AI Vendor Review Pack
The 25 AI questions enterprise security teams now add to vendor reviews, with an example answer for each.
Free resources
Free checklists and templates for security and AI reviews
Built by ISO 42001 and ISO 27001 Lead Auditors. Excel and PDF. Free, no sign-up.
Pick a kit
Each one comes as an Excel file and a PDF.
ISO 42001 Readiness Checklist
Every clause and Annex A area of ISO 42001 in plain words, the evidence an auditor expects, and the gap teams miss most.
AIUC-1 Readiness Checklist
The six areas of AIUC-1, the standard for AI agents, with what each one expects and the evidence to prepare.
EU AI Act Obligations Checker
Work out your role, classify each AI feature, and see which obligations apply and from when.
Enterprise Security Review Kit
The 50 questions buyers ask most in SIG Lite, CAIQ and their own sheets, with an example answer and the evidence to attach.
SOC 2 Reuse Map
Which SOC 2 evidence already covers ISO 27001 and ISO 42001, and the short list of what is actually new.
New Security Lead 30-Day Plan
A first-month plan for a new security lead.
Want one filled in for your company? Talk to us.
Latest insights
News and analysis on AI governance, security and compliance.
AI governance · Mar 17, 2026
The Agentic Shift: Bridging the "Verified Trust Gap" in 2026
On March 17, 2026, new data reveals a surge in AI adoption among mid-sized firms, while industry research highlights a dangerous gap in identity readiness for AI-driven interactions.
Read article →AI governance · Mar 16, 2026The Compliance Playbook is Here: EU Publishes AI Transparency Code for Generative AI
On March 16, 2026, the European Commission officially published the second draft of the Code of Practice for GenAI, establishing the visual, machine-readable, and audit requirements for the August 2, 2026, deadline.
Read article →AI governance · Mar 11, 2026The "Grok" Amendment and the 2026 AI Omnibus: A Mid-March Update
As of March 12, 2026, the EU AI Act has been updated with a "Grok-inspired" ban on sexual deepfakes, while industrial sectors gain much-needed regulatory relief.
Read article →Security alert · Mar 10, 2026Security Alert: Sophisticated "Coinbase Support" Phishing Scam Targeting Users
Read article →EU AI Act · Mar 6, 2026The Compliance Convergence: Navigating the EU AI Act Code of Practice and ISO 42001
A deep dive into the EU Commission's March 2026 Code of Practice update and how ISO 42001 is becoming the de facto evidence locker for AI governance.
Read article →AI governance · Mar 5, 2026Can Anonymity Survive the Age of Generative AI?
A deep dive into the ETH Zurich study revealing how LLMs can unmask anonymous users in seconds for pennies.
Read article →EU AI Act · Mar 4, 2026Bridging the Gap: Operationalizing the EU AI Act with ISO/IEC 42001
Read article →AI governance · Mar 3, 2026The AI Red Lines: Navigating High-Risk and Prohibited Use Cases
Read article →ISO 42001 · Feb 28, 2026The Roadmap to ISO 42001 Certification: From Gap Analysis to Audit
Read article →CMMC · Feb 27, 2026CMMC 2.0: The October 2026 Deadline for Defense Contractors
A survival guide for DoD contractors facing the mandatory CMMC certification deadline on October 31, 2026.
Read article →EU regulation · Feb 25, 2026EU Cyber Resilience Act (CRA): The 24-Hour Reporting Rule
Essential preparation for September 11, 2026, when mandatory vulnerability reporting takes effect for software and hardware makers.
Read article →EU regulation · Feb 24, 2026DORA: From Cybersecurity to Operational Resilience
Why the Digital Operational Resilience Act (DORA) is the top priority for EU financial institutions in 2026.
Read article →EU AI ActThe Replayability Test: Why ISO 42001 is the Only Answer to the EU AI Act’s Evidence Mandate
As the August 2, 2026, deadline approaches, organizations are shifting from "intent" to "evidence." Explore how ISO 42001 helps satisfy the new "Replayability Test."
Read article →SOC 2SOC 2 Type 2: The USA Standard for Operational Trust
Why SOC 2 Type 2 is the essential benchmark for corporate data security and how the observation period proves operational effectiveness.
Read article →Is a security review holding up a deal?
Book a free 20-minute call. Tell us what the buyer asked for and we will map the fastest path to a clean answer.