Lead engagement

AI system compliance audit.

We audit one AI system end to end, on compliance and on risk. You receive a formal opinion in the manner of a financial audit, the evidence base behind it, and a remediation plan ordered by exposure rather than by ease.

Duration: 2 to 6 weeks
Access required: None to model weights
Frameworks: AI Act, ISO/IEC 42001, NIST AI RMF
Output: Formal opinion and roadmap

Scope an audit

Why a third-party view

The Act allows a self-assessment of conformity for most high-risk systems. A self-assessment is hard to defend the day an authority, a client or a committee challenges it. An outside view and a formal opinion are what make your position defensible.

No access to the model

The assessment runs black box. You are not blocked by what you cannot open: a vendor product, a provider that refuses access, a build team that has left the company.

Scope

Eight pillars, tested in practice.

We do not tick a list of documents. For each pillar the question is the same: does it actually hold?

Risk management and governance. A working risk process, with clear ownership and decision rights.

Data governance. Quality, lineage, minimisation and representativeness of the data.

Documentation and traceability. Documentation and logging that keep the system auditable after the fact.

Transparency and explainability. Whether a decision can be accounted for to a regulator, a client or an affected person.

Human oversight. Whether operators can understand the system, intervene and override it.

Accuracy, robustness and security. Performance on the population actually served, and resistance to stress, drift and attack.

Fairness and fundamental rights. Differences in outcome across groups of people, and whether they are justified.

Regulatory alignment. The correct classification, and the obligations that follow.

Dedicated stream

Discovery and inventory. A living registry of every AI system, shadow AI and vendor-embedded AI included, run as a workstream of its own and feeding the audit continuously.

How we run it

Six steps, from the question asked to the action plan.

Framing and risk appetiteWhat the audit must decide, the scope, and the materiality threshold that defines what we flag.
Classification and roleEach system gets one tier on our consolidated risk scale, Light, Medium or Maximal, rolling up its AI-regulatory, privacy, cyber and ethics exposure, plus a provider or deployer qualification. The tier sets the depth of the audit.
Proportionate reviewA Light case passes on a light-touch survey. A Maximal case gets a data protection and fundamental rights impact assessment, bias and robustness testing, and a review of documentation, data governance, human oversight and logging.
Gap analysisMeasured against the obligations in force and those most likely to affect you next, so that remediation stays valid.
Formal opinion and reportAn opinion, a board-ready readout and an audit evidence pack.
Action planRemediation steps prioritised by risk, effort and deadline, each with an owner.

Deliverables

What you receive.

Inventory of the audited systems Risk classification Prioritised gap analysis Per-dimension risk scorecard Quantitative bias testing Robustness testing Explainability analysis Standardised model card Remediation roadmap Residual-risk register Formal opinion and evidence pack Executive summary Monitoring recommendations

Who the audit is for

Compliance, risk and legal leaders, data protection officers and heads of AI governance who have to answer for a system before a committee, a client or an authority.

Before and after the audit

The audit is one step in a journey.

Before · Map

AI system inventory and registry

To pick the right system to audit, you first need to know all of them.

After · Remediate

AI Act remediation

Execution of the action plan, through to a position you can defend.

Next step

Scope an audit.

Tell us which system is in scope. We will come back with a proposed scope, a duration and a fixed fee.

Write to us