What do you need, and what do you control?
AI governance platforms are sold at four figures a month, and sovereignty is sold as a hosting region. Both decisions are usually made from a vendor’s own framing of the problem, because that is the only framing on the table.
The Strategic Assessment gives your board a framework-neutral decision document instead: what you are actually required to do, what you genuinely need tooling for, and where control of your technology stack — hosting, administrative access, key custody, exit — really sits. It is vendor-agnostic because we sell no software and take no referral fees.
In short. A board-ready decision document — multi-framework analysis, an architecture and control map, a 40-page report, a presentation and a staged roadmap, scoped to the decision in front of you.
Three routes on the table. One built.
- Multi-framework analysis across everything in scope
- An architecture and control map: hosting, administrative access, key custody, exit
- A report of 40+ pages, and a board-ready presentation
- A staged roadmap you can actually sequence work from
- Vendor-agnostic — we sell no software and take no referral fees
We have nothing to sell you afterwards.
Most assessments of what AI governance tooling you need are produced by somebody who sells AI governance tooling, or is paid by somebody who does. Most assessments of how sovereign your architecture is are produced by somebody who sells hosting. That is not dishonesty; it is just an incentive, and it reliably produces the conclusion that you need more of the thing being assessed.
We sell no software, no hosting and take no referral fees, so “you need less than you were told” is a conclusion this engagement is free to reach — and on a decision priced at four figures a month, that is where the value usually is.
What you get
Six deliverables, aimed at a board that has to make one decision and live with it.
Your position read against each framework in scope, with the overlaps separated from the genuine conflicts — the second of which is where the cost usually sits.
Where data, inference, model weights and keys sit, who administers the service, who can reach it — and which of those controls is evidenced rather than assumed.
The current design set against feasible alternatives: control gained, operating trade-offs, portability and exit constraints, and indicative effort and cost for each.
Forty pages and up: the analysis, the reasoning, and the recommendation stated plainly enough to disagree with.
The version that survives a board meeting — the decision, what it costs, and what happens if it is deferred.
Sequenced by what has to be true first, not by what is easiest to start — including the technical validation still needed before a step is safe to take.
Who it is for
A board that has to decide, and the technology, architecture, security and procurement leads who will carry the decision.
It is most useful when:
- A governance platform purchase is on the table and the only framing of the need is the vendor’s
- The board asks about vendor concentration, or a customer requires evidence of control
- A cloud renewal, a new AI deployment or a buyer’s sovereignty requirement forces the question of what you could move
- A team needs the practical cost of changing providers before it can recommend anything
How the engagement runs
Six weeks. You see a draft you can argue with before anything reaches a board.
- Before we startScoping and mandate
What decision is this assessment for, which board signs it off, and where the system boundary sits. We agree the frameworks in scope, the controls the decision turns on, and who can explain the current design.
- Weeks 1–2Discovery
Systems, vendors, contracts and the governance you already run, plus interviews across the functions that would carry whatever the board decides. Where control is in scope, we trace hosting, administrative access, key custody and service dependencies from the architecture documents, marking what is evidenced and what is not.
- Weeks 3–4Analysis and options
Your position read against each framework in scope, with the overlaps and the genuine conflicts separated. The current architecture set against feasible alternatives, with portability, exit constraints and indicative effort and cost recorded for each.
- Week 5Draft and challenge
A draft you can argue with before it is finished. An assessment that first appears in its final form at a board meeting is one nobody has stress-tested.
- Week 6Board presentation and roadmap
The report, the presentation, and a staged roadmap sequenced by what has to be true first, with the technical validation still outstanding named rather than assumed.
Sovereign Architecture Review
A hosting location alone does not describe control. Where control of the stack is part of the decision, the assessment goes to architecture level: where data, inference, model weights and keys sit, who administers the service, who holds the keys, and what you could move if a vendor, a buyer requirement or an operating constraint changed. It establishes what your architecture can already support and what the rest would cost, so a buyer’s demand can be answered with a plan rather than a rebuild.
- A model-dependency map: where inference, weights and keys sit, and who can reach them
- A hosting, administrative-access and key-custody review: EU-resident keys, and where a US administrative override still reaches EU data
- A dependency, portability and exit-constraint register for the agreed system or workload
- An abstraction-layer assessment — can you satisfy a buyer’s sovereignty demand without re-architecting?
- Options appraisal covering control, operating trade-offs and indicative effort and cost
- A staged decision roadmap, including the technical validation still needed
It keeps your options open — it does not pick your vendors for you, and it keeps what the law requires distinct from what a buyer merely prefers.
Scope boundaries
The assessment is based on supplied documentation and technical discussions. Findings distinguish evidenced controls from assumptions, and any further technical validation is separately scoped. It does not include:
- Penetration testing or a source-code audit
- Certification, or a legal opinion
- Migration delivery
European Procurement Readiness
Where European procurement is part of the decision, the assessment includes buyer evidence requirements, gaps that could delay market access, and the cost and sequence of addressing them. Contractual commitments are flagged for review with counsel. This work is included in the agreed assessment scope.
You can also commission European Procurement Readiness as a standalone project. Where work overlaps, we agree the combined scope and fee to account for it.
Fee agreed after scoping
Scoped against the decision, the frameworks in play and the system boundary, and fixed before the work starts. If you have had an Advisory Briefing, its £450 fee comes off in full.
Once the decision is made, keeping it current is a different job from making it — so the assessment transitions into a Drift Retainer for ongoing oversight, if and when the board wants that. It is not a condition of the engagement.
For a group, multi-jurisdiction exposure or a full board mandate, the bespoke engagement is available. Fee agreed after scoping — discuss an engagement.
Where it leads
An assessment settles one decision. Keeping the decision current, or scoping it in the first place, is a different job.
“What does this result mean for our AI system?”
If the question concerns one AI system, start with an hour interpreting its Compliance Checker result and setting priorities.
Read more“I do not know what we have actually got.”
If the board cannot yet say what it runs, a pass over the estate has to come before a decision about it.
Read more“It keeps moving and we keep reacting.”
Once the decision is made, keeping it current is a standing job rather than another one-off. The assessment transitions into one if the board wants that.
Read moreRequest a proposal
Tell us what decision the board is facing, which systems it touches, and roughly when it has to be made. We'll come back with a scope and a fixed price.
We sell no software and take no referral fees.
Initial response within 48 hours on business days.
Agreed against the decision before any work begins.
Further reading on this topic
All European Sovereignty coverage- Europe's Five Cards — and the Two It Will Actually Play: A Deployability Audit
A deployability audit of Europe's five response levers to US tech coercion. Regulation and procurement will scale; physical capacity, talent, and the ACI will
- The Same Money, Counted Three Times: AI's Circular Financing Loop Explained
Nvidia backing OpenAI's debt, $820bn off balance sheet, BIS warnings: the AI financing loop is disclosed in plain sight — and your pension is already inside it.
- CAIDA's Sovereignty Tiers: Legal Architecture or Hyperscaler Licence to Stay?
CAIDA's tiered cloud framework lets AWS, Azure, and Google qualify as sovereign providers.
- Europe's Open Source Gambit: The Sovereignty Play Nobody's Talking About
Europe can't out-build Silicon Valley. But it might out-open-source them.