SUPERWISE services
AI compliance readiness
For teams that need to find the gaps, organize evidence, and prepare for a formal assessment.
$12,500 gap assessment to $75,000 full readiness3 to 4 weeks gap assessment · 3 to 6 months full readiness
Outputs you keep
Prioritized gap assessment
Evidence index
Remediation roadmap
What you get
Working outputs, not a presentation about them
Know what is missing for a named AI framework or review, what to fix first, and which evidence supports each control.
Scope and applicability record
A record of the selected framework, business units, systems, use cases, boundaries, assumptions, and questions for your advisers. Keep the assessment focused and show reviewers what the conclusions do and do not cover.
Prioritized gap assessment
A requirement-by-requirement matrix of current practice, evidence found, gaps, risk, and readiness status. See the current baseline and decide which gaps must be addressed before a formal review.
Evidence index
A structured list connecting each in-scope requirement to policies, records, screenshots, approvals, reports, or other supporting material. Find and present evidence consistently without rebuilding the package for every request.
Remediation roadmap
An ordered plan with owners, actions, dependencies, target dates, and the evidence expected when each gap closes. Manage readiness work as an owned program and report progress to leadership.
Evidence request and exception log
A working tracker for missing material, reviewer questions, exceptions, decisions, and response status. Coordinate requests across teams and retain a record of how open questions were resolved.
Readiness reporting pack
An executive summary, gap status, remediation progress, unresolved decisions, and review-ready evidence overview. Run sponsor reviews and give an external reviewer a clear starting point.
Handover guide
Instructions for maintaining the evidence index, tracking remediation, recording changes, and preparing the next review. Keep the readiness program current after the engagement ends.
Outcomes
What will we have at the end?
The gaps are visible
Your team has one prioritized assessment showing which requirements are met, partly met, not met, or still need evidence.
Remediation has an order
Each gap has an owner, next action, dependency, and priority so the team can spend time on the work that changes readiness.
Evidence is ready to review
Policies, control records, decisions, and supporting material are indexed so reviewers can trace a requirement to the evidence provided.
Examples
What could this look like in our business?
These are examples of suitable work, not claims about past client engagements.
Example: an insurer must answer a state AI bulletin
Map the selected bulletin and the NAIC model behind it to current governance, controls, evidence, and remediation owners.
Example: a healthcare team is preparing a HIPAA risk analysis
Document where AI is used, keep protected health information out of systems not covered by a BAA, and organize evidence for the controls in scope.
Example: a law firm is reviewing generative AI duties
Assess the firm's policy, supervision, confidentiality, review, and client-communication practices against the questions raised by ABA Formal Opinion 512.
Example: a company is preparing for ISO/IEC 42001
Assess the agreed scope, identify missing management-system evidence, and create a remediation plan before an external certification review.
Example: leadership adopts the NIST AI Risk Management Framework
Map current practices and evidence to the framework, identify gaps, and turn them into owned work rather than treating the framework as a checklist.
Success measures
How do we know it worked?
We agree the measures at kickoff and use them in the final decision.
Measures agreed at kickoff
- Every in-scope requirement has a documented status and an evidence reference or recorded gap.
- Every prioritized gap has an owner and a defined next action.
- The client team can retrieve the indexed evidence for a sample of requirements during a review exercise.
- Open exceptions and missing evidence are visible in one tracker rather than held in email or individual notes.
- The sponsor can use the reporting pack to decide whether to remediate, narrow scope, or proceed to formal review.
Your team
What does our team need to give?
For a gap assessment, plan for about 8 to 14 hours across the client team in a typical week. Full readiness varies with the remediation the assessment identifies.
Executive sponsor
Confirms the target review, resolves priorities, and makes scope and readiness decisions.About 1 hour per week
Compliance coordinator
Coordinates evidence, meetings, owners, reviewer questions, and remediation status.About 4 to 6 hours per week during the gap assessment
Control and system owners
Explain how controls operate, provide evidence, answer gaps, and own agreed remediation.About 1 to 3 hours per owner when their controls are reviewed
Legal or framework adviser
Determines applicability and interprets legal, regulatory, contractual, or certification requirements.About 1 to 2 hours during scope and findings reviews
Duration
A build path your team can see
3 to 4 weeks gap assessment · 3 to 6 months full readiness
Weeks 1–2
Set the target framework, scope the systems, and collect current evidence.
Weeks 3–4
Assess gaps, prioritize remediation, and deliver the gap report.
Months 2–6
For full readiness, close gaps, assemble evidence, and prepare for review.
Data and security
Is our data safe?
How the engagement handles data
- The client controls the evidence source and access. We agree which documents and systems are needed before collection starts.
- We request the minimum access needed and use redacted or representative evidence when it can support the assessment.
- Credentials remain individual and client-managed; they are not placed in the evidence package or shared through general project documents.
- Sentinel records metadata, not prompt or response content, for supported AI activity. Its coverage limits must be reflected in any evidence claim.
- The SUPERWISE platform is not covered by a BAA, so protected health information must be kept out of it.
Ownership
What do we own when it is over?
You own the gap assessment, evidence index, remediation plan, reporting pack, handover guide, and the decisions your team records. If you stop working with us, the files remain yours and your control owners can continue remediation and maintain the evidence structure.
After the engagement
What happens after?
A gap assessment ends with a decision to remediate, narrow the review scope, or proceed. Full readiness continues through the agreed remediation window and handover. Teams that need continuing evidence coordination, control reporting, and operational support can scope managed AI operations separately.
Draft pricing for review
Know the range before the first call
We confirm a fixed scope and price after a scoping call.
| Tier | Price range | Duration | Included in a line |
|---|---|---|---|
| Gap assessment | $12,500 | 3 to 4 weeks | One target framework |
| Full readiness | $75,000 | 3 to 6 months | Prioritized gap assessment |
Not included
- External audit, certification-body, regulator, or assessor fees
- Certification, attestation, or a guarantee that a formal review will succeed
- Legal advice or a determination of which requirements apply
- Software and product subscriptions
- Remediation work outside the agreed full-readiness scope
- Additional frameworks, business units, or systems beyond the agreed scope
- Ongoing evidence operation after handover unless managed AI operations is separately contracted
Fit
Know whether this is the right starting point
Teams of 100 to 500 people preparing for a named framework or review
Good fit if
- For teams that need to find the gaps, organize evidence, and prepare for a formal assessment.
- Teams of 100 to 500 people preparing for a named framework or review
- You want a defined handover your team keeps.
Start somewhere else if
You need the policy, ownership, and control framework first.
Start with AI governance and controlsWho delivers and proof
Delivered by the SUPERWISE services team
We do not yet publish a case study for this exact compliance-readiness engagement. The nearest published example is Renova Health, where SUPERWISE supports managed AI operations; the services team also runs managed AI operations for Boca Raton Regional Hospital. Those examples show ongoing operational work, not a claim that either organization bought this compliance package.
Related published work
The nearest approved examples for this work.
AI compliance readiness questions
What to expect before you start
We help teams align their controls and evidence to a named target such as ISO/IEC 42001, the NIST AI Risk Management Framework, HIPAA, ABA Formal Opinion 512, or state insurance AI bulletins based on the NAIC model. Your advisers determine applicability. We do not provide legal advice or certify your organization.
Draft pricing for review runs from $12,500 for a gap assessment to $75,000 for full readiness. Evidence collection and remediation, several frameworks, reviewer coordination, and additional business units or systems increase the scope.
For a gap assessment, plan for about 8 to 14 hours across the client team in a typical week. Full readiness depends on the gaps found and the remediation your owners must complete.
No. We organize evidence, identify gaps, and help you prepare. The external auditor, assessor, certification body, or regulator makes its own decision.
We record the gap, its evidence and impact, the accountable owner, the next action, and the evidence needed to close it. The sponsor decides whether to remediate, accept the risk, change scope, or pause the review.
You do. The assessment, evidence index, roadmap, reporting pack, and handover material remain with your team if the engagement ends.
The service path
Where this fits
Learn about the decisions
Can one AI system comply with several regulatory regimes at once?
Organize overlapping obligations around one control system.
Which AI systems can have their logic audited, and which cannot?
Know what evidence different AI systems can expose.
Can you prove afterwards who did what with AI?
See what an activity record must prove after the fact.
Kits for this work
Score one workflow on evidence
Free practical kitCheck one workflow for recent evidence before a readiness review. Real governance or theater: a 10-point scorecard. Ten controls from NIST, ISO/IEC 42001, and the EU AI Act, each scored 0, 1, or 2 on records from the last 90 days. Includes a five-minute evidence test, three public cases where the written rule failed, and a fix list for every zero. Nine pages, PDF.
Products this service puts to work
Accelerate this engagement with Council
Use Council to build the review record and evidence alongside a governed system.
SUPERWISE Sentinel
Sentinel records which controls ran when staff use supported AI tools.
The SUPERWISE platform
The platform keeps policy and activity records available for review.
Talk to us
Tell us about AI compliance readiness
A few details help the services team route your request.