How an engagement runs
No discovery theatre. We work in short, evidenced phases, and you own everything we produce.
Scoping call
Thirty minutes. What you are building or defending, what deadline is driving it, who has to sign off. We tell you if we are a fit before anyone signs anything.
Assessment
We inventory AI in use, including the tools nobody told you about, and map it against ISO 42001 Annex A or NIST AI RMF. You get a control coverage summary and a ranked gap list.
Remediation and build
Policies, data boundaries, access controls, logging. Where we are implementing, we build in your environment against your standards, not in a sandbox we hand over later.
Support and evidence
Questionnaires answered, evidence kept current, new use cases assessed before they ship. Retainer or block of hours, your call.
Common questions
Do you replace our existing security team?
No. We work alongside them, usually because AI governance landed on a team already at capacity. Staff augmentation is a large part of what we do. An engineer embeds with your people for a defined block.
We have not deployed any AI yet. Is it too early?
It is the best time. Controls designed before deployment cost a fraction of controls retrofitted after, and you avoid the shadow-AI cleanup that most organizations are now doing.
Can you get us ISO 42001 certified?
We get you ready and support you through it. Certification itself is issued by an accredited certification body, and no consultancy that also certifies you is one you should trust.
How fast can you turn around a vendor questionnaire?
A first pass on a standard SIG or CAIQ is typically days, not weeks. Once your answer library is built, most later questionnaires are a review rather than a rewrite.
What size company do you work with?
Mid-market through enterprise, plus smaller companies selling into enterprise. Those tend to feel questionnaire pain first and hardest.
Start with the scoping call.
Thirty minutes tells us both whether there is a project here.