Shadow AI & AI Spend Discovery
A read-only look at which AI services are in use, what they cost, and what data reaches them.
About 1 week
FreeNo obligation
Security
Security & AI Readiness
Independent security reviews and fixed-price readiness assessments for ISO/IEC 42001 and the EU AI Act, grounded in how your AI and cloud infrastructure actually runs.
What we do
Secure your cloud, data and AI, and prove it
Cost tools don’t understand governance. Compliance platforms don’t look inside your infrastructure. AI security specialists rarely see the bill. We work across all three, because the risks overlap. Shadow AI is all three at once.
Every finding cites a specific artefact, such as a config key, log line or billing record, plus the control it relates to. Every report is signed by a named consultant. We prepare you for certification audits; we never issue certificates ourselves.
- ISO/IEC 42001
- EU AI Act
- ISO/IEC 27001
- SOC 2
- GDPR
Capabilities
- AI Security Review: prompt injection, agent permissions, RAG access, model supply chain
- Cloud Security Posture Review for AWS, Azure and Google Cloud
- DevSecOps & hardening: pipelines, secrets, IaC scanning, least-privilege IAM
- Compliance readiness: ISO/IEC 42001, ISO/IEC 27001, SOC 2, EU AI Act
- Shadow AI discovery and AI spend visibility
- Remediation roadmap ranked by risk and effort
How it works
Three steps, no surprises
Scope
Fixed scope and price, and you approve the exact read-only permissions.
Collect & analyse
A read-only collector runs in your environment; every finding needs cited evidence.
Sign & present
A named consultant triages, signs and walks your team through the report.
Engagements & pricing
Fixed scope. Fixed price.
Every engagement is scoped and priced before work begins. You buy a result, not hours.
AI Governance & Security Readiness Assessment Core
Our core engagement. Your AI and cloud estate assessed against ISO/IEC 42001, EU AI Act obligations mapped, cost findings attached.
2–4 weeks
From €8,000Fixed fee
Remediation & Hardening Programme
We implement the roadmap: DevSecOps pipeline, identity and access, secrets, cloud posture and AI guardrails.
Milestone-based
QuotedFixed fee per milestone
Prices in EUR, excluding applicable taxes. USD quotes on request. Never billed hourly.
Why now
The high-risk deadline moved. The work didn’t.
The 2026 AI Omnibus pushed the EU AI Act’s high-risk obligations back. It did not remove them, and much of the Act already applies. Organisations that start now reach the deadline with evidence rather than a plan.
- Prohibited AI practices
Bans on unacceptable-risk systems apply.
- General-purpose AI models
Obligations for GPAI model providers apply.
- Transparency obligations
Article 50 duties for AI interaction and generated content apply.
- High-risk systems (Annex III)
Stand-alone high-risk AI obligations apply, deferred from August 2026.
- High-risk AI in regulated products (Annex I)
Obligations for AI embedded in products under EU harmonisation law.
Summary as of September 2026, reflecting the AI Omnibus in force from 27 July 2026. Not legal advice — which obligations apply depends on your role and your systems.
Related services
Governance
AI Admin & Governance
Model management, access controls, audit trails and AI policies for AI at scale.
ExploreFinOpsFinOps & Cost Optimisation
Kubernetes, Databricks and multi-cloud cost optimisation with evidence behind every saving.
ExploreResilienceDisaster Recovery for Cloud & Databricks New
Custom multi-cloud recovery for your estate, including Databricks, with a tested failover.
ExploreNot sure where to start?
Tell us your situation. We’ll tell you exactly what you need, with no sales deck.