A customer asks hard questions before signing
A SaaS team needs coherent answers about information security governance, policies and ownership. A scoped review separates available evidence from work still needed.
Compliance, GRC & AI Governance
Know what applies. Know what to do next.
Know which requirements matter, which gaps deserve attention and who owns the next step. Turn scattered policies into a working basis for customer conversations and internal decisions.
No one-size-fits-all price. Scope, deliverables and cost are agreed in writing.
Is this your team?
Made for teams like yours.
For founders, product leaders and organisations that need to explain how they manage AI, data and security risk.
- Your customers ask about security, privacy or AI governance, and the answers live in different teams.
- You are introducing AI and need to map suppliers, data flows, responsibilities and controls.
- You want to prepare for an agreed standard or regulatory framework without launching a sprawling programme first.
What changes for you
A promising deal. A security questionnaire. A folder full of policies nobody quite trusts. Let’s get the answers in order.
A prioritised readiness plan for one agreed framework, with named owners, useful evidence and practical next steps. Applicability is assessed by country, sector, size and organisational role.
Scope first. Useful work next.
The value, in plain English
AI governance consulting makes the uncomfortable questions easier to answer: which AI tools are in use, what data they touch and who owns the risks. Your team gets a focused compliance readiness assessment and a prioritised plan, rather than another policy folder nobody opens.
From the first question to a useful handover
Choose the requirement that matters
Define the product, market and process. A regulatory applicability assessment determines whether EU AI Act readiness, a NIS2 readiness assessment or a DORA gap assessment is relevant to the agreed scope.
Connect controls to real evidence
Use a GRC gap assessment for AI data flow mapping and supplier responsibilities. Record the agreed findings in an AI risk register. Decide which evidence supports customer security questionnaires and where action is needed.
Give the next steps an owner
Turn the review into a compliance action plan, with document drafts and an evidence handover your decision-maker can develop further.
Where this earns its place
Illustrative use cases. The actual work and acceptance checks are agreed in your proposal.
New AI tools, unclear responsibilities
An organisation needs an AI use case inventory and AI supplier risk assessment before expanding internal use. The work maps tools, data and the people responsible for controls.
CLIENT FEEDBACK
What our methodology delivers
What to agree for this service
Compare services and prepare your brief ↗Deliverables
- Map AI uses, suppliers, data flows and responsibilities for the agreed process or product.
- Review up to ten control areas and record gaps, supporting evidence and risk priorities.
- Deliver an action plan, up to three draft documents and a handover session.
- Package scope
- Compliance Readiness Sprint: one organisation, one process or product, one framework and up to ten control areas. We agree the scope and acceptance criteria in writing before work starts.
- What your team provides
- Provide accurate process information, relevant policies and a decision-maker. Your organisation owns the resulting decisions, implementation and ongoing compliance. Changes to the agreed scope require approval before work proceeds.
- Outside the package
- Full ISMS implementation, ISO certification, a SOC 2 examination, legal opinions and DPO appointment are outside this package. Wider implementation is quoted separately.
Acceptance examples to discuss
Illustrative checks for negotiation. These are not completed test results, new contractual promises or additions to the package. The written proposal defines the actual acceptance criteria.
- Each agreed control area links to available evidence or a recorded gap, with a proposed owner and next step.
- Document drafts identify the agreed process and framework, assumptions and decisions needing your approval.
Stuck on an AI decision? Get a clear next step.
A focused review of one AI purchase, integration or agent idea. Turn an uncertain decision into a written brief your team can act on.
€490 for one decision. Any applicable VAT and the agreed scope are confirmed in writing before acceptance. Requesting a review is not a purchase or a confirmed booking.
YOUR NEXT MOVE
Get your tailored proposal
Tell us about your organisation, your team and the product or process you want to improve. We will review the fit and follow up with the questions needed to shape a proposal. Scope, deliverables, timing and price are agreed before work begins.
Q&A
Good questions. Straight answers.
Which frameworks can we discuss?
ISO/IEC 27001 and ISO/IEC 42001 readiness, GDPR consulting, NIS2 readiness, DORA readiness and SOC 2 readiness, where applicable. The entry package covers one agreed framework; it does not assert that all of them apply to you.
Does this certify us?
No. ISO certification is issued by an appropriate certification body. SOC 2 is a separate professional examination and report. Readiness advice or a single penetration test cannot establish complete regulatory compliance.
What does an ISO 27001 gap analysis or ISO 42001 readiness review cover?
The agreed sprint reviews one framework and up to ten control areas. ISO 27001 readiness focuses on the agreed information-security evidence; ISO 42001 readiness addresses the agreed AI-management evidence. Full implementation and certification are separate.
When is GDPR readiness consulting or DPIA support for AI processing useful?
GDPR consulting helps clarify the defined data-processing questions in scope. A separately scoped DPIA assessment examines one processing activity, risks to people and possible safeguards. Your organisation retains its decisions and ongoing responsibilities.
Can this help us with SOC 2 readiness consulting?
SOC 2 readiness can identify gaps in the agreed controls and evidence. A SOC 2 examination and assurance report are separate professional work; this service does not issue them.
Do we get security policy development or an AI policy?
Up to three draft documents can be included in the agreed sprint. Security policy development, an AI acceptable use policy or responsibility records should reflect your actual process and require your approval.
Is fractional CISO consulting or DPO support included?
Fractional CISO consulting is a separately defined leadership mandate. DPO support is a distinct privacy service requiring an appropriate professional and an independence review. Neither role is automatically included in the readiness sprint.
What should we prepare for a compliance readiness assessment?
Bring the product or process, relevant countries and sector, existing policies, supplier details and a decision-maker. We agree the framework, deliverables and acceptance criteria before work starts.
Make an informed move.
Practical guides to help your team ask better questions before committing.