Featured engagement
The AI Vendor Risk Assessment
Banks and credit unions remain responsible for the AI tools they use. We review vendor evidence, data handling, and oversight controls before or after deployment. You receive documented findings and priorities, with scope and a fixed fee agreed before work starts.
What the assessment covers
Four pillars, one deliverable: an executive playbook with an owner and a deadline on every finding.
Catalog
Every generative AI tool, chatbot, transcription bot, browser extension, and SaaS copilot in use - including the ones nobody approved. Expense reports and sign-on logs surface what interviews miss.
Verify
Each vendor's terms of service, data-processing agreement, and sub-processor list, reviewed against five questions: Do they train on your data? Is zero-retention available? Where is data stored? Who are the sub-processors? What happens at termination?
Map
Where customer PII, financials, and proprietary files actually flow - which API boundaries they cross, where prompts and transcripts are retained, and which regulated data reaches a tool without the required agreement.
Consolidate
A keep, reconfigure, or retire decision for every tool, with overlapping subscriptions flagged and priced, so you can see what retiring them saves each year.
See the work before you buy it
Sample report
An abridged assessment for a fictional 42-person company - the executive summary, inventory excerpt, contract findings, and 30-day recommendations, exactly as a client receives them.
Download PDFSelf-audit template
A free four-step checklist and scoring sheet to run your own first-pass audit. The questions you cannot answer are the finding - bring them to us if you want them closed.
Download PDFAssessment scoping
Scoped to the vendors, data, decisions, and control evidence involved. Every engagement is a fixed fee, set in writing after a scoping call - never hourly, never a surprise. Scope reflects how the AI touches your business. How engagements are scoped.
Convenience AI
Fixed fee after scoping
Tools that draft, summarize, or transcribe but never touch a business decision or regulated data.
Typical tools: Marketing copy tools, meeting transcription, internal chatbots
Data-processing AI
Fixed fee after scoping
Tools that ingest, transform, or store customer PII, financials, or proprietary files.
Typical tools: Document processing, support chatbots on customer data, analytics copilots
Decision-making AI
Fixed fee after scoping
Tools whose output drives a consequential decision about a customer, employee, or borrower.
Typical tools: Screening, scoring, pricing, eligibility, or recommendation engines
Portfolio bundle
Fixed fee after scoping
The full-stack audit: every AI vendor in the business assessed together, with the rationalization and cost-takeout plan across the whole portfolio.
Quarterly re-review
Fixed fee after scoping
Vendors change their terms constantly. Ongoing monitoring re-verifies data-training and retention terms quarterly and flags new shadow AI as it appears.
Find out where your data is going.
A scoping call takes thirty minutes and fixes your fee in writing. The schedule is agreed from the vendors, evidence, and review depth in scope.
Request an assessment