AI Assurance and Independent Verification

What we do

We check AI systems against what they claim. That means verifying the model actually serving a request rather than the one named in the contract, re-running the evaluation that produced the headline number, tracing how a decision was reached six months after it was made, and testing whether the controls around the system hold when someone tries to get past them.

The output is a written assessment with the method attached, so your board, your auditor or your customer can follow the reasoning rather than trust the conclusion.

Why this is suddenly a procurement question

Under the DPDP Act the Board can levy penalties from 13 November 2026, and the EU AI Act is phasing obligations in over the same period. Both ask the same thing in different words: show that the system behaves as described, and show the evidence was produced as it ran rather than assembled afterwards.

Most organisations discover the gap at the point someone outside the company asks the question. By then the evidence either exists or it does not, and it cannot be backfilled honestly.

Where we are independent, and where we are not

If we built a system, we do not also certify it. That separation is the whole value of the assessment, and we would rather lose the engagement than blur it.

Every assessment ships with its method and its harness, so you can re-run it yourself, hand it to a different firm, or put it in front of an auditor without us in the room.

WHAT THIS RESTS ON

Method handed over

The harness ships with the report so the result can be re-run without us

Regulated delivery

GxP quality systems, HIPAA platforms and APRA CPS 230 assurance already shipped

Disclosure first

Findings go to the vendor privately before anything is published

How we engage

Team: A dedicated pod, billed monthly, with a three-month minimum.
Starting: Within one to two weeks of agreeing what gets built, what gets left out, how payments work, and the roadmap after launch.
Working hours: 7am to 8pm IST, with calls until 10pm IST. That covers the US Eastern morning.
Ownership: All code and IP are yours on payment.
Architecture only: We can design the architecture for a team you already have. Your team then owns delivery. We take responsibility for execution only when our own team builds it.

Questions we hear before engagements

Can you assess a system you did not build?

That is the normal case and the stronger one. We work from the running system, the evaluation harness and whatever documentation exists, and we say plainly where the evidence runs out.

What if the assessment finds something serious?

You hear it first and in private, with the reasoning and the measurement behind it. Nothing goes further until you have had the chance to see it and respond.

Is this a compliance certificate?

No. It is a technical assessment with evidence attached. It supports a compliance position, and it is often what a regulator or an acquirer actually asks to see, but we do not issue certificates for systems we engineered.