Assessment · available now
The AI Use Assessment registers every place AI acts for you: in your own teams, inside your providers and in the platforms behind them. It asks the same seven questions of each, and records what evidence can be produced and independently checked.
The question it answers
How it runs
01
A representative set of arrangements, agreed with the CRO or GC. Not the whole estate.
02
Where AI acts, what authority it holds, and who stands behind it. We start from your own inventory.
03
The consequence of each use, and the evidence obtainable at each boundary.
04
Legal questions go to counsel in writing. Counsel sees every draft first.
The evidence ladder
Each authority level has a default rung. The consequence of failure and the rights you hold can move it up or down.
| Authority delegated to the AI | Default evidence rung | What you hold |
|---|---|---|
| Productivity | Disclosure | A statement of where and how AI is used |
| Analytical | Attestation | A signed statement that stated controls operate |
| Decision | Event notification | Notice when defined thresholds are crossed |
| Transactional | Audit | A right to have the evidence examined |
| Agentic | Continuous evidence | A periodic, aggregate measure against appetite |
| Actuating | Deterministic control | A control at the point of action, with a signed record |
What you provide, and what you get
Through counsel, we need your current AI inventory and the agreement for each arrangement in scope. No customer data, no individual decisions, no system access and no provider involvement.
Triodian produces
Counsel produces
Who does what
| Party | Role | Where it stops |
|---|---|---|
| You | The CRO commissions the work. The GC instructs counsel and sets the brief. The board owns appetite. | Your AI, governance and safety teams own the gaps handed back to them. |
| Board risk adviser | Facilitates the appetite sessions and writes the board paper. Optional: we can work with yours. | Does not perform the assessment. |
| Counsel | Engaged before any finding is written. Owns every legal call and the privilege position. | Sees every draft first. |
| Triodian | Owns the method and the technical result. Builds the register, runs the assessment, operates the apps. | Gives no legal advice. Presents no product. |
| Independent checker | Checks the assessment for counsel: is it sound, and are its findings supported? | Engaged separately from Triodian. Builds nothing. |
We work with large law firms and board risk advisers in alliance with Triodian, or with yours.
Where it stops
Every legal determination is yours and your counsel's. Legal questions go to counsel in writing.
The measure is your supervisor's expectations and your board's appetite, not any product.
No customer data, no individual decisions, no system access, no access to a provider's model.
Where you hold no rights, that is recorded honestly. The work can stop at the findings.
After the finding
Whichever route you choose, the test is the same: can the evidence be produced, and can someone independent check it?
Evidence terms at the next contracting point. Counsel drafts them, with the technical schedule beside the clauses.
A provider may already have a control or record that closes its gap. The finding says what it must show.
An existing governance, security or board tool may cover a gap inside your own estate.
A boundary control and evidence design, as a separate engagement decided on the findings.
| Evidence rung | What it has to show | Triodian route, if chosen | Horizon |
|---|---|---|---|
| Disclosure | Where AI acts and what authority it holds | The AI use register, from this assessment | Available now |
| Attestation | That an output met a declared policy | Certifiable Conformance Pack | In build · 2027 |
| Event notification | That a set of decisions moved outside appetite | Aggregate Drift Service | In build · mid-2027 |
| Audit | What was checked, against which policy version | Compliance token and ledger | In build · 2027 |
| Continuous evidence | That the check still holds after the model changes | Harness-as-Assurance | In build |
| Deterministic control | That a forbidden action could not be taken | Bounded Command, then the hardware appliance | In build · then 2028 |
The app
Eight phases, each with a gate; anything produced before its gate is met is marked draft. One register entry per place AI acts, the seven questions, one obtainability test per evidence rung, legal questions routed to counsel, and an independent check before the findings are handed over.
Available now. The worked example uses a fictional insurer and its providers.
Get in touch
Whether AI sits inside a material provider, and whether a review, a renewal or a deadline is coming.
Book a 30-minute conversation →