Know Exactly Where Your AI Stands
An expert review of the AI you’re running and the AI you’re planning, against the security, privacy, governance, and compliance requirements that apply to you.
- Every AI system in use, who owns it, and what data it reaches
- Gaps against ISO/IEC 42001, NIST AI RMF, and the EU AI Act
- Mapped onto the compliance program you already run
Four Deliverables, in Plain Language
AI Inventory
Every AI system in use or planned, who owns it, what data it reaches, and whether anyone approved it.
Risk Snapshot
Each use case tiered by the risk it actually carries, so controls are proportionate to potential harm.
Gap Analysis
Where you stand against the frameworks that apply to you, in the language an auditor will use.
Prioritized Roadmap
Quick wins and bigger moves, sequenced, with the effort named, readable by a non-technical director.
Five Stages, and Most Organizations Are on the First Two
In Use, Unmanaged
People are using AI. Nobody approved it, nobody is tracking it, and nobody could tell you what data it touches.
Experiments with Owners
Named pilots, but no consistent rules across teams and no inventory of what escaped the pilot.
Written and Known
Policy, an approved tool list, and an intake path for new tools that people actually use.
Operating with Evidence
Controls with owners: terms get re-read, settings get checked, the inventory stays current.
Normal Business
Governed as part of how the company runs, with reporting a board or auditor accepts without a special project.
The assessment tells you which stage you are actually at, not which one you would like to be at. Both answers are useful; only one of them is true.
Typically Two to Three Weeks, Once We Have Your Documentation
Kickoff and Discovery
A 60-minute session with the people who own AI, security, and compliance. We send a short documentation request the same day.
Review and Interviews
We work through what you sent, interview system owners, and map what is running against what is documented. The gap between the two is usually the finding.
Readout
A working session with your leadership team, the written assessment, and the roadmap. Yours to keep and act on, with us or without us.
Duration depends on how quickly documentation arrives. That’s the one variable we can’t compress.
- You’re in a regulated industry, or your customers behave as though you are
- AI is already in use somewhere, whether or not it was approved
- Someone has started asking, a board, an auditor, a carrier, a customer
- You need a defensible answer in weeks, not quarters
- You want a certificate without changing anything
- You need a tool license rather than judgment and a plan
- Nobody internally can give three hours to the process
Fourteen Years of Assessments in Rooms Where the Rules Are Strict
Assessment engagements start in the five figures. We confirm scope and price in writing before you commit to a call.