A fixed-price AI risk assessment that tells you exactly where you stand.
In two to four weeks, we find how AI is being used across your organization, what data is exposed, and what to fix first. You get a written plan in plain language, not a pile of jargon.
Six areas, every time.
- AI inventory. Every AI tool, AI feature and browser extension in use, approved or not.
- Data exposure. What patient, client, employee and financial data goes into AI tools, and where it ends up.
- Vendors and contracts. Training-on-your-data terms, retention, sub-processors and Business Associate Agreements.
- Accounts and access. Company versus personal accounts, single sign-on, MFA and audit logging.
- Policy and people. Whether written rules exist, whether staff know them, and who owns AI decisions.
- AI application security. For chatbots and integrations: prompt injection and data leakage checks (OWASP LLM Top 10).
What you receive
- AI inventory spreadsheet you keep and maintain
- Risk-ranked findings with business impact in plain language
- 30 / 60 / 90-day action plan with owners
- Mapping to NIST AI RMF functions and ISO/IEC 42001 controls
- HIPAA-specific findings for healthcare organizations
- Draft AI acceptable-use policy outline
- 60-minute leadership readout
Four steps, no surprises.
Scoping call (free, 30 minutes)
We learn your size, systems and concerns, and send a fixed written quote.
Discovery (week 1–2)
Short interviews, a staff survey and read-only review of your admin consoles and key vendor terms.
Analysis (week 2–3)
We map findings to NIST AI RMF, ISO/IEC 42001 and HIPAA, and rank them by real-world risk.
Report and readout (week 3–4)
A plain-language report and a meeting with leadership to agree what happens next.
| Framework | What it means for you |
|---|---|
| NIST AI RMF | The U.S. government’s voluntary framework for managing AI risk, organized as Govern, Map, Measure and Manage. |
| ISO/IEC 42001 | The international standard for an AI management system. We use it to structure policies and controls, and can prepare you for certification if you want it later. |
| HIPAA | If protected health information touches an AI tool, the Security Rule applies. We fold AI into your required risk analysis. |
| OWASP Top 10 for LLM Apps | The most common security weaknesses in AI chatbots and integrations, used as our testing checklist. |
Frequently asked questions
How long does an AI Risk Assessment take?
Most assessments for small and mid-sized organizations take two to four weeks from kickoff to readout, depending on how quickly we can schedule interviews and get read-only access.
What does it cost?
Pricing is a flat $5,000 for a standard engagement. AI/LLM security testing is quoted separately if needed. You will have a written quote before any work starts.
Do you need access to patient records?
No. We look at which tools are used and how data flows, not at the records themselves. Where we need system access, it is read-only and agreed in advance.
What frameworks is the assessment aligned to?
The NIST AI Risk Management Framework (AI RMF 1.0), ISO/IEC 42001, the HIPAA Security Rule for healthcare clients, and the OWASP Top 10 for LLM Applications for AI apps and chatbots.
Who performs the assessment?
Edmond K. Sarpong (CISSP, CISM, CISA, CRISC, PMP, AIGP, AAISM) leads every assessment personally, from scoping call to leadership readout.
Do you assess banks and credit unions?
Yes. For financial institutions the assessment also covers AI inside vendor products (core, digital banking, fraud, contact center), third-party AI due diligence, and documentation your examiners and board can follow. The price is the same flat $5,000. AI governance for banks and credit unions.
What do we get at the end?
A written report with an AI inventory, a risk-ranked findings list, a 30/60/90-day action plan, a draft AI use policy outline, and a readout meeting with your leadership.
Not sure where AI is already being used in your business?
Start with a 30-minute call. We will ask a few plain questions, tell you what we would look at first, and give you a fixed price if an assessment makes sense.