- Scoped engagement
- 6–8 weeks
- NIS2
- DORA
- EU AI Act
Full OSRA Engagement
All four OSRA phases run across the estate rather than a scoped sample, ending in a convergence risk summary and a remediation programme your teams can execute.
Why now
A scoped assessment tells you where the exposure is. Regulators increasingly want the working: which dependencies, which failure modes, which unverified trust signals, and the evidence trail behind each conclusion. That is a different artefact from a risk register, and it takes the whole estate rather than a sample.
What you get
- The Substrate Map: every dependency the AI systems rely on to function
- The Failure Surface Register: what failure looks like per dependency, and who would notice
- The Trust Surface Register: every signal the organization trusts without verifying
- The Convergence Risk Summary: where all three overlap, scored and dated
- A sequenced remediation programme with owners and dependencies
The Assessment applies OSRA to the systems that matter and stops there, because a fixed scope is what makes a fixed fee honest. This engagement does not stop there.
All four phases run across the estate. Phase 1 maps the substrate: every dependency each AI system relies on to function, through the model, compute, data, energy and contractual layers, including the ones no single team can see because ownership is split. Phase 2 runs failure scenarios against that map and asks, for each dependency, what failure looks like and who would notice. Phase 3 audits the trust surface, every signal the organization acts on without verifying. Phase 4 maps convergence, where substrate risk, undetected failure and unverified trust overlap into exposure that none of the three would reveal alone.
Convergence points are scored on the published six-factor model and sorted into remediation categories with their own clocks: 30 days for critical convergence, 90 days for a convergence point, six months to an exit strategy for concentration risk. Each one maps to actions from the 22-action catalogue, so what leadership receives is a sequenced programme with owners and dependencies rather than a list of concerns.
The methodology is public, so nothing in the output requires taking my word for it. Your auditors can trace every conclusion back to a documented method.
What it costs
Mid five figures
Fixed fee, set by the size of the estate and the number of systems in scope.