Sample report
See the deliverable before you buy it.
This is a condensed version of a Readiness Assessment report, written end to end for a
fictional company so you can judge the work before paying for it. Every real engagement
produces this structure at full depth.
Fictional company. No client data appears on this page. Subject "Meridian Notes," a Series A clinical-documentation AI company
AI systems found 14 9 with no named owner
Overall maturity 1.3 of 4 across 38 controls
Priority findings 6 ordered by buyer impact
Domain maturity
Scored 0 to 4 across the nine ISO 42001 domains
Internal organization 2.2 Resources for AI systems 1.5 The six priority findings
F1 The core transcription model runs on a vendor with no executed DPA and no model-change notice clause. Third parties · severity high · blocks two open enterprise deals
F2 The patient-facing intake chatbot does not disclose that it is AI, in scope for EU AI Act Article 50. Transparency · severity high · already live in EU pilot
F3 No AI impact assessment exists for any system, including the two that touch clinical decisions. Impact assessment · severity high
F4 Nine of fourteen AI systems have no named owner; three were adopted by individual teams without review. Internal organization · severity medium
F5 The published AI policy describes practices the company does not follow, a worse position than no policy. AI policies · severity medium
F6 Security questionnaire responses claim ISO 42001 alignment no evidence supports. Use of AI systems · severity medium · contract risk
The ninety-day roadmap, condensed
Days 1 to 30 Stop the bleeding
Execute the missing DPA or replace the vendor. Add AI disclosure to the chatbot. Correct the questionnaire responses. Name an owner for every system.
Days 31 to 60 Build the spine
Impact assessments for the two clinical systems. Rewrite the AI policy to match practice. Stand up the vendor and model intake gate.
Days 61 to 90 Make it provable
Evidence folder mapped to the crosswalk, questionnaire answer library, first quarterly report to the board. Decide whether ISO 42001 certification is worth pursuing this year.
Your report would look like this, about your systems.
Fixed scope, fixed fee, quoted per statement of work before anything begins.
Request an assessment