Fixed scope. Fixed fee.
Defined deliverables.

The full published obligation set for one deployment — six §III values plus conformance testing against the OCTO AI/ML Governance Policy and clauses E.1–E.4. Report · client assessment · remediation workbook · readout deck · OCTO submission set · 30-day checkpoint, all rendered from one findings register.Boundary: one AI deployment

Role-specific operational training that starts where the baseline course stops, built on a role and decision-authority map. Converts §III.C human accountability into job aids used at the moment of decision.Boundary: 3 role groups · 3 live sessions · 75 participants

Pre-award review of a planned acquisition — requirements, evidence rights, acceptance criteria, termination leverage — with every finding attached to a named pre-award decision point. Anchored to the §4.2 CTO approval gate.Boundary: 1 acquisition · 3 working sessions · 1 evaluation-panel briefing

The vendor-side mirror. Every District AI procurement triggers a factsheet; this produces it, keeps it current within 30 days of substantive change, and builds the readiness evidence behind it.Never run alongside the agency-side review on the same procurement

Retained monthly capacity across deployment, monitoring, and review cycles. Standing capacity rather than episodic projects — structured to carry an agency through the Taskforce sunset without a gap.

Organization- or program-wide diagnostic against the NIST AI RMF baseline plus the instruments binding the specific program. Where AI influences decisions, where oversight is missing, sequenced remediation.

Independent verification and validation of an AI system — bias, traceability, and alignment with regulatory expectations in high-impact environments. Vendor-neutral by construction.Unclassified scope only — no CUI

Where agentic workflows and tool-connected models create exposure that traditional model review does not catch — connector permissions, action authority, prompt-injection surface, and the human checkpoint that should exist and usually doesn't. Mapped to the OWASP LLM Top 10.

Where AI adoption intersects an existing CMMC or SP 800-171 posture — and where a well-meaning AI rollout quietly undermines a control that was already assessed.

AI governance sections written to the solicitation's evaluation criteria, on 48-hour notice, before any subcontract — at no cost to the prime.

For organizations with no AI policy at all. Acceptable use, shadow-AI controls, decision authority, and a governance structure sized for an organization without a compliance department.

For organizations that already have some policy and need to know whether it survives contact with how staff actually work. Plain language, no framework theater.

Is what you have already automated actually under control? The risk companion to an automation program — what the workflow can do unsupervised, and who finds out when it does it wrong.

Hands-on enablement — teaching staff to use AI tools well. Deliberately distinct from governance and policy work, and sold separately so neither pretends to be the other.

Ongoing monthly advisory for organizations that have a policy and need someone to keep it true as tools, staff, and regulation change.

One working hour with the principal and a one-page memo. Flat fee. The lowest-friction way to establish whether there is a real engagement here — including the answer that there isn't one yet.