What would we answer if an inspection arrived tomorrow morning ?
The cabinet examines the GDPR, the AI Act if your teams use artificial intelligence, and the obligations specific to your sector, together rather than separately. The report distinguishes what is in place, what is written but not kept, and what is missing, with the evidence you will be able to produce.
- Price2 500 € excluding VAT, fixed price
- Lead time15 working days
- Who it is forhealth, banking, insurance, law firms, accountancy firms
3regimes
Examined together, never separatelyThe GDPR, the AI Act and your sector obligation sometimes contradict one another. Treating them separately produces three answers that do not hold together in front of an inspector.
Your sector carries obligations, you have documents written at some point, and nobody can say whether those documents still match the tools actually in service. The cabinet examines the three regimes together: the GDPR, the AI Act if your teams use artificial intelligence, and the rules specific to your sector. It confronts your processing register with your real tools rather than with a declaration made three years ago, and checks your vendor contracts against article 28 one vendor at a time. After fifteen working days you receive a report that separates what is in place, what is written but not kept, and what is missing, each gap tied to the text that imposes it and to the evidence you still have to produce.
Evidence you can produce, not a list of good intentions.
- Your processing register confronted with the reality of your tools, not with what was declared three years ago.
- The classification of your uses of artificial intelligence by risk level, if your teams use any.
- The state of your processing agreements against article 28, vendor by vendor.
- The gaps ranked, each with the text that imposes it and the evidence still to be built.
- A session with your executive team and the signed report, usable as it stands in an inspection.
Scoping
Sector, applicable obligations, perimeter of entities and processing activities.
Examination
Existing documents confronted with the tools actually in service.
Drafting
Every gap tied to its text and to the evidence that is missing.
Delivery
A session with your executive team and, if you wish, with your legal counsel.
The limits, in writing.
An engagement that does not state its limits lets the client discover them at the worst possible moment.
- This is not legal advice: the cabinet is an engineering practice, not a law firm. It states what the condition of your systems demonstrates, your counsel states the law.
- This is not a compliance programme: the diagnostic establishes the facts. Closing the gaps is a separate, costed piece of work.
- This is not a certification audit: it awards no label and commits no certification body.
An inspection is prepared, never improvised.
The report is your property and stays usable without the cabinet. If you continue, keeping the register current over time belongs to a governance contract.
A first conversation of 30 minutes
No obligation, no access to your systems. We look at whether the step you are considering is the right tool for your situation, and the cabinet says no when it is not.
A signed scoping letter
The perimeter, the read-only access, the people, the delivery date and the firm price. Nothing starts before your signature.
The report, then the decision
A dated report that holds up in front of a third party, a session with your executive team, and the list of gaps ranked. You then decide what follows, or you stop there.
6 questions, 6 answers.
The cabinet's answers, in plain terms. If your question is not here, ask it: the answer comes back to you in writing.
How much does the compliance diagnostic cost, and how long does it take?
2 500 € excluding VAT, fixed price, delivered in 15 working days. You receive your processing register confronted with the tools actually in service, the classification of your uses of artificial intelligence by risk level if your teams use any, the state of your processing agreements against article 28 of the GDPR, and the gaps ranked with the text that imposes each one.
Is this legal advice?
No. The cabinet is an engineering practice: it states what the condition of your systems demonstrates, with dated evidence. Your counsel states the law. The two work well together, and the report is written so that a lawyer can use it as it stands.
Does it make us compliant?
No, and that is said before you order. The diagnostic establishes the facts and names each gap with the evidence that is missing. Closing those gaps is separate work, costed on the published grid, and keeping the register current over time belongs to a governance contract.
Does it cover the AI Act even though we do not use artificial intelligence?
The AI Act section is examined only if your teams actually use such tools, and the survey often finds accounts opened on personal subscriptions that nobody declared. Where there is no use, the report says so and the section is dropped: the cabinet does not invoice a chapter about a risk you do not carry.
Will this report be accepted by a client security questionnaire?
It is written for that purpose: every statement is tied to dated evidence, the perimeter is named, and the gaps are ranked with the measure that closes each one. It is not a label and commits no certification body. What it gives you is a file that holds up in front of a client, an insurer or an inspector instead of a declarative answer.
Can the three diagnostics be ordered together?
Yes, and that is the full audit: 8 900 € excluding VAT over 20 working days, on-site survey and offensive reconnaissance included, up to three legal entities and ten sites. Conducted together the findings answer one another, because most regulatory gaps are explained by a technical fact already surveyed.