A 3–4 week assessment that turns AI uncertainty into an inventory, a risk-tiered gap analysis, and a roadmap your board and examiners can follow.
Most organizations already use more AI than they can account for: copilots in productivity suites, AI features embedded in vendor platforms, internal experiments, and models in production decisioning. Governance usually lags behind.
This assessment establishes the baseline. It inventories AI use, classifies each use case by impact and autonomy, assesses controls across the NIST AI RMF functions, and maps the results to the programs you already run — model risk, third-party risk, data governance, and information security — so AI governance extends what exists instead of creating a parallel bureaucracy.
Kickoff, stakeholder map, document request, and confirmation of in-scope business units and obligations.
Structured interviews and system review to build the AI inventory; each use case is risk-tiered.
Evidence-based review of 26 controls across Govern, Map, Measure, and Manage, scored for maturity.
Gap prioritization by regulatory exposure and business impact; executive readout and handover.
No — that is the best time. The assessment produces the inventory and draft policies you need to start, sized to your actual use.
Typically 8–12 interviews of 45–60 minutes, plus document requests coordinated by a single point of contact.
No. It extends model risk, third-party risk, and data governance to cover AI-specific risk and shows where each program owns which control.