Most organisations cannot prove their AI would stand up to an audit. We score every use case against ISO/IEC 42001, the EU AI Act and the NCSC Cyber Assessment Framework, and hand you the evidence pack that proves it.
Organisations come to us because somebody external has started asking whether their AI is defensible. The driver differs. The work behind the answer does not.
A governance question you have to answer this quarter
You have AI in production, or close to it, in more functions than anyone holds a single list of. The question is not whether it works. It is whether you could show a board, an auditor or an accreditor that the risk was assessed before it shipped, and by whom.
Which of our AI use cases would fail an audit, and how badly?
Clearing an AI supplier before a bid or a renewal
You are being asked to take on a supplier whose product has AI inside it, and the assurance questions you would normally ask do not map cleanly onto a model. What you need is a scored position you can put in front of a risk committee.
Can this supplier show its AI risk is mapped, rather than asserted?
NCSC Cyber Assessment Framework v4.0
NCSC’s CAF v4.0, released in August 2025, improves coverage of AI-related cyber risk. Where its indicators address AI directly, they sit in Principle B4, System security: operators using automated decision-making technologies are expected to restrict the actions those systems can take, and to understand and replicate their decisions.
Where does AI risk sit against the framework, in its own words?
The diagnostic answers the question before somebody else asks it.
Book a free scoping call →Most organisations cannot answer a simple question: which of our AI use cases would fail an audit, and how badly? We inventory the estate, classify every use case against the regulation that governs it, and hand back a scored risk register with the evidence to defend it to a board, a regulator or an accreditor.
AI Assurance Diagnostic
Fixed fee
Continuous Assurance
Monthly retainer
The diagnostic is a point in time. Your AI estate is not: models change, use cases multiply and the regulation moves underneath you. Continuous assurance keeps the register live, so the answer to “is this still defensible?” is never more than a month old.
What’s included
AI assurance at Velinor is led by the person who did this inside government. James A. Lang was appointed the MOD’s first AI Cybersecurity Product Manager, after more than twenty years in the Royal Signals culminating as a Warrant Officer Class 1. Ben Brand ran the MOD’s Vulnerability Management Support Team for over two years, after ten years in the Intelligence Corps.
2 December 2027
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and came into force on 27 July 2026. It moved the compliance date for standalone high-risk systems under Annex III from 2 August 2026 to 2 December 2027, and for AI embedded in products already covered by EU product-safety law under Annex I to 2 August 2028. Two things did not move. The prohibitions have applied since 2 February 2025, and the general-purpose AI model obligations since 2 August 2025. The extension is to the deadline, not to the obligation, and assembling the evidence takes longer than making the assessment. The Act does not apply to AI used exclusively for military, defence or national security purposes (Article 2(3)), though systems that also serve a civilian purpose stay in scope. For UK defence work, MOD policy on AI is set chiefly in JSP 936, Dependable AI in Defence.
Regulation (EU) 2026/1744, Official Journal of the European Union, 24 July 2026. Read at source 22 September 2026.
We price to your organisation, not from a rate card. Book a free scoping call and we will scope the engagement before you commit to anything.
| Engagement | Commercial model |
|---|---|
| AI Assurance Diagnostic | Fixed feeScoped to the size of your AI estate |
| Continuous Assurance | Monthly retainerMinimum 3 months |
Velinor is a member of the Anthropic Partner Network. We do not simply resell a licence: we own the assurance that sits around it. Claude goes into environments where a wrong answer is not an inconvenience: defence, government, nuclear and the regulated enterprise. It goes in assured.
We have delivered one AI governance diagnostic for a UK critical national infrastructure energy operator. References available on request.
Anthropic Partner Network member. We deploy on Claude and on client-controlled infrastructure, including AWS Bedrock, where sovereignty demands it.
Every deployment is mapped to the standards the client is held to: ISO/IEC 42001, the EU AI Act and the NCSC Cyber Assessment Framework.
A vetted bench of specialist consultants and forward deployed engineers, brought in against the problem, with clearance confirmed for each person at enquiry.
Deployment, support and embedded engineering, carried out under the governance the diagnostic just established rather than starting the argument again.
