A1 · Advisory
Regulatory Exposure Snapshot
A two-week, fixed-price review that tells you which AI systems you actually have, which laws reach them today, and the five things to fix first.
Every AI law starts with the same question
Do you know where AI is used? EU AI Act deployer duties, Colorado SB 26-189, NYC Local Law 144, Illinois HB 3773 and Texas TRAIGA all assume an inventory exists. Most mid-market companies have none.
Shadow AI sits inside SaaS tools nobody registered. A department bought a screening tool; a vendor switched on an AI feature; a team wired up an assistant over customer data. None of it appears on a risk register, and no one can produce the list when the board asks for it.
The Snapshot is deliberately small. It is not a maturity assessment and it is not a remediation programme. It is the two weeks it takes to find out how exposed you are, at a price that clears a general counsel's discretionary budget without going through procurement.
What you get
-
AI system inventory — up to 12 systems
Built from a 45-minute intake call and a short self-report form sent to five function heads. Each system classified by decision criticality, jurisdiction exposure, vendor dependency and human-oversight status.
-
Exposure map — one page
Which laws touch which systems today (NYC LL144, California ADS, Illinois HB 3773, Texas TRAIGA, EU AI Act transparency duties) and which land in 2027 (Colorado SB 26-189, Connecticut SB 5, EU Annex III).
-
30-minute readout
With the GC or CRO, plus a ranked list of the five things to fix first. Written so it can go straight into a committee pack.
Scope
Fixed on both sides. Anything outside it is a separate engagement, quoted separately.
Included
- Up to 12 AI systems
- One operating entity
- One 45-minute intake call
- Self-report form for five function heads
- Follow-up calls with 2–3 function heads
- Jurisdiction mapping across the six covered regimes
- One-page exposure map
- 30-minute readout with a ranked fix list
Not included
- A board deck or board presentation
- Remediation work of any kind
- Policy or contract drafting
- Vendor negotiations
- Legal advice or a compliance opinion
- Systems beyond the twelfth
- Additional operating entities
- Technical model testing or bias auditing
How it runs
| Day 1 | Kickoff call. Intake questionnaire and self-report form go out to five function heads. |
|---|---|
| Days 2–5 | Forms returned. Follow-up calls with two or three function heads to close gaps. |
| Days 6–8 | Classification, jurisdiction mapping, draft exposure map. |
| Day 9 | Internal review against the Fiduciary AI Scorecard™ Pillar 1 rubric. |
| Day 10 | Readout, ranked fix list, and the written inventory handed over. |
Common questions
What if we have more than 12 AI systems?
Most companies that think they have five turn out to have twenty. The cap keeps the engagement fixed-price and two weeks long; we inventory the twelve with the most exposure and note the rest. If the full picture matters, the Fiduciary Readiness Assessment covers it without a cap.
Is this legal advice?
No. The exposure map says likely applies — review with counsel, never you are in violation. It is readiness evidence, not a compliance opinion. Bring your counsel in at the readout; several clients do.
How much of our time does it take?
A 45-minute intake call, a 15-minute form for five function heads, two or three half-hour follow-ups, and the 30-minute readout. Under four hours across the organisation.
Can it be credited against a larger engagement?
Yes. The full fee is credited against a Fiduciary Readiness Assessment if you commission one within 60 days. The Snapshot is week one of that engagement, run as a standalone.
Who needs to be involved?
A sponsor (usually the GC, CCO or CRO) and five function heads — typically IT, HR, operations, procurement, and the largest business unit. No engineering time required.
NEUBoard provides governance advisory services. Nothing in a Snapshot constitutes legal advice, a compliance certification, or an assurance opinion, and no attorney–client relationship is created. Jurisdiction analysis reflects law as at the engagement date and is intended for review with your counsel.
Find out what you're actually running
A 30-minute call is enough to scope it. If the Snapshot isn't the right starting point, we'll say so.