The deal is signed except for one section.
The AI questionnaire.

The AI Trust Package is $3,500 fixed. Readiness Engagements are fixed-fee too, but scoped on the call, because the honest answer depends on how many AI systems are in scope, which regimes reach you, and how much already exists in writing. Regulatory Watch runs $500–1,500/month and is free for 60 days with any engagement. Firm Partnerships are $2,000–5,000/month.

No hourly billing, no scope creep, and the number is agreed in writing before work starts. For reference, the alternatives run $20,000–$80,000 for an independent consultant and from $75,000 at a Big 4 firm.

No to both, and we won't imply otherwise. We are not a law firm, not an accredited certification body, not a registered auditor. We build the documentation; your counsel interprets it and an accredited body of your choosing certifies you. If what you need is a legal opinion, we'll say so on the call.

Partly true, widely misread. Under the Digital Omnibus, Annex III high-risk obligations moved to 2 December 2027 and Annex I embedded high-risk to 2 August 2028. But Article 50 transparency obligations, Article 49 registration and national market surveillance authority powers apply from 2 August 2026, and Article 5 prohibitions plus GPAI obligations have been in force since 2025.

If you run a chatbot or ship generative features, your date did not move. And procurement doesn't wait for regulators — the questionnaire arrives when the deal arrives.

Sometimes you should, and we sell them — from $199. But understand what you're buying. Certification guidance is blunt about this: pre-written templates filled in with your company name will not impress an experienced auditor, because the documentation has to reflect your actual systems and your specific risks.

Buy templates if you have the internal expertise and the weeks to adapt them. Book a call if a deal is blocked or an audit is booked.

Engagements are led by the founder, with specialists brought in per engagement across AI research, security, compliance and technical domains depending on scope. You're told who is working on your engagement before it begins. We don't staff a fixed bench and we don't pretend to.

Every engagement includes a revision round. On the toolkits there's a 7-day refund, no reason required. And when we get something wrong we correct it in public with the control IDs — the changelog above is what that looks like in practice.

Yes, and most of our work is cross-border. The EU AI Act applies extra-territorially: if your system is placed on the EU market or its output affects people in the EU, it reaches you regardless of where you're incorporated. Microsoft SSPA obligations follow the supplier relationship, not geography.