years running a business in the UK market — and the governance obligations of chairing the Supervisory Board of Carlson Investments SE, a company listed on the Warsaw Stock Exchange (WSE: CAI). We also build our own AI products, Hadar and Operark, and test our methods on them before we advise you.
Novus Point works with several advisers — in AI, law, security and data — brought into an engagement where the matter needs them, under the firm's direction and on the firm's responsibility. Clients are told who is on their matter before they start. What does not happen is the pattern the market is used to: a senior name at the pitch, and someone else entirely on the delivery.
Next step
The audit — three steps