Three ways to engage. One standard of defensibility.
Built for the CCO, CRO, CAE, and General Counsel of regulated mid-market firms. Every engagement begins with the diagnostic, because you cannot govern what you have not inventoried, and you should not buy a program before you know what you need. Each rung stands alone; stop at any point with something your team uses regardless of what follows.
RUNG ONE · WHERE EVERY ENGAGEMENT STARTS
AI Exposure Diagnostic
2026 founding-client rate, fixed cost · 3 weeks · 10 hours of your team’s time · no pre-work
$18,500
What you walk away with
-
—
The validated AI use-case inventory: every known and discovered use case, the system it runs in, the data it touches, the decisions it influences, and a named owner.
-
—
A gap assessment against your existing policy and committee charter, with recommended language changes.
-
—
A go/no-go readiness determination for any platform AI features you are considering enabling.
-
—
A board-ready one-page summary, formatted for your next scheduled AI update.
-
—
A prioritized 90-day remediation list with named owners, useful whether or not we ever work together again.
How it runs
-
—
Week 1: Discovery. Six to eight structured interviews of 30 minutes each, reconciliation of your intake records, and a sweep of the application portfolio for embedded AI.
-
—
Week 2: Classification. Every use case mapped against your policy, classified by risk, with an owner proposed for each.
-
—
Week 3: Delivery. A working session with your team to walk through the findings, confirm owners, and hand over the artifacts.
A validated inventory of every place AI actually operates in your business, including the AI already embedded in your application platforms that no intake form ever captured, classified by decision impact and data sensitivity, with a named accountable owner proposed for each use case.
Not ready to commit? A two-hour Executive Briefing for your leadership team is $2,500, credited against the diagnostic if you proceed.
RUNG TWO · BUILD WHAT THE DIAGNOSTIC SURFACED
12-Week Governance Sprint
The diagnostic tells you where the gaps are. The sprint closes them, with working controls installed in your environment rather than kept on a binder on a shelf.
A governance and controls framework built to the NIST AI RMF and mapped to the laws and examiners that actually apply to you, not a generic framework with your logo on it.
First- and second-line roles settled before an incident tests them, with a standing report to your audit or risk committee in the language directors act on.
Incident and escalation ownership: a named owner for the moment a model fails, with stop authority established in advance.
Regulatory change management, so obligations are tracked as they move, before the deadline rather than after the finding.
Fixed fee, agreed before the sprint begins and scoped from the diagnostic findings. Delivered personally, alongside your team.
RUNG THREE · STANDING OWNERSHIP
Fractional Chief AI Officer
Some firms need more than a framework, they need ongoing accountability. If the diagnostic keeps surfacing the same root cause that no one owns the AI outcome end to end, the fix is standing ownership: one officer accountable for getting deployments shipped, ensuring ROI, and defending every decision under scrutiny. That is a seat, not a project. It reports to your CEO or business leader, and it is described in its own section.
WHICH ENGAGEMENT
Four situations. Four different answers.
You cannot name every place AI operates in your business, including the features your platforms have already switched on.
The AI Exposure Diagnostic. Three weeks, fixed fee. You cannot govern what you have not inventoried.
You know where the gaps are, you can define what must be built, and you want it delivered once.
The 12-Week Governance Sprint. Fixed fee, scoped from the diagnostic findings.
AI has to return value, you cannot yet define everything it will require, and the outcome needs one accountable owner.
The Fractional Chief AI Officer seat. Bring your CEO or BU leader to that conversation.
AI is not yet material to your business.
Nothing, yet. Subscribe to Judgment Call and revisit when it is.
WHAT I DELIBERATELY DO NOT SELL
No prompt libraries. No adoption workshops. No software.
Firms that want AI adoption help have many options available today. Firms that need resilient AI they can defend externally have very few. Blackbox Zero serves the second group only.
One independence note, because it matters in a governance practice: building your program and independently attesting to it cannot be done by the same firm. When I build your program, your audit needs to come from an independent provider. My deliverables are built to evidence standards that make that attestation cheaper and easier when needed.
Not sure which rung you are on?
That is what the first conversation is for. Thirty minutes, no charge, and a clear verbal read on which governance question your examiner or auditor will raise first.