Start free

    Solutions · Experts

    A consultant who works with Ansvar, on your terms.

    Hire one of our consultants, or a consultant from a partner firm trained in Ansvar. They work in the AI you already run or on Ansvar's EU-hosted service, and leave you a report with its sources and a delivery receipt you can check.

    Assessment runs execute on Ansvar's EU gateway. The Ansvar connector inside your own cluster is for design partners today.

    See an example assessment

    Scoped work with a report at the end.

    • Compliance

      Find the gaps in your controls and write them down with their evidence.

      Gap analysis against NIS2, DORA, the Cyber Resilience Act, the AI Act, BSI Grundschutz++, NIST CSF and CMMC · data protection impact assessment (DPIA) and fundamental rights impact assessment (FRIA) · regulatory applicability register · supplier assurance review · tender review

    • Security architecture

      A threat model of your system, with the threats tied to the components they hit.

      STRIDE or LINDDUN threat model · AI system threat model · adversary tabletop · risk assessment · living architecture pilot (design partners, today)

    • OT, machinery and robotics

      Threat analysis for plants, machines and robots, and a risk decision on the advisories that hit your installed assets.

      Operational technology (OT) threat model · OT threat analysis and risk assessment (TARA) over IEC 62443 zones and conduits · machinery gap analysis against the Machinery Regulation · robot TARA · ICS advisory risk decision

    • Mobility and drones

      Threat analysis and risk assessment for vehicles, trains and drones, and the compliance work around them.

      Automotive TARA under ISO/SAE 21434 and UN R155 · rail TARA · drone and UAS TARA · support for a SORA (specific operations risk assessment) application · drone operator compliance · drone product security conformity

    • Medical devices

      Security gaps and risks of a device, documented against the rules a notified body reads.

      MDR and IVDR gap analysis · gap analysis against the MDCG cybersecurity guidance · medical device security risk assessment

    • Review an existing assessment

      A consultant reviews an assessment you ran yourself, alone or in a one to two hour review workshop with your team, and corrects what needs an expert's eye.

      Review of your run · assessment review workshop · set-up of a design-partner pilot: living architecture, ISMS as Code or the connector in your cluster (design partners, today)

    We agree scope and price with you in writing. Pilots are paid and credited when you convert.

    Photos: credits on the About page

    You can check every finding.

    The consultant signs off on the report, and the delivery receipt records what the run checked and what it could not. How a receipt works

    Example finding · incident reportingBuilt from Ansvar's recorded control mapping, 28 Oct 2026
    Requirement
    NIS2 Art. 23(4): early warning in 24 hours, notification in 72 hours, final report within one month, source 1
    Control in place
    NIST SP 800-53 IR-6, incident reporting: overlaps the requirement, source 2
    Result
    IR-6 sets internal reporting only. The statutory deadlines are not covered.
    Gap
    Sources. Click a numbered square.
    (a) … within 24 hours of becoming aware of the significant incident, an early warning […]; (b) … within 72 hours … an incident notification […]; (d) a final report not later than one month after the submission of the incident notification under point (b). NIS2, Article 23(4) · EUR-Lex
    Mapping IR-6 → NIS2 Art. 23: intersects, reviewed. Gap stated: “No prescribed 24-hour early warning, 72-hour notification … one-month final/progress reporting …” Ansvar control library · NIST OSCAL 5.2.0
    Open NIS2 Art. 23 on EUR-Lex
    Showing passage 1

    Ours, or a partner's. The same delivery requirements.

    Ansvar consultants

    The people who build the product run your engagement. Security architects and compliance practitioners who write threat models, gap analyses and DPIAs in Ansvar.

    Partner consultants

    Security and compliance firms that work with Ansvar. They deliver engagements on Ansvar for their own clients and can hold yours end to end, with local presence and delivery in your working language.

    Every engagement ends with a cited report, the consultant's sign-off and a delivery receipt.

    Your AI, your environment, or ours.

    In every setup, assessment runs execute on Ansvar's EU gateway, Ansvar runs no server-side model, and the model provider's own terms govern model traffic. Ansvar trains on nothing of yours.

    Who runs the AI
    You do. Ansvar is connected to your AI for the engagement.
    Where your documents are
    In your AI tenant and your systems. Ansvar reads what the consultant puts into an assessment.
    What Ansvar sees
    Law and standards lookups and the assessment runs. Not the traffic between you and your model provider.
    What you provide
    A seat and a connection.
    When the engagement ends
    The connection goes. Your reports stay in your tenant.

    Data and deployment facts

    Three steps.

    1. 1

      Tell us the decision

      Which system, framework or processing activity, and when you need the result.

    2. 2

      Pick the setup and the people

      Your AI tenant, temporary access in your environment or the Ansvar EU workspace; an Ansvar consultant or a partner near you.

    3. 3

      Run and hand over

      The consultant runs the assessment, reviews it with you, and leaves the report, the receipt and the sources.

    Bring us the assessment you need done.