Three scores, kept separate
Maturity, Risk Exposure and Compliance Gap. They are never added together, because a legal duty is not a capability and mixing them lets good controls hide an unmet obligation.
AI Governance & Compliance
How much AI risk
have you taken on?
Most businesses adopted AI faster than they wrote any rules for it. We tell you exactly how much risk that created, where your controls fall short of it, and what to fix in the next ninety days — measured against every regulation that actually reaches you.
What We Do
An assessment that
gives you a number.
The Atolus AI Maturity Index scores how responsibly your business runs AI. Not an opinion, not a checklist — three independent scores, each traceable to a named clause in real law.
Only the rules that reach you
The assessment works out which regulations actually bind your business — from your jurisdiction, sector, data and what your AI does — and scores you against those. Most owners are surprised by the answer.
A costed 90-day plan
You finish the readout already holding a prioritized roadmap: what to fix first, who owns it, and roughly what it takes. Not a report that ends in a proposal.
What Happens
From first call
to a plan you can act on.
No long discovery phase, and nothing that needs a committee to approve.
- 01
A 30-minute call
Tell us what prompted this — a customer questionnaire, an insurance renewal, a near-miss, or just a nagging feeling. We tell you honestly whether you need us.
- 02
The AI sweep
A working session to find the AI tools actually in use across your business. It almost always surfaces something management did not know about, and you keep the list either way.
- 03
The assessment
Two to three weeks. A few hours of your time, plus short sessions with whoever owns the relevant areas. We do the rest.
- 04
The readout
Your three scores, every finding with the clause behind it, and a costed 30/60/90 plan — delivered in the room, not sent on later.
Who We Serve
Where the obligations
actually bite
Recruiting, Staffing & HR
AI in hiring sits in the highest-risk tier almost everywhere it is regulated — NYC Local Law 144, Illinois HB 3773, the EU AI Act. Your core product is the thing the rules are aimed at.
Professional & Legal Services
Confidentiality and privilege make staff use of public AI tools an immediate problem, and client contracts increasingly say so explicitly.
Health & Clinical Services
Sensitive data by default, high harm severity, and owners who already understand what a regulator looks like. HIPAA and state privacy law both reach AI use.
Financial Services & Insurance
Credit, underwriting and advice decisions made or assisted by AI carry specific duties — plus an existing compliance culture and a board that asks.
B2B Software & Tech Services
Your enterprise customers now send AI questions in every security review. The fastest-moving trigger there is, and the one with a deadline attached.
Manufacturers & Suppliers
Selling into large accounts means inheriting their compliance requirements. AI governance is turning up in supplier questionnaires alongside cyber.
Why Atolus
Measurement, not
a memo
3scores
maturity, risk exposure and compliance gap — never merged into one grade
96questions
across 44 sub-domains, every one traced to a named clause
2–3weeks
from kickoff to a costed 90-day plan
A number, not an opinion
Law firms deliver memos. Compliance platforms deliver checklists. We deliver a defensible score you can compare against last year and against your sector — with the arithmetic written down rather than left to judgement.
Built for your size
Enterprise AI governance programmes take a year and a department. Ours is scoped for a business of twenty to two hundred people, where one or two people can say yes and nobody has a compliance team.
We fix it, not just find it
An assessment that ends at findings leaves you stuck. Ours ends with a sequenced plan, and we can carry it out — write the policies, build the inventory, train the team, and re-score you afterwards.
Beyond The Assessment
Once you know where
you stand, we can fix it
Governance work usually turns up practical gaps. These are the engagements that close them — and the AI implementation work that follows once the guardrails exist.
AI Consulting
Strategic guidance to identify where AI creates the most value for your business — without the jargon.
- AI readiness assessment
- Custom roadmap & priorities
- ROI projections upfront
Custom Solutions
Purpose-built AI tools and automations designed around your specific workflows and systems.
- Process automation
- Custom integrations
- Built for your existing tools
Training & Workshops
Hands-on training that gets your team confident using AI tools — from day one.
- Team onboarding sessions
- Practical, role-specific training
- On-site or remote
Managed AI Services
Ongoing AI support and optimization so your tools keep working as your business evolves.
- Monthly monitoring
- Performance optimization
- Priority support
Start Here
Find out where
you actually stand.
A free 30-minute call. We will walk through which regulations reach your business, what an assessment would cover, and whether it is worth doing at all right now.
Book a free 30-minute call
Typically responds within 1 business day