Tier 2 · fixed-price engagement
Vendor AI assessment
The AI vendor you are about to sign, assessed against what they claim, before the contract rather than after the incident.
Who this is for
A buyer in procurement or security review holding a vendor's AI claims with no way to test them.
Fixed price
$2,500
- Duration
- 3 days
- Deposit
- Paid in full
- Other currencies
- €2,300 · £1,950 · S$3,400
- Catalog
- T2-04
Thirty minutes with the engineer who would run the work, before any paperwork.
The work, stage by stage
In order, with what happens at each stage and what it produces. The timings are the ones the catalog prices, not an estimate written for this page.
Read what they gave you
Day 1
The proposal, the security questionnaire response, the model documentation, the data processing agreement and the subprocessor list, read against each other. A contradiction between a sales deck and a DPA is common and is the fastest signal available.
Separate the claims from the evidence
Day 1
Each claim sorted into evidenced, available on request, or unevidenced. A named report is checked for who issues it, what period it covers, and whether you have been given the report or only the badge.
Test what can be tested
Day 2
Where a trial or sandbox exists, the claims about grounding, data handling and prompt safety are probed directly rather than taken from the questionnaire.
Write the questions to ask before signing
Day 3
A short list of specific questions, each paired with the answer that would satisfy it, so the follow-up call is not another round of marketing.
Everything that arrives, listed
The contents of the document, and the artifacts that come with it. If something here would not be useful to you, say so before we start and the scope changes.
- A claim-by-claim table: what the vendor states, what evidence exists for it, and what would close the gap
- The report check: who issues each named report, what period it covers, and whether the report itself was provided
- Findings from direct testing where access existed, with reproduction steps
- The pre-signature question list, each question paired with the answer that would satisfy it
- A recommendation with its reasoning written out, so you can disagree with the reasoning rather than only the verdict
What this covers, and who takes the rest
Stated up front, because scope is what derails an engagement in week two rather than at the proposal.
Inside this engagement
- The vendor's own documentation and questionnaire responses, read against one another
- Direct testing of the product where a trial or sandbox is available
- Data handling, subprocessors, and the AI-specific security claims
Handled separately
Named so you can plan and budget for it, whether we do it or somebody else does.
- Contract negotiation and legal review of the vendor's terms, which your counsel runs
- A security assessment of your own integration, once you have signed
Start with a call, not a proposal.
Thirty minutes, straight to the engineer who would run the work. We will tell you if a smaller engagement answers your question, or if nothing here does.
Typical reply within one business day · Engagements start at $2,500
Fixed price · 3 days