Discovery Sprint
One product or one department. We find what's running, map the data flows, and hand you the gaps. The fastest way to see whether the picture you have matches reality.
We design your AI system architecture right from the start — or step in to remediate and govern your existing deployments. Your systems become natively compliant and fully governed, allowing you to scale safely without costly retroactive restructuring.
Our blueprints bridge the gap between technical reality and rigorous standard compliance. We natively bake the requirements of the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001 directly into your technical architecture.
Compliance by design, value by definition.
It rarely arrives through a decision. A department signs up for a tool. A vendor switches on an assistant inside software you already licence. Someone builds a small automation that quietly becomes load-bearing.
None of that is reckless. It's how useful technology spreads. But it means the register your compliance function relies on describes a fraction of what's actually running — and nobody knows which fraction.
Start where the pressure is. Each engagement stands alone, and each one leads naturally to the next.
One product or one department. We find what's running, map the data flows, and hand you the gaps. The fastest way to see whether the picture you have matches reality.
Full discovery across eight channels, a reconciled inventory with named owners and data inputs, evidence-chain design, and findings mapped to the EU AI Act and ISO 42001.
Not what's wrong — how context should be structured and governed. Approved sources, what may feed which class of system, filtering boundaries, retention, and the operating model that holds it together.
Governance built into how work already happens — intake gates, procurement checks, approval paths. New AI systems land in the register on their own instead of being discovered a year later.
For a specific dated event: a certification attempt, a client security questionnaire, a supervisory review. Evidence pack, dry-run questioning, and rehearsal for the people who'll be in the room.
The role without the hire. We keep your register current, review new systems as they arrive, and stay reachable when something needs a judgement call.
AI literacy, acceptable use, approval paths and procurement questions — for the teams who use AI rather than build it. Often the whole engagement, not a warm-up.
You don't buy a framework. You buy an answer your regulator, your auditor and your board recognise.
Our discovery and assessment method follows the NIST AI Risk Management Framework — open, structured, and mature enough to be worth building on.
Findings arrive mapped to the articles and controls you already report against, so nothing needs translating before it reaches compliance.
Designing controls and then auditing them is a conflict. We get you ready; someone independent signs off. That line stays clear.
Contextuary is a two-person advisory. You work with us, not with a team you meet once at the kick-off.
Eight years building software in regulated environments — insurance, finance, enterprise. That background is why we know where AI quietly accumulates and what questions surface it. Now advising rather than building.
Seven years in enterprise presales at Oracle. Runs discovery conversations, stakeholder work and enablement — the part where governance stops being a document and starts being something people actually do.
What we're learning about AI inventory, data flows and evidence in regulated organisations.
A short call, or a discovery sprint on one department. Either tells you more than another framework will.