Operational risk where AI meets regulation

Operational Risk Diagnostic

Fixed-scope gap map and qualification. Tiffany delivers directly. Not a free discovery call. I deliver this directly. One relationship, one accountable operator. Build and governance conversations come after, not before.

• Gap map across GDPR, EU AI Act, US privacy law, and operational risk
• Compliance exposure and integration constraints reviewed together
• Decision-ready scope for what to do next
• Delivered directly by Tiffany. One relationship, one accountable operator

Fixed scope, fixed fee. $10,000 floor. No exceptions. Budget objections flex scope, not price.

Not included: Full AI use register or board-ready governance pack; Governance operating model build or remediation implementation; Active penetration testing or red-team exercises.

AI Governance Build

Governance operating model, remediation, and implementation after the diagnostic. Operator-led with vetted security and engineering depth when scope requires it. Priced $65,000 to $95,000 based on systems and scope identified in the diagnostic.

• Governance operating model: policies, intake workflow, accountability matrix, human oversight
• Remediation roadmap with ownership and evidence requirements
• Independent technical architecture review memo when scope requires it (advisory, not penetration testing)
• Implementation support with vetted security and engineering advisors under one engagement

Compliance Design & Audit

Compliance is not a checkbox. It is architecture: data flows, access controls, logging, governance. Built in, not bolted on.

• GDPR and EU AI Act gap analysis and remediation
• HIPAA compliance design for healthcare AI
• ISO/IEC 42001 AI Management System implementation
• SOC 2 readiness and evidence preparation
• CCPA and US state privacy assessments

AI Architecture & Implementation

System design after the diagnostic, when scope is earned. I map what you are locked into, where the risk surface is, and what the right architecture looks like given those constraints.

• Agent and multi-agent system design (LangGraph, Vertex AI Agents)
• LLM selection, evaluation, and deployment strategy
• Vertex AI, Google Cloud, and hybrid deployment
• RAG pipeline and knowledge base architecture
• Technical risk assessment before build

Integration Architecture

Where systems connect is where projects fail. I evaluate your stack, identify integration risks, and design patterns that hold under production load and regulatory constraints.

• Tool stack auditing and vendor evaluation
• CMS, automation, and AI agent integration patterns
• API architecture and data flow design
• Workflow automation architecture (n8n)

Workflow & Operations Design

The technical and operational are the same problem. Architecture decisions inform workflow design. Compliance posture shapes tool selection. I do not separate them.

• Process documentation and workflow automation design
• Operational handoff and team enablement
• Marketing and technical systems integration
• 60/30/10 framework implementation