AI / THIRD-PARTY RISK
AI vendor onboarding
AI disclosure, processor terms and release gate

ABDULLAH AL OWASIThe finished work, not another software seat
Three executable client-style scenarios demonstrate bounded AI supplier reviews, control-evidence readiness, and cross-border incident triage. Each has real calculation logic, synthetic source records and an exportable decision memo.
Human-reviewed deliverables, scoped per engagement. No hourly retainer or guaranteed compliance result implied. Prices quoted after agreeing evidence and acceptance criteria.
Productized governance service
Agree the decision, in-scope systems, named owners and permissible evidence references.
Deterministic checks propose a risk band, evidence gaps and review queue; any AI assistance is subject to human validation.
Receive versioned findings, treatment actions and a decision memo. Approval or regulatory conclusions remain with authorized reviewers.
Interactive delivery proof · synthetic fixtures
Download the exact JSON shown below, inspect the decision and import that same file into either linked register. The separate typed workspace and Decision Lab formats are validated from one scenario envelope.
Synthetic evidence URLs are not fetched or independently verified. A 100% recorded readiness score is not an audit opinion or certification.
AI / THIRD-PARTY RISK
AI disclosure, processor terms and release gate
SOC 2 / ISO 27001
Recorded passing tests and evidence metadata
PRIVACY / INCIDENT
Transfer safeguards, owner actions and conditional reporting clock
Select a sample to calculate its recorded review outcome.
Choose a reviewed jurisdiction reference to inspect its official source and relevant domain links. This is a curated reference register, not a live compliance feed. A new rule or an applicability decision requires a human owner and published source verification.
Curated primary sources; legal applicability requires human review.
Automated source observations have not run yet; no source is presumed current.
Coverage is limited to the sources listed here. No 190-country coverage or unverified live update claim.
Primary legal references: EU AI Act Article 50 ↗ · EDPB breach notification ↗ · Sequoia’s outcome-based service thesis ↗.
Explore all 87 synthetic domain fixtures → · Operating documentation →