For AI fintechs
Bank-Ready AI Due Diligence Dossier
An indexed evidence package for the bank's risk, security, and procurement review.
View scopeServices
AI governance consulting and AI risk assessment for teams that already run AI
Your people are already using ChatGPT-like workspaces, chatbots, and third-party AI plugins. We find every tool in use, assess the risk each one carries, and set up governance your team can actually run. Banks and credit unions, AI fintechs preparing for buyer review, and federal contractors documenting AI evidence. Every engagement is a fixed fee, set in writing after a scoping call.
AI Vendor Risk Assessment
An AI risk assessment starts with what is actually running. We catalog every tool, verify each vendor's data-training and retention terms, and show you where your data is going.
Convenience AI
Fixed fee after scoping per vendor
Tools that draft, summarize, or transcribe but never touch a business decision or regulated data.
Data-processing AI
Fixed fee after scoping per vendor
Tools that ingest, transform, or store customer PII, financials, or proprietary files.
Decision-making AI
Fixed fee after scoping per vendor
Tools whose output drives a consequential decision about a customer, employee, or borrower.
Portfolio bundle
Fixed fee after scoping for 5+ vendors
The full-stack audit: every AI vendor in the business assessed together, with the rationalization and cost-takeout plan across the whole portfolio.
Quarterly re-review
Fixed fee after scoping per quarter
Vendors change their terms constantly. Ongoing monitoring re-verifies data-training and retention terms quarterly and flags new shadow AI as it appears.
Every engagement is a fixed fee, set in writing after a scoping call - never hourly, never a surprise. Scope reflects how the AI touches your business.
What AI governance consulting covers
Governance sized to the business in front of us, not to a large bank's. Four pieces, in the order they happen.
AI use inventory
Every AI tool in use, who approved it, and who can see what. Shadow AI - tools staff use without approval - is where we start, because it is the part nobody currently owns.
AI risk assessment by use
Each tool is scoped by how it touches the business: convenience, data processing, or decisions about people. That is what sets how much review it needs, not what the vendor's site says.
Vendor terms review
Data-training rights, retention, subprocessors, and security posture, read before a contract is signed and checked again after. You get what the terms actually allow, in plain sentences.
Governance and evidence
A plain-language AI use policy staff will read, testing evidence, and owner or board reporting, built on NIST AI RMF and ISO/IEC 42001 so a customer, insurer, or examiner questionnaire can be answered from documents you already hold.
"How do we assess AI vendor risk?" is the question we hear most, and the honest answer is that a small team can run the first pass itself. Our free self-audit template walks you through it; download it here. When you want a second set of eyes, the same method becomes an engagement.
Prepare the evidence behind your AI
For federal IT and defense contractors
Federal Contractor AI Advisory
AI governance, evaluation evidence, and security documentation scoped to the solicitation or project.
View scopeAdvisory service lines
Governance consulting, implementation, and security work all start here. Scope varies with the organization, so these carry no list price. Each is a fixed fee set in writing after scoping. How advisory engagements are priced.
AI Implementation
Cijara Group helps small and mid-size businesses in highly regulated industries - credit unions above all - put AI to work without losing control of risk. We start from your workflows and your regulatory obligations, not from a vendor demo, and we stay through rollout so the tools actually get used.
Learn moreAI & Software Supply-Chain Security
Your core banking system, digital banking platform, and loan origination tools come from vendors - and all of it rests on open-source software you never see. Cijara Group maps that hidden layer, shows you which known flaws actually reach your environment, and researches the components you depend on for the flaws nobody has found yet.
Learn moreAI Governance & Model Risk
Cijara Group builds the governance layer regulators expect around AI and models - risk frameworks, inventories, testing evidence, and board reporting. Each engagement is led by a senior principal consultant matched to the work. We bring operator-grade discipline to organizations that cannot staff every specialty full-time.
Learn moreProof it works at scale
Our assessment method puts inventories, evidence, and accountable actions ahead of vendor assurances. The case study illustrates how application rationalization identifies redundant tools and informs a practical consolidation plan.
Not sure which service fits? Request a confidential consultation and a practice lead will recommend the right scope on a thirty-minute call.