AI audits across the model, the system, and the management around it.

High-risk classification is determined by Annex III of the regulation. The main categories are: biometric identification, critical infrastructure, education, employment (hiring, monitoring, termination), access to essential services (credit scoring, insurance, public benefits), law enforcement, migration, and administration of justice. AI systems used as safety components in products covered by EU product safety law (medical devices, vehicles, machinery) are also high-risk. We classify your system formally as the first step of every engagement — and the classification itself is a piece of evidence regulators may ask for.

ISO/IEC 42001 audits your management system — the governance, policies, and processes around AI in your organisation. EU AI Act conformity assessment audits a specific high-risk AI system against the regulation's technical and documentation requirements (Articles 9–17). The two are complementary: a mature ISO 42001 management system makes EU AI Act conformity dramatically easier to evidence. We deliver both, separately or as an integrated engagement.

Yes — LLM and generative AI are now the majority of our AI audit engagements. Our red-team specialists test against the OWASP LLM Top 10 (2025 edition), MITRE ATLAS adversarial taxonomy, and protocol-specific failure modes for RAG systems, agentic workflows, and multi-modal models. We cover prompt injection (direct and indirect), jailbreaking, training-data extraction, tool-use boundary abuse, output handling vulnerabilities, and the agentic-loop and excessive-agency risks unique to AI agents.

For EU AI Act conformity work, the Annex IV technical documentation pack: system description, intended purpose, training data documentation, evaluation results, risk management documentation, post-market monitoring plan. For ISO 42001 work, your AI policy, Statement of Applicability, risk register, and process documentation. For technical red teaming, model access (API or weights), system prompts, and any deployment guardrails. We send a tailored checklist after the scoping call — most clients have 60–70% of what they need and we identify the gaps quickly.

Six to sixteen weeks end-to-end, depending on scope. A targeted LLM red-team engagement against a single deployed system can close in 4–6 weeks. A full ISO/IEC 42001 internal audit across an organisation typically runs 8–12 weeks. An EU AI Act conformity assessment for a single high-risk system, including remediation cycles, runs 10–16 weeks. We commit to a specific window in the engagement letter.

Pricing depends on three factors: the AI system's complexity (single model vs. multi-model pipeline vs. agentic system), the depth of audit required (focused dimension vs. full STARED), and the auditor-days needed across the relevant specialists. Fixed-price quote returned within 24 hours of scoping. SME-friendly engagement sizes start in the low-five-figures; full enterprise EU AI Act conformity assessments scale up from there. Contact us at hello@auditone.io for an indicative range.

No. Most high-risk AI systems (Annex III) follow the self-assessment route under Article 43, where the provider conducts the conformity assessment using internal procedures. Our role is to deliver the conformity assessment as an independent third party, producing documentation that satisfies the requirements without requiring a Notified Body's involvement. For the narrow set of high-risk products that do require Notified Body involvement (certain biometric ID systems), we work alongside accredited Notified Bodies — including partners in our certification body network — and produce the evidence base they need.

STARED is our five-dimension framework for AI audits: Security, Technical Assessment, Regulatory compliance, Ethics, and Data governance. It was built specifically because existing security or compliance frameworks don't cover what makes AI systems hard to audit — training data lineage, model behaviour under adversarial conditions, drift, agentic risk. The full methodology, scoring rubrics, and worked examples are available in the STARED litepaper.

Both functions are kept strictly separate. We do not write your policies, build your AI governance, or implement your controls — doing so would compromise the independence required for the audit itself. What we do offer is a pre-audit gap assessment (lighter, advisory) followed by the formal audit (independent, evidence-based). The gap assessment tells you what to fix; the audit verifies you've fixed it. Different scoping, different deliverables.