AIRAAI Risk Assessment

NIST AI RMF · ISO/IEC 42001 · EU AI Act

AI risk you can prove.

Fixed-fee AI risk assessments built on the NIST AI Risk Management Framework and cross-referenced to ISO/IEC 42001, the EU AI Act and U.S. state AI laws. You get one scorecard your board can read and a dated plan your team can run.

Start with a 2-week Snapshot See published pricing
Fixed fees, agreed up front Free retest within 90 days Independent of any AI vendor

Executive scorecard

Sample · fictional client
Overall maturity
2.6 / 5Peer median 2.7
Risk rating
ModerateScale: low to high
Open findings
232 critical · 14 systems
Govern
2.8
Map
2.9
Measure
2.2
Manage
2.4
At or above peers Below peers Peer median 12-month target

Peer medians in this sample are illustrative. Your scorecard uses your systems, your controls and your evidence.

Why now

Legal deadlines moved. Commercial pressure did not.

The EU and Colorado gave organizations more time in 2026. The customers, insurers and boards that fund and oversee you are asking for AI governance evidence today.

In effectAug 2, 2026

EU AI Act transparency duties (Art. 50) and general-purpose AI rules. Chatbot and generative AI disclosure applies now.

UpcomingJan 1, 2027

Colorado SB 26-189 replaces the Colorado AI Act, covering automated decisions in employment, housing, lending and insurance.

UpcomingDec 2, 2027

EU high-risk obligations for hiring, credit and education systems (Annex III), after the Digital Omnibus delay.

RuleStatusWhat it asks of you
Texas TRAIGAIn effect since Jan 1, 2026Disclosure and prohibited-use duties for Texas operations.
NYC Local Law 144In effectAnnual bias audits for automated hiring tools.
EU AI Act, Annex IAug 2, 2028High-risk duties for AI in regulated products such as medical devices and machinery.
ISO/IEC 42001VoluntaryIncreasingly a procurement checkbox. Certification body accreditation under ISO/IEC 42006 is rolling out.

Dates as of November 2026. We track changes monthly and confirm each date against the official text before it goes in your report. Regulatory mapping identifies obligations; it is not legal advice.

Customers

Procurement sends AI questionnaires and asks for ISO 42001 status before signing.

Insurers

Underwriters ask how AI decisions are controlled, tested and monitored.

Regulators

Fair lending, consumer protection and privacy rules already apply to AI decisions.

Boards

Directors are expected to show oversight of AI risk they can evidence.

Method

Built on the standards your auditors use

Every AIRA assessment follows the four functions of the NIST AI RMF 1.0. Each finding carries its framework reference, so your auditors, customers and regulators can trace it.

GOVERNGovern

Policies, accountability, culture and oversight across every AI system.

ISO 42001 cl. 4–10
MAPMap

Inventory each system, its purpose, users and risk tier, and the laws that apply.

EU AI Act tiers
MEASUREMeasure

Test accuracy, bias, security and drift, and keep the evidence.

OWASP LLM Top 10NIST SP 1270
MANAGEManage

Owners, treatments, incident response and monitoring, ranked by risk.

ISO/IEC 23894
Cross-referenced to ISO/IEC 42001ISO/IEC 42005NIST AI 600-1EU AI ActOWASP LLM Top 10MITRE ATLAS

How an engagement runs

Typical engagement: 6–12 weeks. Workstreams run in parallel after scoping, so you see findings early.

  1. Weeks 1–2Scope

    AI inventory, risk tiering and the laws that apply.

  2. Weeks 2–4Govern

    Policies, roles, oversight and vendor management against NIST Govern and ISO 42001.

  3. Weeks 3–6Assess

    Risk and impact assessment for each system in scope, including generative AI risks.

  4. Weeks 4–8Test

    Red teaming and bias testing, in the Comprehensive package.

  5. Final 1–2 weeksReport

    Executive scorecard, prioritized roadmap and leadership readout.

Pricing

Published prices. Fixed fees.

Most clients start with the Snapshot, then choose a package with the findings in hand. Prices are in U.S. dollars and assume a mid-size organization; we confirm scope in writing before you sign.

AI Risk Snapshot

$7,5002 weeks

The fastest way to know where you stand.

  • AI inventory workshop
  • Risk tiering of up to 10 systems
  • One-page executive scorecard
  • Top 5 actions

Fee credited in full toward Foundation or Standard if you sign within 60 days.

AI Vendor Trust Pack

$14,5003–4 weeks

For AI and SaaS vendors answering enterprise security reviews.

  • Governance review of one AI product
  • Answers for standard AI security questionnaires
  • Customer-ready AI governance summary
  • ISO 42001 gap list

Leads to ISO 42001 readiness or a generative AI red team.

Foundation

3–5 weeks · about 100 hours

From
$24,500
  • AI inventory and risk tiering (up to 15 systems)
  • Governance gap assessment
  • Executive scorecard
  • 12-month roadmap and leadership readout

Best for boards and executives who need a baseline and a plan.

Most chosen

Standard

6–8 weeks · about 220 hours

From
$49,500
  • Everything in Foundation
  • Risk and impact assessment for 2 systems
  • Generative AI risks (NIST AI 600-1)
  • Regulatory obligations map and risk register

Best for organizations facing customer, auditor or regulator questions about specific systems.

Comprehensive

8–12 weeks · about 400 hours

From
$94,500
  • Everything in Standard
  • Security testing and red teaming for 2 systems
  • Bias and performance testing for 2 systems
  • Evidence pack and 30-day check-in

Best for high-risk lending, hiring, healthcare and customer-facing generative AI.

Add-ons

Add-onUnitPrice
Additional system assessmentPer system$12,500
Generative AI red teamPer system$18,500
Bias and performance testingPer system$14,500
ISO/IEC 42001 readinessPer client$22,500
ISO/IEC 42001 internal auditPer audit$18,500
AI policy packPer client$8,500
Additional jurisdictionPer jurisdiction$6,500
Board AI risk briefingPer session$4,500

10% off per-system add-ons for 5 or more systems. Change orders are $275 per hour, approved in writing first.

Ongoing assurance

Essentials$3,500 / month
  • Quarterly review and scorecard refresh
  • Regulatory change alerts
  • 8 advisory hours a month
Advanced$7,500 / month
  • Everything in Essentials
  • Monthly monitoring and incident review
  • Annual reassessment of up to 3 systems
  • 20 advisory hours a month

Who we serve

Built for regulated and AI-first organizations

Banks and lenders

Credit models are high-risk in the EU, and Colorado's 2027 rules cover lending.

Start with: Standard

Insurers

Underwriting and claims models fall under state AI bulletins based on the NAIC model.

Start with: Standard

Healthcare

Clinical and administrative AI handles protected health information.

Start with: Standard or Comprehensive

Hiring and HR tech

NYC bias audits apply now, and hiring is high-risk under the EU AI Act.

Start with: Bias testing

AI and SaaS vendors

Enterprise customers ask for AI governance evidence and ISO 42001 status.

Start with: Vendor Trust Pack

Contact centers

AI agents talk to customers under disclosure, consent and recording rules.

Start with: Snapshot

Why AIRA

What you can hold us to

Fixed fees

Package prices are agreed up front. No hourly surprises.

Retest guarantee

We retest every finding free within 90 days of the report.

Standards-based

NIST AI RMF method, mapped to ISO/IEC 42001, the EU AI Act, OWASP and MITRE ATLAS.

Executive-ready

A one-page scorecard and a dated roadmap, not a 200-page binder.

Independent

We do not assess AI systems we built, sold or integrated, and we disclose any relationship.

Current

Our regulatory tracker reflects the 2026 EU and Colorado changes and is updated monthly.

AIRA assessments are not a certification and are not legal advice. ISO/IEC 42001 certificates are issued only by accredited certification bodies.

FAQ

Questions buyers ask us

What is an AI risk assessment?

A structured review of the AI systems your organization builds, buys or uses. We inventory each system, tier its risk, assess governance and controls against the NIST AI RMF, and give you a scorecard and a dated plan to close the gaps.

How much does an AI risk assessment cost?

The AI Risk Snapshot is $7,500 over two weeks. Full packages start at $24,500 (Foundation), $49,500 (Standard) and $94,500 (Comprehensive). Additional systems, red teaming and bias testing are priced per system.

Do we need this if the EU and Colorado deadlines were delayed?

Usually yes. Customers, insurers and partners ask for AI governance evidence through questionnaires and contracts now. EU transparency duties for chatbots and generative AI have applied since August 2, 2026, and Texas TRAIGA has applied since January 1, 2026.

Will we be ISO/IEC 42001 certified at the end?

No. Only accredited certification bodies issue ISO/IEC 42001 certificates. We prepare you for certification with a readiness assessment and internal audit, so the certification audit goes smoothly.

Is this legal advice?

No. We map which obligations apply to each system and what evidence they call for. Your counsel decides how to interpret and act on them, and we work alongside them.

What do you need from us?

A sponsor, a list of the AI tools and models you know about, and access to the people who own them. For testing, we need read-only or sandbox access to the systems in scope. We find the AI you didn't list as part of the inventory.

What happens after the report?

We retest every finding free within 90 days. Many clients then move to an Essentials or Advanced retainer for quarterly scorecard refreshes and regulatory change alerts.

Next steps

Start with a two-week Snapshot

Tell us about your AI use and the pressure you are under. We'll reply within one business day to set up a call.

  1. Discovery call30 minutes on your AI use, regulators and customer pressure.
  2. AI Risk Snapshot$7,500 over 2 weeks: inventory, risk tiers, scorecard and top 5 actions.
  3. Fixed-fee proposalA package and timeline built from the Snapshot findings, with the fee credited.

Request a discovery call

We use your details only to reply to this request.