AI switched on inside tools nobody listed
Why it mattersCustomer data may be flowing to AI tools that aren’t in your contracts or privacy policy.
The fixList the tools, switch off or sign proper terms, and update your vendor list.
01
For startups building or using AI
AI audit. Know your AI is safe to sell.
I check every AI feature and tool in your startup against the AI laws in your markets. You get a plain-English report and a ranked fix-list, before a customer, investor or regulator asks.
The short version
- What it is
- A check of every AI feature and tool in your business, against the AI laws in your markets.
- Made for
- Startups building or using AI: chatbots, copilots, agents, AI decisions.
- You get
- A plain-English report, a ranked fix-list and a readout call.
- Takes
- Typically 3–6 weeks, for a fixed fee.
Is this for you?
If any of these
sound familiar, yes.
Two or more? Then this audit will likely pay for itself in the next deal.
- 01A big customer sent an AI questionnaire and nobody knows how to answer it.
- 02You are moving from an AI that suggests to an AI agent that takes actions.
- 03Your AI helps decide who gets a job, a loan, insurance, a home or treatment.
- 04You have users in Europe and don’t know if the EU AI Act applies.
- 05You train on customer data, or your AI vendor might be training on yours.
- 06Investors asked for your AI policy and you don’t have one.
What I check
Six things I check.
In plain English.
Open any one to see what I look at and what I’ll ask you for. You don’t need to prepare any of it in advance.
01Find all your AI
Most startups use more AI than they think. I list every model, AI tool and AI feature, and who owns each one.
What I look at
- Which features use AI, and which model powers them?
- Which of your tools (support, sales, HR, coding) quietly switched AI on?
- Who can change a prompt, model or agent in production?
- Which AI do customers see, and which is internal only?
What I’ll ask you for
- A product demo and a list of models and AI APIs
- Your list of software tools and vendors
- Where prompts and agent settings live
You get
An AI register: one list of all your AI, kept up to date.
02Work out which rules apply
Your legal duties depend on what your AI does and whether you built it or bought it. I work that out for each market you sell in.
What I look at
- Are you building AI, or using someone else’s?
- Does any feature fall into a banned or ‘high-risk’ category?
- Does rebranding or fine-tuning a model make you responsible for it?
- Do you need to tell users they are talking to AI, or label AI content?
What I’ll ask you for
- Product descriptions and marketing claims
- How your customers use the product
- What is on the roadmap for the next two releases
You get
A simple map: each AI feature, its risk level and the rules that follow.
03Check your data and vendors
I check what goes into your AI and what your AI vendors can do with it, so nothing comes back to bite you.
What I look at
- Do you have the right to use the data you train or fine-tune on?
- Can your AI vendor keep or train on your prompts and outputs?
- Is customer or personal data being sent to an AI model?
- Does your open-source model licence allow commercial use?
What I’ll ask you for
- Your AI vendor terms and settings
- Where your training and reference data comes from
- Who can access the data your AI uses
You get
A list of contract and setting changes to make with your vendors.
04Keep a human in control
Customers and regulators ask the same thing: can a person stop it, and do users know it is AI?
What I look at
- Can a person check or reverse an AI decision before it affects someone?
- Do AI agents need approval before they pay, email or change records?
- Can people find out why the AI decided something, and challenge it?
- Is AI-generated content labelled where it needs to be?
What I’ll ask you for
- Screens and in-product messages
- How issues get escalated today
- What your agents are allowed to do
You get
Clear recommendations for review, approval and disclosure points.
05Testing and when things go wrong
I look at how you tested your AI and what happens if it gives a harmful answer or leaks data.
What I look at
- What did you test before launch, and who signed it off?
- Have you checked for bias in decisions about people?
- How do you stop prompt injection and data leaks?
- Who gets called, and who must be told, when the AI causes harm?
What I’ll ask you for
- Any test results or red-team notes
- Complaints or incidents involving AI
- Security reviews of the AI parts
You get
A list of missing tests and a simple plan for AI incidents.
06Policies and contracts
Finally, I turn everything into policies your team follows and contract terms that hold up in sales.
What I look at
- Who in the company is responsible for AI risk?
- Is there a policy for how staff use AI tools?
- Do your customer contracts say who is liable for AI outputs?
- Has the team had basic AI training?
What I’ll ask you for
- Existing policies and training
- Customer contracts and order forms
- Recent customer AI questionnaires
You get
An AI policy, contract wording and a governance setup you can reuse.
How it works
About four weeks.
Very little of your time.
A typical timeline. Bigger products or more markets take longer. A deal deadline can make it faster.
- Day 1
Intro call
- You show me the product
- We agree what is in scope and your deadline
- You get a fixed price in writing
Your time: 30 minutes
- Week 1
I get to know your AI
- You share documents in one folder
- Short calls with product, engineering and sales
- I build the first AI register
Your time: 3–4 calls of 45 minutes
- Weeks 2–3
I do the analysis
- I check the laws for each market
- I review contracts, vendors and policies
- I send a few follow-up questions
Your time: A few quick answers
- Week 4
You get the answers
- Report and ranked fix-list
- A readout call with your founders
- Optional summary for investors or customers
Your time: One 90-minute call
- After
We fix it (optional)
- I draft policies, notices and contract terms
- I help on customer questionnaires
- A re-check at your next big release
Your time: As needed
Common problems
What I usually find.
And how we fix it.
Problems that come up in startup after startup, sorted by how urgent they are. Your list will depend on your product.
Your AI vendor can train on your data
Why it mattersThat can break the confidentiality promises you made to customers.
The fixMove to business or zero-retention terms and record the setting.
AI decides about people with no human check
Why it mattersSeveral laws require human review and a way to appeal for important decisions.
The fixAdd a review step, a notice and an appeal route.
Marketing says “unbiased” or “accurate” without proof
Why it mattersRegulators treat unproven AI claims as misleading advertising.
The fixMatch claims to your test results, or soften them.
Nobody owns AI incidents
Why it mattersWhen the AI gives a harmful answer, the team scrambles with no plan.
The fixAdd AI scenarios to your incident plan with named owners.
No staff AI policy or training
Why it mattersThe EU AI Act already expects basic AI training, and buyers ask about it.
The fixA one-page AI use policy and a short team session.
What you get
Six things
you keep using.
- Your AI registerOne list of all your AI: what it does, who owns it, its risk level.
- Which laws applyA short memo: which AI laws apply in your markets, why and from when.
- The reportWhat I found, in plain English, ranked by how much it matters.
- Your fix-listActions with owners and deadlines, ready to drop into Jira or Linear.
- Policies & playbooksAI policy, staff rules and an AI incident plan, recommended or drafted.
- Customer-ready summaryOptional: a short summary that answers enterprise AI questionnaires.
What to bring
Whatever you have.
Don’t have half of these? That’s normal, and often why you need the audit. Bring what exists.
- A product demo
- A list of the AI models and tools you use
- Any test results you already have
- Your customer contracts and policies, if you have them
Laws covered
You don’t need to know these.
That’s my job.
For the curious: the laws I check against most often, by market. I only cover the ones that apply to you. Each links to a plain summary in the law library.
European Union
Your risk level, banned uses, AI labelling and the high-risk timeline.
United Kingdom
Safeguards for automated decisions and what each regulator expects.
United States
Honest marketing, decisions about people and bias audits for hiring tools.
India (home ground)
Labelling AI content, platform duties and personal data in AI.
Asia-Pacific
High-impact AI duties, labelling and local representatives.
Standards
The language big customers use in their questionnaires.
FAQs
Straight answers.
No legalese.
Is this an official EU AI Act certification?
No. It is a legal review. It tells you whether certification applies to you and how to prepare. Official conformity checks are done by approved bodies.
We just use OpenAI, Anthropic or Google. Do we still need this?
Usually, yes. The law looks at how you use AI, not who built the model. Building a product on top of an API makes you responsible for that product.
Do you test the AI yourself?
I review the testing you have and spot the gaps. If you need technical or security testing, I bring in a specialist firm.
Can this help with ISO 42001?
Yes. The register, policies and review steps line up with ISO 42001. The certificate itself comes from an accredited certification body.
How much does it cost?
A fixed fee, agreed after the intro call. It depends on how many AI features and markets you have, and how much help you want with fixes.
We already have lawyers. Can you work with them?
Yes. I often take the AI and data work while your existing lawyers handle the rest.
The fine print
This is a legal review of your product and documents. It is not an official certification, a security test or a guarantee that your AI is safe. If you need technical testing, I bring in a specialist partner.