Know where your AI dependencies leave you exposed.
You can list the AI you bought. Can you explain which vendors you depend on, where your data goes and whether the evidence supports the claims?
The Exposure Diagnostic connects those questions into a clear picture of your AI estate, so you can see which dependencies could constrain the business and where to act first.
In short. A scoped review of your systems, vendor evidence and dependencies, with a written report and prioritised actions.
Trace the dependencies. Examine the evidence. Set priorities.
Who it’s for
For organisations already using AI that need a defensible picture of where they stand.
A board may be asking about risk, a customer may need evidence for procurement, or your team may be unsure how dependent it has become on a particular vendor. The Diagnostic helps when answering the question means looking across systems and suppliers.
It gives leadership, technology and procurement teams a shared basis for deciding what to address this quarter.
How it works
- Step 1
Agree the scope
Define the entities, systems and jurisdictions the review will cover. The scope and fee are agreed before work begins.
- Step 2
Examine the estate
Review your AI systems and vendor evidence, map the dependencies and assess where regulatory differences affect your operations.
- Step 3
Act on the findings
Receive a 15–25 page written report with an executive summary and prioritised actions. A 30-day follow-up call helps you work through what happened when you put them into practice.
What the review covers
- Systems and vendor evidence
- What AI you run, what your vendors can prove and where the evidence is missing — down to component level, as an AI Bill of Materials.
- Dependencies
- How your models, APIs and cloud services connect, where your data goes and which suppliers would be difficult to replace.
- European Procurement Readiness
- Where European sales or procurement are in scope, map buyer questionnaires to your evidence, identify gaps that could block a deal, and flag contractual commitments for review with counsel.
- Regulatory friction
- Where different jurisdictional requirements affect your operations and create constraints on the business.
The AI Bill of Materials
The register you keep afterwards. Where the estate warrants it, the systems review goes to component level and you receive a version-tracked inventory of what your AI is actually made of — the artefact that answers a regulator or a buyer, rather than a report that describes one.
- Each model, dataset, fine-tune, wrapper, API and library, version-tracked
- Provenance and licence status for every component, with the gaps your vendors cannot yet evidence
- A mapping to the Cyber Resilience Act’s SBOM duty and to AI Act Article 50 transparency
- A prioritised remediation list — what to fix first, and why
Part of the agreed diagnostic scope where relevant, not a separate purchase.
For a defined buyer review, European Procurement Readiness can also be commissioned directly. Where work overlaps with this diagnostic, we agree the combined scope and fee to account for it.
Pricing
Fee agreed after scoping
A fixed quote for the scope you agree.
The fee covers the review, report and follow-up call. You know the boundary and the price before committing, and can use the findings independently.
Further work is optional. Many clients go on to a Drift Retainer for ongoing oversight; there is no obligation to continue.
Request a diagnostic
Tell us what you run and what has prompted the review. We’ll come back with a proposed scope and a fixed price.
All enquiries are treated with strict confidentiality.
Initial response within 48 hours on business days.
Further reading on this topic
All AI Act & Compliance coverage- CAIDA's Sovereignty Tiers: Legal Architecture or Hyperscaler Licence to Stay?
CAIDA's tiered cloud framework lets AWS, Azure, and Google qualify as sovereign providers.
- Semiconductor Testing Bottleneck: Why the AI Accelerator Supply Chain Is Stalling at the Last Meter
The AI accelerator supply chain is constrained by test capacity, not fab output. Regional agencies have 18 months to position as semiconductor test hubs.
- Korean Memory Fab Capacity Squeeze 2027: A Forensic Assessment of DRAM and NAND Supply Constraints, Geopolitical Exposure, and Operational Response Strategies
South Korea's DRAM and NAND fabs face a structural capacity squeeze by 2027.
- EU AI Act: What 2 August 2026 Actually Requires (and What Moves to 2027–28)
2 August 2026 moves the transparency line and switches on the penalty regime; the heavy high-risk obligations move to December 2027 and August 2028.