Don’t trust us. Check.Try to break a sealed record
Coriqo
Services · four fixed-scope engagements

Most teams that need this are short a person, not short a tool.

Buying the platform still leaves someone to fill in the inventory, chase the documents, and assemble the pack before the exam. In a two-person risk function that someone does not exist, and the CRO is the one who answers for the gap. These four engagements do that work with you, on your data, in your Coriqo instance. Each has a fixed scope and a fixed fee, and we state our boundary before you ask.

See the four engagements Tell us what is coming
The line we don't cross

We assemble the evidence and lock it into the record. We never sign the validation opinion. SR 26-2 expects validation to be independent of the model owner. A vendor that sold you the evidence platform is in no position to also write the conclusion kept inside it. Our work stops at readiness: your second line, or an independent validator you choose, makes the call. If you would rather we did both, we will refer you to a firm that can do the second half.

Why we started offering this

Software nobody has time to fill in ends up unused, and we would rather say so.

Two findings shaped this decision. Both argue against selling a licence and walking away.

Pilots that went nowhere
95% showed no measurable P&L impact

Across roughly 300 deployments, the projects that worked were the ones somebody embedded in; the ones that failed were generic tools handed over at the contract signing.

MIT NANDA, The GenAI Divide, August 2025
Projects being cancelled
Over 40% of agentic AI projects, by end-2027

The reasons given are cost, unclear value, and inadequate risk controls. The third one is the part we can actually fix, and it is easier to fix with someone in the room.

Gartner forecast
Start here if you run agents

Your agents are already acting. Someone should be able to say what they actually do.

When a board or an examiner asks that question, a vendor slide deck is not an answer. This engagement produces a real one. We run a defined set of tests against one of your agents, at a fixed version, in your own environment. The results are locked into the record so a reviewer outside your company can check them.

S4
Agent assurance assessment
Fixed fee per agent and protocol · scoped on a call
We test the things that go wrong in practice. Does the agent call tools it was never authorized to call? Can a hidden instruction in a document it retrieves steer it? Does data leave that shouldn't? Do its actions match what it was approved to do (its mandate)? Does it follow your own business rules? Every test runs where the agent lives, and nothing executes from our side. Each result is recorded as what we expected, what was forbidden, and what we observed.
Where your environment blocks a test, the report says inconclusive for that test, with the reason. A report that manufactures certainty is worth less than one that names its gaps.
Scope an S4
You end up with
A defined test protocol run against one agent at a fixed version. The record names the version, so a later change can't blur what was tested
Every failure traceable from the finding back to the exact run that produced it
Findings with a severity and a named owner, raised in your instance where they can be tracked to closure
A signed assessment package, as a PDF plus a JSON file, that anyone can check offline against a public key
A written note of what was in scope and what wasn't. Re-assessing after your team fixes the problems is a second, smaller engagement
Under an order or a finding?

A repeat finding costs more than the first.

If your regulator has already said a control failed, it will come back to ask whether the fix worked and whether it still does. We take one order and leave you with a record of it that your examiner can check themselves. Fixed fee, scoped on a call.

Scope it with us
Three more engagements

Each one ends with something your examiner can check without taking our word for it.

Every engagement runs inside your own Coriqo instance and requires an active subscription. We scope on a call and quote a fixed fee; there is no hourly rate and no open-ended retainer. We price per deliverable, and each one can be counted in your own record, so afterwards you can point at what you paid for.

S1
Getting governed
Fixed fee · scoped on a call
You have models in spreadsheets, documents in SharePoint, and no single list anyone trusts. We build the list and turn it into a record.
You end up with
Your full model and AI inventory imported and reconciled, including the vendor models you did not build
Existing documentation ingested and attached to the specific version it covers
Cloud discovery connected, Azure first, so shadow AI shows up next to what you declared
Your first governance record, locked in and checkable offline with a public key
Scope an S1
S2
Evidence packs
Fixed fee per pack · or fleet coverage
For each model or agent, the evidence a validator will ask for, gathered and locked into the record before they ask. Per pack, or standing coverage across the fleet.
You end up with
The readiness checklist satisfied, with every open item named and assigned rather than quietly skipped
An assumptions list built from your documentation, with checks for when reality drifts away from it
An evidence pack per model, locked to the version it describes
A written list of what is missing and who owns it, because a pack that hides gaps is worse than no pack
Scope an S2
S3
Exam preparation
Fixed fee per exam or milestone
You have a date. A regulatory package for that named exam, or for an EU AI Act conformity milestone, drafted and locked in against it.
You end up with
A regulatory package taken from draft through review to a locked final version, scoped to the exam actually coming
Gaps raised as tracked corrective actions, each with an owner and a due date
The examiner portal set up so a reviewer can verify the package without a Coriqo account
A dry run against the questions in our regulatory corpus, so the obvious ones have answers before the day
Scope an S3
What we will turn down

Four things we don't sell, and the reason for each.

A short list is more useful to you than a long one, and it tells you what we are before the third call.

The validation opinion

Independence. We prepare the evidence; somebody else concludes on it. This is the boundary at the top of the page and it does not move per engagement.

Bodies by the month

Staff augmentation turns into a headcount line that never ends and a product that stops improving. Every engagement here has a defined end.

Open-ended advisory

We are not a consulting firm and are not trying to become one. Services stay a minority of revenue on purpose, so the platform keeps getting built.

A promised outcome with your regulator

Nobody can sell you a passed exam. We can get the evidence into a state where the questions have answers, which is a different claim and an honest one.

Questions we get

Asked by risk officers, procurement, and the firm that already does your validation.

It feeds them. An S2 pack is what an independent validator has to assemble by hand today: inventory, versioned documentation, assumptions and the chain of approvals. It arrives already gathered and locked to the version it covers. That collection has to finish before any judgment can start, and none of it needs the validator's expertise. We take that half. They keep the judgment, which is what they are paid for.
Only under a written scope that names every tool the agent can reach and says which of them a test may trigger. Where a tool has side effects, such as moving money or updating a customer record, we test against a non-production copy of the agent, or read-only, never the live tool. Nothing runs from our infrastructure. The tests execute inside your environment, and what comes back to us is the signed results and their fingerprints (hashes). If your environment blocks a test, the report marks that test inconclusive with the reason, because an assessment that quietly skips the hard part is the thing we built this to replace.
No, and the reason is the same independence line as everywhere else on this page: the party that assessed the agent should not also be the party that rebuilt it, or the next assessment is checking its own homework. Your engineers or a partner firm remediate; we re-run the protocol afterwards as a second, smaller engagement, and the two signed packages sit side by side showing what changed.
Today, the founder, with a cap of two engagements running at once. That is a real constraint and we would rather name it than take a booking we cannot staff. If the calendar is full we will tell you the date we can start rather than starting badly. As the runbooks harden, the manual steps in them become product features. That is why we do this work ourselves rather than hiring a delivery team first.
No. Every deliverable here lives in your Coriqo instance as a signed record. A pack that leaves as a PDF loses what makes it worth having: a reviewer can verify it later against a public key without trusting either of us. A consultancy can hand you a document. Only the platform can hand you one that is still checkable in three years.
A fixed fee per engagement, quoted after a scoping call, on the same basis as the rest of our packaging. We are not publishing a rate card for the same reason we do not publish a licence price list: we are early, the numbers would be invented, and a bank that catches a vendor inventing numbers is right to stop reading. Ask, and you will get a real one for your scope.
Only what the engagement needs, inside your own workspace, under the same separation and zero-retention terms as ordinary platform use. Your data is never used to train a model. Access is limited to named people for the length of the engagement and removed at the end. Every action we take lands in your audit trail under our names, not under "the vendor". You can read what we did afterwards, which is the same standard we ask of everyone else on the record.
Yes, with the framework swapped. S1 and S2 run the same way against our healthcare checks, and S3 targets a Joint Commission RUAIH or ONC HTI-1 review, or a health system's AI governance committee, in place of a bank exam. The artifact both buyers want turns out to be the same one: a signed package somebody outside your company can check.