Independent assurance over what your AI actually does.

Nobody outside your organization can verify your own testing. That is the gap we close. We give regulators, buyers, insurers, and boards independent evidence that your AI does what you say it does.

Talk to us about your needs

For Regulators

Answer a regulatory inquiry, wherever you operate.

For Buyers

Clear a procurement or security review.

For Boards

Give directors a straight answer on the risk.

For Insurers

Support an underwriting decision with evidence.

You want to make a specific claim about your AI, we verify it.

Whatever specific claim you need to stand behind about an AI system, we independently verify it and document exactly what we found, in the conditions where the system actually runs.

A NYC bias audit you are required to publish

You are hiring in New York City or develop HR AI. We run the Local Law 144 bias audit and issue the independent results the law requires, either verifying your own testing or running the audit ourselves.

A claim you need to stand behind

Your documentation makes specific claims, or you want to say something no framework yet covers: be it your responsible data handling practices, the performance of your anonymization algorithm, or another. We turn the claim into clear criteria and independently confirm whether it holds.

An internal audit required for ISO 42001

We act as independent auditor for your internal audit requirement under ISO 42001. If you are not sure whether you are ready to start the certification process we also offer a structured gap analysis for you to know what is still missing.

Verifying the guardrails of a chatbot

A direct engagement to verify that a set of guardrails for an LLM-based chatbot work as promised.

How an engagement runs.

Every engagement is conducted under ISAE 3000, the same standard financial auditors work to. That is what ensures quality and independence and lets other people rely on the opinion.

1. Kick-Off

We align on goals, stakeholders, and the claim you need to support.

2. Scoping

We define the system boundary, criteria, and level of assurance.

3. Fieldwork

Adapts to the engagement type

We gather evidence and/or test the system in the conditions it runs in.

4. Quality review

An independent internal reviewer checks our work before we conclude.

5. Reporting

We issue a report about the engagement that you and your stakeholders can rely and act on.

Attestation engagement

We verify what you reported.

You have already tested your system against a normative framework. We independently verify those results; recalculating outputs, rerunning tests, inspecting datasets and code, and scrutinizing methodology.

Direct engagement

We measure, evaluate, and conclude.

We independently measure and evaluate the AI system itself. The more thorough path, typically chosen when you need to demonstrate genuine due diligence to an external audience.

Some questions we get.

Which regulations do you cover?

We work against the frameworks our clients are held to, including NYC Local Law 144, the NIST AI RMF, and the EU AI Act, among others. One thing we are careful to be honest about: for many regulations, no one can credibly claim that a test makes you “compliant.” Sometimes the standards do not exist yet, and sometimes compliance depends on much more than testing a system. The EU AI Act is the clearest example. What we can give you is independent, defensible evidence about specific requirements, and a clear account of where the limits are. Talk to us and we will walk through what an audit can be used for in your situation, and what it cannot.

What kinds of AI systems do you work with?

We work across systems that make or inform decisions about people, including hiring tools such as resume rankers and video interviewers, chatbots and large language model agents, computer vision systems, and credit models. Most of our work is on high-risk systems, because that is where independent, third-party testing is most often required or expected. If a system materially informs a consequential decision, it is likely in scope.

What are the different types of audit?

There are three. In an attestation, you have tested your system and we verify your results against existing criteria (e.g. our standard bias audit). In a direct engagement, we measure and evaluate the system against those criteria ourselves. And in assurance over assertions, for cases where no standard exists yet, the claims you want to make become the criteria we assure against. Any of the three can be scoped to reasonable assurance or to the lighter procedure of limited assurance, depending on what your context requires.

What if there is no standard for my kind of system or the claim I want to make?

That is what assurance over assertions is for. We define the specific claims you want to make as criteria, gather evidence, and conclude on whether they hold. You can make a credible, independently assured claim even where the field has not settled on a framework.

How long does an engagement usually take?

Most standard audits run five to eight weeks from kickoff to final report for a single system.

How often do you re-audit a system?

It depends on the system. Where it is stable, a single report can cover the period a regulation requires; under NYC Local Law 144, that is twelve months. When the system changes, its data shifts, or its risk moves, we reassess only what actually changed, scaled to the risk. The schedule follows the system’s risk rather than a fixed calendar, so what you pay for is assurance that still means something.

How do you stay independent?

Independence is structural, not a promise. We do not build, sell, or operate the systems we assess, and we have nothing to gain from the outcome. Our engagements are conducted under the independence requirements of ISAE 3000, and our advisory work is kept strictly separate from our assurance work, so the independence of an assurance opinion is never in question.

Not sure what exactly you need?

Tell us what you need to demonstrate, and to whom. We will tell you honestly whether independent assurance is the right next step, and what it would take.

Get in Touch