Products solve recurring problems. People solve the ones unique to you. Our engagements are delivered by the same people who architect the products, which is a different proposition from a consultant who has read the regulation.
Each is scoped, repeatable and produces an artefact you can hand to an auditor, a notified body or your own board.
Per AI system, establish whether you are provider, deployer, importer or distributor, classify risk, and produce an attested applicability determination with its basis recorded. The question every other obligation hangs from.
Assess your AI management system against ISO/IEC 42001 and the applicable AI Act duty elements. The gap report names, for each unmet duty, whose condition prevents it, so remediation has an owner rather than a colour.
Build the Annex IV technical documentation and the ISO/IEC 42001 Statement of Applicability, with every claim traced to its source evidence rather than to a paragraph someone wrote.
Contained adversarial testing of deployed AI systems with a reproducible evidence record, addressing the Article 15 robustness and cybersecurity duties, which apply from 2 December 2027. Prompt injection, tool poisoning, excessive agency and egress abuse, proven rather than asserted.
We map your real attack surface across applications, APIs, cloud and identity, then model it with STRIDE and, for AI systems, agentic frameworks. Findings ranked by exploitability and impact, not raw CVSS.
A standing relationship for teams without a full security function. We review designs, triage risk and keep your posture current as you ship, including as your AI footprint grows.
Indicative sizing so you can budget before a first call. Final scope is agreed in writing after discovery.
| Engagement | Typical size | Who buys it | What you get |
|---|---|---|---|
| AI Act applicability & role determination | 5–10 days | Legal / Compliance + CIO | Attested applicability determination per AI system |
| AI governance readiness assessment | 8–15 days | CISO / CIO | Gap report with each unmet duty attributed |
| Evidence & technical documentation build | 15–30 days | Product / Quality management | Annex IV documentation and Statement of Applicability |
| Adversarial testing & AI red-teaming | 10–20 days | CISO | Reproducible evidence record of what was tried and what worked |
| Security posture assessment | Scoped per environment | CTO / Head of Engineering | Ranked findings with a remediation plan |
| Continuous advisory | Retained, monthly | Founders / Heads of Platform | Standing design review and risk triage |
We translate dense standards into a backlog your engineers can actually work through.
The binding EU regulation and the certifiable AI management standard. Germany's market surveillance architecture went live under the KI-MIG on 29 July 2026 with the Bundesnetzagentur as central authority, so the question is no longer whether someone will ask. ISO 27001 holders get a large head start, and we map the rest.
The German NIS2 implementation act has been in force since 6 December 2025 and expanded the regulated population to around 29,500 entities, according to the BSI. Management must implement and oversee the risk measures, attend regular training, and is liable to the entity for culpable breaches. DORA has applied to financial entities since January 2025. We turn both into concrete technical and organisational measures.
The information security baselines most enterprise buyers require. We scope the controls, fix the gaps, and stand up the evidence trail so the audit is a formality, not a fire drill.
Data protection obligations turned into measures rather than another policy nobody reads, and a clear path through the latest payment requirements, with Cyron API Security available where API monitoring evidence helps your case.
A short discovery call to understand your systems, your AI footprint, your customers and the standard you are chasing.
We test, model and review, then hand you findings ranked by real risk, with every conclusion carrying how it was established.
We work alongside your team to fix issues and prepare the evidence, all the way to audit.
An assessment tells you which agents have unmonitored tool access and unbounded egress today. Cyron AI Security keeps protecting that traffic, and Cyron API Security does the same for your APIs. Cyron AI Compliance, in development, will keep the evidence current. We will tell you honestly which of the two you need.
A short discovery call, an honest scope, and a written proposal. No pipeline theatre.