AI and superintelligence audit
An AI and superintelligence audit is an independent review of where artificial intelligence and superintelligence already touch an organization's decisions, data, and obligations. We rank what could go wrong and what must change first. It ends with a written position a board can use, not a slide deck.
What an AI audit covers
An AI audit starts from use, not from a policy binder. We look for where artificial intelligence and superintelligence already shape a decision, a recommendation that is treated as a decision, or a record someone will later rely on. That includes systems the organization bought, systems a division turned on, and systems a vendor operates while the organization's name stays on the outcome.
For each use we ask four things. What decision is touched. What data the use depends on, and whose data it is. What obligation already applies, from a sector rule, a contract, a disclosure duty, or a duty to the people affected. Who can explain the use if a board, an auditor, a regulator, or a counterparty asks next month. If nobody can answer, that gap is a finding, not a footnote.
We also look for shadow use. Staff adopt tools because the approved path is slow. A pilot runs beside the business and then becomes the business without anyone renaming it. An audit that only reviews the inventory the technology group maintains will miss the uses that carry the real exposure. We read how work is actually done.
The audit is independent. We do not sell the system under review, and we do not take a fee from the company that does. The finding can be that a use should stop, that a contract should not be signed, or that a system is doing less than the fear around it. All three are useful. A review written to justify a purchase is not an audit.
AI readiness assessment
An AI readiness assessment, inside this audit, is a direct question. Is the organization ready to let a system take, or strongly shape, a named class of decisions. Ready means the owner is named, the data is fit for that use, the obligation is understood, the record exists, and someone can stop the use. It does not mean the organization has attended a briefing or bought a platform.
We do not publish a scored index, and we do not hand you a number that pretends to compare you with other organizations. Readiness is specific to the decision. An organization can be ready to draft and nowhere near ready to deny, price, hire, diagnose, or move a case. The assessment says which is which, and what would have to be true before the line moves.
The same review covers what is planned, not only what is live. A contract in negotiation is part of readiness. So is a board paper that asks for approval of a use the organization cannot yet explain. We would rather slow a signature than audit the damage afterward. Due diligence before you sign is part of the work: what the system would be allowed to decide, and what the contract leaves with you.
AI risk and governance audit
Risk, in this audit, is what can happen to the organization and to the people it affects if a use is wrong, unavailable, or unexplainable. We rank findings by that consequence, not by how new the tool feels. A dull system on a high-stakes decision outranks a fashionable system on a low-stakes one.
A governance audit asks whether oversight matches the uses. A policy that forbids what the business does every day is a finding. So is a committee that never sees the uses, a control that exists only in a slide, and an owner whose name is a department rather than a person who can act. AI governance consulting can follow. The audit does not pretend the policy is the practice.
We do not certify the organization, and we do not offer a penetration test, a model-leaderboard evaluation, or a legal opinion dressed up as one. Where a use needs a specialist test, the audit says so and stops at the edge of our work. The written position is still useful: it tells you which use needs that test, and why.
What you receive
You receive a written audit. It sets out how decisions are made today, which systems already make or shape them, the data and obligations those uses touch, and the rules and exposures that apply. It ranks what could go wrong. It says what to change first, and what can wait. It notes the questions a board, an audit committee, or a regulator is likely to ask, and whether you can answer them now.
The document is meant to be handed to someone who was not in the interviews. It is not a transcript, and it is not a catalog of every tool in the building. If a use does not touch a decision, data of consequence, or an obligation, it does not earn a chapter. Length is not the point. A ranked list and a first set of changes is the point.
What you do not receive is a promise that the risks are gone, that a regulator will be satisfied, or that the organization is now compliant. No honest audit can say that from a review. We say what we saw, what it means, and what should change first.
If the review is the whole job
When the written position is the whole scope, the work ends there. A later design, if you commission one, has to follow what the review found, not a preference for a tool. We will not stretch a finished review into extra phases. What a later design and the retained counsel each produce is set out on the engagement page.
Some organizations need the audit and then stop, because the right move is to halt a use or to decline a contract. That is a complete engagement if the scope says so. We will not pad the work into a design you do not need. Scope is agreed in writing after a briefing. Request a briefing with the decision or the contract in front of you.
The audit sits inside AI consulting. If the findings are mostly about oversight, the next reading is AI governance consulting. If they are mostly about systems that already match or exceed human expertise across many tasks, read superintelligence consulting.
Questions about the review
What does an AI audit cover?
It covers where artificial intelligence and superintelligence already touch decisions, data, and obligations, including uses a vendor runs in your name and uses staff adopted outside the official inventory. It ranks the risks and says what to change first.
What is an AI readiness assessment?
It is the part of the audit that asks whether you are ready to let a system take or strongly shape a named class of decisions. Ready means an owner, fit data, a known obligation, a record, and a way to stop. It is not a published score.
Is this a certification?
No. We do not certify an organization, a model, or a control framework. The deliverable is a written position on what we found and what should change first. A certificate would overstate what a review can know.
Can you audit a contract before we sign it?
Yes. Reviewing what a proposed system would be allowed to decide, and what the contract leaves with you, is part of the audit. The outcome can be to sign, to change the terms, or to walk away.
How is this different from a security test?
A security test asks whether a system can be broken into. This audit asks what the system is allowed to decide, whose data it uses, and who answers if it is wrong. Where a technical test is needed, we say so. We do not pretend this review is that test.
Who is the audit for?
Private, public, government, and non-profit organizations in the United States. It is written for the people who remain accountable: owners, executives, boards, and the counsel who has to answer for the use.
What happens after the audit?
You can stop there. If you want the findings turned into a design, that is the architect step, followed by advise. Both are scoped in writing. Neither is automatic, and neither is a software installation.
Other services
Bring the decision or the contract
Tell us what is already in use, or what you are about to sign. We read the request before any time is offered.
Request a briefing