AI strategy, policy and governance for businesses that answer to somebody — a regulator, a carrier, a client, a prime. We find out what AI is already doing in your business, then put rules and an owner around it. We don’t sell AI tools.
Nobody held a meeting about it. It came in through people trying to do their jobs faster, which is the hardest kind of change to see.
A contract, a patient note, a client list, a drawing. To get a faster answer, from somebody capable who was trying to help. Nobody told them not to, because nobody had decided.
Your carrier, your client or your prime now asks what you do about AI. The honest answer today is a shrug, and a shrug is an answer with consequences.
Every vendor you have added an AI feature this year and wants to talk about it. None of them will tell you which ones your obligations actually allow.
You don’t need to become an AI expert. You need somebody in your corner who already is.
You have someone for the money, someone for the law, someone for the insurance. Then there’s the one that changes monthly.
Watches it, explains it, tells you before it becomes a problem.
Reads what you’re signing and says the uncomfortable thing.
Knows what you’re exposed to and what the policy actually covers.
The decisions still get made. Just by whoever happens to be typing.
Somebody in that seat: who knows your business, watches what’s changing, and tells you the truth about both the risk and the opportunity — in plain English, every month.
Everyone starts the same way, because nobody can advise you on a business they haven’t examined.
A paid, fixed-scope engagement. We map what AI is actually doing in your business right now — which tools your people use, what data goes into them, and where that could come back on you. You get the findings in plain English, in writing, with one recommended next step. It’s yours to keep whether or not we ever talk again. Fixed scope, quoted before you commit to anything.
AI changes monthly, so your rules have to keep up. We meet on a regular cadence, keep your policy current, review new tools before your team adopts them, and flag what’s coming — so the next questionnaire, client ask or renewal is a file you open, not a fire you fight.
We do not sell AI tools — no licences, no software, no commissions. Our only product is the advice, which is exactly why you can trust it.
Written down, in words they can follow, so the capable person trying to work faster isn’t the one carrying the risk.
When the carrier, the client or the prime asks, you hand over a document instead of improvising on a call.
AI used where it actually pays in your business, chosen deliberately — rather than whichever vendor got to your team first.
It’s a paid, fixed-scope engagement — not an hourly arrangement and not a free consultation dressed up as one. The scope and the figure are agreed before anything starts, so there’s no surprise at the end. What it costs depends on how many people you have and how much is already in motion, which is why we look before we quote.
Most are good at keeping systems running, which is a different job. This one asks what your obligations are, what your clients and carriers will accept, and what you’d have to defend — questions about your business rather than your network. Some IT firms do both. Ask yours what your AI policy says today.
No. No licences, no resale, no commissions, no vendor relationships that pay us. Our only product is the advice. That’s deliberate — the moment we earn money on a tool, our recommendation about that tool is worth less.
It depends on what goes into it and what agreements sit behind it. Client data in a public AI tool is a disclosure question, not a technology question — and the answer is genuinely different for a law firm, a surgery center and a machine shop. Sorting that out for your specific obligations is what the assessment does.
You can, and a template is better than nothing. The gap is usually that a template describes tools you don’t use and misses the ones your team actually opened last week. A policy that doesn’t match what’s happening in the building is a document, not a control.
We build and document the controls your obligations require and prepare the evidence your auditor, carrier or client asks for. We are not an auditor and we issue no certifications — there is no such thing as a “HIPAA certified” provider, SOC 2 attestations come from licensed CPA firms, and CMMC status comes from a C3PAO. Anyone telling you otherwise is selling something that doesn’t exist.
Tell us what’s going on and an advisor calls you back within one business day. We ask about your business before we say anything about ours. Nothing to sign, nothing installed.