From €95,000
Attack, sovereignty and leakage together.
Six to ten weeks.
TSI / Independent AI audits
Find out.
Before someone else does.
Find the security gaps. Test the vendor’s claims.
Get the findings, the repair priorities and a retest.
What do you need to know?
Vendor claim verification€30,000 · 3 weeks
Other 8 auditsFrom €45,000 · 4–6 weeks
9 audits
- 01Vendor claim verification
Is what they sold you true?
Make the purchase or renewal decision with evidence in your hands.
€30,000 · 3 weeks See scope - 02Sovereignty & egress
Where does your data really go?
Keep company and client information inside the boundary you approved.
See scope - 03Adversarial attack
What happens when someone tries to turn it against you?
Find exploitable behaviour before an attacker uses it.
See scope - 04AI stack security
What is holding the system together?
Close gaps in access, secrets, dependencies and deployment configuration.
See scope - 05Data leakage
What is coming out that should stay private?
Protect tenant separation, confidential outputs and retained information.
See scope - 06Privacy & purpose
Does the system do only what was authorised?
Turn privacy commitments into controls your team can inspect.
See scope - 07EU AI Act readiness
Can you show what your system is accountable for?
Give your compliance team a usable technical evidence and remediation pack.
See scope - 08Model capability
Does the model do your actual work?
Choose models by accepted results and operating cost on your tasks.
See scope - 09Evidence reconstruction
Could you explain what happened six months later?
Make consequential AI work traceable when someone challenges it.
See scope
Know what failed.
Know what to fix.
What you will receive
- A scoped evidence report
- Reproducible findings
- Prioritised remediation
- An executive readout
- One scoped retest
01The claim
“It runs privately.”
You were told the system is private.
02The test
- Trace the document from upload to retrieval, inference and logs.
- Check each external destination against the approved boundary.
03The evidence
The company’s approved boundary
- Client file
- Local model
- Retrieval tool
Outside the approved boundaryExternal file serviceA connector copies the document here.
A private model. An unapproved exit. The retrieval tool sends client documents to an external service.
04What you do next
- Reproducible findings with impact and priority
- A repair plan and one scoped retest
How it works
Scope it. Test it.
Fix what fails.
- 01
Agree the scope.
The named system. The questions. The permitted tests. A fixed fee before work begins.
- 02
Test the system.
Inspect the deployment and challenge the claims. Escalate critical findings as they are confirmed.
- 03
Leave with the evidence.
A prioritised report, an executive readout and one scoped retest of your repairs.
When one question isn’t enough
Assess the estate.
Keep checking as it changes.
From €180,000
The complete catalogue against a defined estate.
One quarter.
From €18,000 / month
Recurring review as models, code and dependencies change. Twelve-month minimum.
30 minutes · $500 · credited towards your audit
Existing catalogue fees, excluding VAT and travel. Final scope and dates agreed before engagement. A TSI seal requires a separate, completed assessment against its stated criteria.
Before
you begin.
Ask about your systemChoosing your audit
Are these only sovereignty audits?
No. The catalogue includes sovereignty and egress, adversarial attack, AI stack security, data leakage, privacy and purpose, vendor verification, AI Act readiness, model capability and evidence reconstruction.
Do you do penetration testing and bug hunting?
The adversarial-attack and security engagements test agreed attack paths and security boundaries. Penetration testing and bug hunting must have named targets, written authorisation and rules of engagement; they are not permission to attack third-party systems.
Which audit should we buy?
Start with the question you need answered. Data routes point to sovereignty and egress; exploitable behaviour to adversarial attack; stack controls to security. A defined multi-audit programme covers a broader estate.
What will we receive?
A scoped evidence report, reproducible findings, prioritised remediation, an executive readout and one scoped retest. Each audit page lists its exact deliverables.
What happens before the audit?
Complete a short system brief, then join a 30-minute preparation call for $500. We review your brief before the call. The $500 becomes a credit towards your audit if you engage TSI.
Scope and access
What does an audit cost?
The catalogue lists each audit’s fee and duration. Vendor verification is listed at EUR 30,000; most individual audits start at EUR 45,000. The final scope, dates, taxes and travel are agreed before engagement.
What access do you need?
Enough authorised access to test the agreed system and reconstruct the relevant behaviour. The engagement defines accounts, source material, environments, data handling and prohibited actions before testing begins.
Can you test a live production system?
Only within explicitly agreed rules and limits. Use a suitable test environment for disruptive scenarios. Business continuity and handling of sensitive data must be planned before any production testing.
Is AI Act readiness legal advice?
It is a technical readiness and evidence review for an agreed obligation set. Legal advice and statutory conformity assessment are separate services.
Evidence and follow-up
Does buying an audit guarantee a seal?
No. You buy an independent answer, including failures. A TSI seal requires a completed assessment against stated criteria and applies only to the assessed scope and validity period.
Does an audit guarantee that a system can never fail?
No. The evidence covers the tested scope, versions, conditions and time. Findings identify what was observed, what passed the defined tests and what could not be established.
Do you repair the problems too?
The audit supplies a remediation plan and a scoped retest. Implementation can be delivered by your team or a separately engaged partner, with independence maintained between building and assurance.
What if our system changes after the audit?
Changes to models, tools, sources, permissions or deployment can invalidate earlier evidence. Retest the affected scope or arrange continuous assurance for an evolving estate.
Find out. Before someone else does.
Name the system and the question.
We agree the scope and a fixed fee before work begins.