Independent AI architecture & external exposure assessment
Decide what to build.
Know what to fix first.
Independent AI architecture and external exposure assessment for leaders investing in AI and the systems it depends on.
02 · What is at stake
A pilot can impress and still fail to justify a rollout. Compare it with a simple baseline before committing budget.
Model, integration and supplier costs continue after launch. Understand them before they become contracts.
AI services depend on domains, identities, interfaces and suppliers. Much of that surface can be seen from the internet by anyone who looks.
03 · Who will ask
After an incident, the questions are what was decided, by whom and on what evidence. Several regimes set maximum penalties linked to worldwide turnover.
| Regime and maximum | Source |
|---|---|
| UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, section 157: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. | Section 157 ↗ |
Maximum amounts for the most serious categories. Whether a regime applies depends on your role, systems and jurisdiction. Legal conclusions remain with your qualified advisers.
04 · What we do
Inference Institute gives leaders an independent view before budget, approval or exposure becomes a commitment. Every engagement is scoped to close on a written decision record with the evidence behind it.
05 · Services
Each service is scoped at a call and closes on a written decision record. Discovery, reviews and ongoing advice sit within each one.
05.1 · Cyber Defence
See what is externally visible, decide what to fix first and brief your remediation partner.
Agreed targets and methods only. Indicators require validation and are not proof of compromise. Your team or chosen partner implements fixes.
05.2 · Architecture
Compare build-or-buy options, costs and controls before committing AI budget.
Also within the practice
05.3 · Architecture
Connect AI to your existing systems and avoid duplicated platforms and running costs.
Target architecture, Capability map, Transition roadmap, Platform and vendor recommendations
05.4 · Governance & Risk
Give AI decisions clear owners, approval gates and evidence for regulatory responsibilities.
Governance operating model, Control catalogue, Ownership and gate criteria, Regulatory gap assessment
05.5 · Governance & Risk
Identify harm, privacy and control gaps before approving a system or expanding its use.
Risk and impact assessment, Data Protection Impact Assessment (DPIA) where applicable, Risk and control register, Decision record and conditions
06 · External Exposure Assessment
Agree the decision, assets, methods and stop conditions in writing.
Review the agreed evidence and external exposure without intrusive testing.
Set out findings, confidence, limitations and priorities for the decision owner.
Your team or chosen remediation partner implements the agreed changes.
No written authorisation, no assessment. Work stops if ownership or permission is unclear.
Indicators require validation and are not proof of compromise.
Illustrative
07 · The output
A concise executive view, with a technical appendix your team can act on. Evidence for board, insurer and partner conversations, with confidence and limitations stated.
View a representative sample ↗08 · Independence
Inference Institute is an independent, vendor-neutral practice. We take no vendor commission and we do not implement. You choose who builds and who fixes, and they receive a brief they can work from.
Read the research ↗09 · Next step
A scoping call agrees the decision, the evidence available and what a useful output looks like. Fees and timetable follow from that scope.