Engagements · for US companies and the advisors who place them
Start narrow. Expand only where
the assessment says you must.
Three engagements, each with a defined scope and a fee agreed in advance. The first is
deliberately small — until it is done, nobody, including us, knows how much work you have.
EU AI Act Exposure Assessment
Fixed scope · 2–3 weeks
Where every engagement starts. Answers whether the Act applies to you, to which systems, at what tier, and where you fall short.
Deliverables
- Inventory of AI systems across products and features
- Role determination per system — provider, deployer, importer, distributor
- Territorial scope analysis
- Risk classification with written, defensible rationale
- Gap register against the obligations that attach to that classification
- Prioritised remediation roadmap with effort estimates
Remediation Retainer
Monthly · 3–6 months typical
Execution against the roadmap. Structured so your engineering and legal functions are working from one plan rather than two.
Deliverables
- Technical documentation to Annex IV structure
- Quality management system design and documentation
- Data governance procedures and records
- Human oversight design and escalation paths
- Incident and serious-malfunction reporting processes
- Conformity readiness — preparing the evidence base an assessment draws on
Evidence Infrastructure
With Latitude.so · implementation + ongoing
The technical layer that makes the rest provable. Implemented in your stack, not described in a deck.
Deliverables
- Evidence model design — what must be captured to satisfy Art. 12
- Traceability implementation for multi-turn agent systems
- Automated post-market monitoring aligned to Art. 72
- Continuous evaluation pipelines
- Handover and enablement for your engineering team
How we price
The Exposure Assessment is fixed-scope and fixed-fee, quoted after the scoping call
once we know how many systems are in play. Quoting earlier means padding for
uncertainty, and you would pay for the padding.
The retainer is monthly against an agreed scope. Evidence infrastructure is quoted per
implementation. Nothing starts without a written scope and an agreed fee.
The scoping call is free and is not a sales call. If the Act does not apply to you, we
will say so — that happens often enough that we would rather spend fifteen minutes
finding out than sell you an assessment you do not need.
For advisors and counsel
If you place clients into the European market.
What we do. We take US companies through EU AI Act applicability,
risk classification, gap closure, and the logging and monitoring the Act requires.
One jurisdiction, one regulation, done properly.
What we do not do. We are not a law firm and do not provide legal
advice or legal representation. We are not a notified body and do not perform
conformity assessment or issue CE marking. We prepare clients for those processes;
we do not substitute for them.
The handoff. A free 15-minute scoping call, then a fixed-scope
assessment. Both are bounded and low-risk for you to recommend — your client gets a
defined deliverable, not an open-ended engagement, and you are not exposed to a
runaway consulting bill made in your name.
Where we work alongside counsel. Frequently. The classification
rationale and gap register are built to be reviewed by a client's lawyers, and we
expect them to be.
Talk to us about referrals
Beyond the EU
Our focus is the EU AI Act. We advise on US state AI law — Colorado's SB 26-189, which
replaced the original Colorado AI Act and takes effect 1 January 2027; New York City
Local Law 144; Illinois' biometric and video-interview rules — and on Canadian
requirements including Québec's Law 25, where they intersect an EU engagement.
We do not present ourselves as a comprehensive multi-jurisdiction practice. If your
primary need is US-only or Canada-only, we will tell you honestly whether we are the
right firm.
Fifteen minutes to find out.