AIRA › AI Risk Assessment
AIRA Risk · NIST AI RMF · ISO/IEC 42001
AI risk assessment you can prove.
Fixed-fee AI risk assessments built on the NIST AI Risk Management Framework and cross-referenced to ISO/IEC 42001, the EU AI Act and U.S. state AI laws. Every deliverable is written to be handed to someone else: an underwriter, a customer's security team, an auditor or your board.
What is an AI risk assessment?
An AI risk assessment is a structured review of the AI systems your organization builds, buys or uses. We inventory each system, tier its risk, assess governance and controls against the NIST AI RMF, and give you a scorecard and a dated plan to close the gaps.
It answers the question your customers, insurers and board are starting to ask: can you prove your AI is under control? The trigger is usually a customer AI questionnaire, an insurance renewal or a board question. It's usually asked by CISOs, compliance and legal teams, and AI or SaaS vendors facing reviews.
Built on the NIST AI Risk Management Framework
Every AIRA risk assessment follows the four functions of the NIST AI RMF 1.0. Each finding carries its framework reference, so your auditors, customers and regulators can trace it.
| Function | What we assess | Cross-reference |
|---|---|---|
| Govern | Policies, accountability, culture and oversight across every AI system | ISO/IEC 42001 clauses 4–10 |
| Map | Inventory each system, its purpose, users and risk tier, and the laws that apply | EU AI Act risk tiers |
| Measure | Test accuracy, bias, security and drift, and keep the evidence | OWASP LLM Top 10, NIST SP 1270 |
| Manage | Owners, treatments, incident response and monitoring, ranked by risk | ISO/IEC 23894 |
Also cross-referenced to ISO/IEC 42005, NIST AI 600-1 (generative AI), and MITRE ATLAS.
Ready to attach to
- Cyber insurance renewal applications
- Customer AI and security questionnaires
- Board and audit committee packs
- ISO/IEC 42001 certification preparation
Start with the two-week AI Risk Snapshot
The fastest way to know where you stand, and to have something to show for it. $7,500, fixed.
- AI inventory workshop, including tools staff use without approval
- Risk tiering of up to 10 systems
- One-page executive scorecard mapped to NIST AI RMF
- Top 5 actions, with owners and dates
- A one-page AI governance summary you can attach to questionnaires
Fee credited in full toward Foundation or Standard if you sign within 90 days.
How a full Risk package runs
Typical engagement: 6–12 weeks. Workstreams run in parallel after scoping, so you see findings early.
- Weeks 1–2Scope
AI inventory, risk tiering and the laws that apply.
- Weeks 2–4Govern
Policies, roles, oversight and vendor management against NIST Govern and ISO 42001.
- Weeks 3–6Assess
Risk and impact assessment for each system in scope, including generative AI risks.
- Weeks 4–8Test
Red teaming and bias testing, in the Comprehensive package.
- Final 1–2 weeksReport
Executive scorecard, prioritized roadmap and leadership readout.
AI risk assessment cost
| Package | Time | Price | Best for |
|---|---|---|---|
| AI Risk Snapshot | 2 weeks | $7,500 | A fast baseline and a governance summary |
| AI Vendor Trust Pack | 3–4 weeks | $14,500 | AI and SaaS vendors answering enterprise security reviews |
| Foundation | 3–5 weeks | From $24,500 | Boards and executives who need a baseline and a plan |
| Standard | 6–8 weeks | From $49,500 | Customer, auditor or regulator questions about specific systems |
| Comprehensive | 8–12 weeks | From $94,500 | High-risk lending, hiring and customer-facing generative AI |
Add-ons: additional system assessment $12,500, generative AI red team $18,500, bias and performance testing $14,500 (each per system). We retest every Risk finding free within 90 days of the report. Prices in U.S. dollars as of November 2026.
Questions buyers ask
Will the Risk Snapshot satisfy our insurer or customer?
It gives you the documents they usually ask for: an AI inventory, risk ratings, a governance summary and a framework mapping. We can't promise any particular underwriter's or customer's decision.
Do we need this if the EU and Colorado deadlines were delayed?
Usually yes. Customers, insurers and partners ask for AI governance evidence through questionnaires and contracts now. EU transparency duties for chatbots and generative AI have applied since August 2, 2026, and Texas TRAIGA has applied since January 1, 2026. See the AI laws tracker.
Is this legal advice?
No. We map which obligations apply to each system and what evidence they call for. Your counsel decides how to interpret and act on them, and we work alongside them.
What do you need from us?
A sponsor, a list of the AI tools and models you know about, and access to the people who own them. For testing, we need read-only or sandbox access to the systems in scope. We find the AI you didn't list as part of the inventory.
Know where you stand in two weeks
Tell us who is asking you about AI. We'll reply within one business day to set up a 30-minute call.
AIRA assessments are not a certification and are not legal advice.