Independent assurance for the AI you already shipped.
A fixed-scope, fixed-price audit of one LLM feature in production. We adversarially test it, check how it behaves when nobody is watching, and review what you would hand an enterprise buyer or a regulator who asks. You get severity-rated findings with reproducible evidence, a remediation plan, and a re-test once you have fixed things.
Free scoping call. Written scope and a fixed quote within 24 hours.
Why Companies Call Us
Almost nobody books an audit because of a risk lecture. They book one because something upstream of them started asking questions.
- 01
An enterprise prospect's security questionnaire has grown an AI section, and you are guessing at the answers.
- 02
You have EU users, and the AI Act transparency duties under Article 50 have applied since August 2026.
- 03
Your product has a chat surface that reaches people who are struggling, or minors. California SB 243 has been in force since January 2026, with New York, Utah and Illinois behind it, and Oregon and Washington from January 2027.
- 04
You are raising or selling, and diligence now includes the model, not just the code.
- 05
Something happened. A prompt injection, a data leak, an agent that took an action nobody authorised. Or a near miss that you only noticed by luck.
- 06
Your insurer or your professional indemnity renewal has started asking what you do about AI.
What We Test
Five layers, in order, on one live feature
LLM and agent security
Can someone make it do something it was never meant to do?
Direct and indirect prompt injection, including through retrieved documents, uploaded files and tool output. System prompt leakage. Sensitive data disclosure, including other tenants. Excessive agency — tool calls a user should not be able to trigger, irreversible actions with no human in the loop. Unsafe handling of model output. Retrieval and embedding weaknesses. Token and cost exhaustion. Model, prompt and tool supply chain.
Rated against the OWASP Top 10 for LLM Applications and the 2026 agentic list, using their identifiers so the questionnaire on the other side recognises them.
Behavioural quality and evaluation
How do you know it still works after you change the prompt — or the provider changes the model under you?
Whether you have an eval set, and whether it reflects the traffic you actually get. Whether it runs in CI or by hand when someone remembers. Whether your LLM-as-judge has ever been checked against human judgement, or is trusted on faith. Grounding and hallucination on retrieval answers. Refusal and over-refusal balance. Consistency across model versions. How prompt changes are versioned and reviewed.
Reported as an eval coverage map, a judge agreement table, and a taxonomy of the failures we found.
User harm and psychological safety
What does the conversation do to the person having it?
Crisis detection and response tested with keyword-free scenarios. Sycophancy and reinforcement of emotional dependence. False professional claims. Age handling where minors can reach the product. Escalation and human handoff. Refusal quality — does it help, or just decline. Tone under distress. Manipulation and dark patterns. Whether the system tracks risk across a conversation, or resets its judgement every message.
Mandatory depth for companion, coaching, wellbeing, education, recruitment and support products. This is the layer we are known for.
Governance and documentation
When the questionnaire, the regulator or the investor asks — what do you hand them?
Model inventory and provider terms. Data protection, including a DPIA where one is needed, training data use, retention and sub-processors. Article 50 transparency and synthetic content labelling. A risk register with a named owner. Incident logging and response. A defined notion of human oversight. Acceptable use and abuse handling. Sector overlays where they apply.
You get a gap table — have, partial, missing — and an outline of an assurance pack you can reuse the next twenty times someone asks. We map ISO/IEC 42001 gaps; we are not a certification body.
Production monitoring and change control
If it breaks next Tuesday, will you find out from your logs or from a customer?
What is logged — prompts, outputs, tool calls, judge scores — and for how long. Alerting on severe failures. Drift detection for the day a provider quietly updates a model. Canary and rollback for prompt changes. Cost and latency guardrails. Whether anything from your support queue ever makes it back into your eval set.
Reported as a monitoring map and a recommended minimum telemetry set.
Every finding is rated Critical, High, Medium, Low or Informational on likelihood against impact — where impact explicitly includes harm to a user, not only data exposure and cost. Everything Critical or High comes with a case you can reproduce and a fix you can action.
The Layer Almost Nobody Runs
Psychological safety of conversational AI
Most assurance work stops at whether a model can be tricked. That is a real question, and we answer it. It is not the question that keeps founders of consumer-facing AI awake.
Layer 3 asks what the conversation does to the person on the other end — and it is the part of this work we go deepest on, because it is the part we came from.
The rubric was designed by a psychologist, not adapted from a content filter. The scenarios are keyword-free, so a product that passes by pattern-matching on the word "suicide" fails here. Every automated score we report comes with the figure that matters underneath it: how closely it agrees with human raters. We build the tooling ourselves, and for clients who cannot send conversation data anywhere, we run the judge on your infrastructure instead of ours.
Where statutory language applies to you, the report maps to it directly — California SB 243, Utah HB 452, New York Article 47, Illinois — alongside the MHRA's position on when a chatbot stops being a wellbeing product and becomes a medical device. We show you where the gaps are. We do not tell you that you are compliant; nobody honest can.
Who It's For
Product and B2B SaaS companies with an LLM feature in production — a chatbot, a copilot, an agent, retrieval-backed search, automated decisions or recommendations.
Usually five to a hundred and fifty people, with a founder or CTO who personally owns the feature. Usually selling to enterprises, or into health, finance, legal, recruitment, education or the public sector — which means someone upstream will eventually ask them to prove they did something about it.
If your product has a chat surface a member of the public can reach, Layer 3 is not optional in your audit. That applies to companion, coaching, wellbeing and education products, to recruitment tools, and to support bots that meet customers on their worst day.
Three things we check before quoting
- It is live. Real users, real traffic. We test what exists, not what is on the roadmap.
- Someone owns it and can give us access to prompts, logs and a test environment.
- You intend to fix what we find. A re-test is included because the point is the fix. We do not write shelfware.
What It Costs
Published, so you can decide before you talk to us
AI Risk Snapshot
£1,200–1,500
One full day
A day on one feature: a structured pass across all five layers, live adversarial probing against the paths most likely to hurt you, and a four to six page memo — your top five risks, what each one would cost you, and what to fix first. The fastest way to find out whether you need the full audit.
AI Assurance Audit
£4,000–8,000
Three to five days
All five layers on one LLM feature. Severity-rated findings with reproducible evidence, a remediation plan ordered by effort against impact, a readout call, a mapping from every finding to the standard or statute your buyer will cite, and one re-test included.
Extended: £8,000–15,000 over six to twelve days for multi-agent, tool-using or multi-model systems, or more than one feature.
Psychological Safety Deep Dive
£6,000–12,000
Four to eight days
Layer 3 at full depth. A risk taxonomy built for your product, a judge validated against human raters with the agreement figures reported, a gate you can run in CI, and protocol documentation written in the language the applicable statutes use.
Assurance Retainer
£1,000–1,500
Per month, around four hours
Judge-drift review, a regression run each time a model changes underneath you, incident review when something goes wrong, and a one-page note your board can actually read.
Re-test
£800–1,500
A full day
Verify that remediation worked and reissue the report. Included once with the Assurance Audit; available on its own afterwards.
Every engagement is fixed-scope and fixed-price. You get the scope in writing and the quote within 24 hours of the scoping call, and the number does not move afterwards unless you ask us to test something new. Prices exclude VAT.
How It Works
Scope, quote, test, report, fix, re-test
We scope it. A free call. Your features, your users, the sectors you sell into, what triggered this, and what access we would need. You get a written scope and a fixed quote within 24 hours — not a proposal document, a scope and a number.
We agree the rules. Test environment or production with agreed limits. Data handling terms, an NDA, and a named contact on each side who can answer a question the same day.
We test. Layers one through five, in order, over three to five days. Manual adversarial work alongside automated suites. If we find something Critical you hear about it that afternoon, not in the report three days later.
We report. One page your board can read without a translator. Then findings by severity, each with the transcript or payload that produced it, a remediation plan ordered by effort against impact, and a mapping from every finding to the standard or statute someone will eventually cite at you.
We talk it through. Sixty minutes with whoever owns the feature, walking the findings and the fixes. A fifteen-minute version for the board if you need one.
We re-test. Within sixty days, included in the audit. We verify the fixes and reissue the report with a statement of what we tested and what we found. That statement is a record, not a certificate — we are not a certification body, and anyone who offers you an AI certificate today is selling you one they invented.
What We Don't Do
Independence is the product. It only works if the boundaries are real.
Infrastructure and network security testing
A different discipline with its own certification regime. We will introduce you to a CREST-registered firm, and we are happy to work alongside one.
Legal advice
We map which obligations appear to apply to you and where your gaps are. A solicitor tells you what that means. We describe; we do not advise.
Medical device classification
If your product is near that line, you need a regulatory consultant. We will say so, refer you, and supply our evidence into your safety case.
ISO/IEC 42001 certification
We do the gap analysis. An accredited certification body does the certification. Those have to be different people, and that is the point.
Building it or fixing it for you
Remediation belongs to your engineers. If you want help, that is a separate engagement under a separate agreement — never bundled into the audit that found the problem.
We use our own tooling as an instrument during an audit, and the report says so every time. No finding ever resolves to "buy our product" — every remediation path includes options that are not ours.
No equity, no success fees, no resale of your data. Conversation data is encrypted at rest on our infrastructure and deleted thirty days after the final report unless you ask us to keep it. If it cannot leave your estate at all, we run locally instead.
Based in Liverpool
Our office is at Central Tech in Liverpool, and the North West is our home turf. We work with a lot of Manchester companies too — it is a 35-minute train ride from Manchester Piccadilly to Liverpool Lime Street, which is close enough that scoping happens in a room rather than over a call.
We work across the UK — currently with clients in Cheshire and Edinburgh as well as either side of the M62. Psychological safety engagements we run from anywhere; that part of the work has never needed a postcode.
In September 2025 the UK government published its roadmap for a trusted third-party AI assurance profession — the CREST model, applied to AI. It counted 84 specialised assurance firms in the entire country.
We are one of the very few of them in the North West.
Someone is going to ask what you did
about your AI feature.
Better it is us, on a Tuesday, than a customer's security team in the middle of a deal.
Free scoping call. Written scope and a fixed quote within 24 hours. No deck, no demo.