What does an AI verification audit actually check?
Two structural questions. First, whether the system holds a reference — a specification of the state it is supposed to reach — or only a proxy that has replaced it. Second, whether any independent channel exists through which the system's own report can be contradicted. Both are answerable without access to model weights or training data.
How much does it cost?
Fixed prices, net of VAT, agreed in writing before work starts, never hourly. Rapid AI architecture review €1,400. Vendor claim audit from €2,300. Applied architecture audit and AI system architecture audit from €4,700. Verification layer review and AI agent security audit from €7,000. Urgent AI incident analysis from €2,300; full post-incident report from €4,700. Closed-loop control engineering from €14,000. AI Crawl Audit from €2,500, Citation Architecture from €7,500, AI visibility care from €2,500 per month.
Why do you publish prices?
Because the price is information a client needs before a conversation can even start. Hiding it saves the seller's time, not the client's. I also publish what the price depends on and what is out of scope, so that a comparison with another offer is fair.
Where do I start on a small budget?
With the free 30-minute call, the free audit kit, or the free seven-day bot log sample. The cheapest paid start is the rapid AI architecture review at €1,400, which is credited against a full audit ordered within 60 days.
Do you need access to our code or infrastructure?
For the vendor claim audit, no — it runs against the deployed model through its normal interface. For the applied architecture audit, ordinary user access to the deployed system is enough. The verification layer review works from documentation and interviews. The security audits need documentation and read access to configuration and logs; the agent audit needs a test or staging environment and written consent. None of them need model weights or training data.
What should we do in the first hours after an incident involving an AI system?
Secure the records: application logs, agent action logs, conversation history and configuration, before log rotation overwrites or deletes them. Do not treat the model's explanation as evidence: asked for a cause, a model can produce a convincing but false story. I start an urgent incident analysis within 24 hours of the order and send written first findings within 24 hours of receiving the material. For an incident, call or message on WhatsApp at any hour: +48 733 123 915.
Can the incident report go to our board, an insurer or a regulator?
The report is technical documentation: the course of the incident, the evidence, the confidence level of each finding and the missing control layer. It can support your legal team, an insurer or a board, but it is not a legal opinion and does not replace any breach notification you may be required to make.
How does payment work?
For audits and engineering work: 50% upfront on signing, 50% by bank transfer within 30 days of the report or of acceptance of the work. The rapid review is paid 100% upfront. AI visibility care is paid monthly in advance. Prices are net; VAT is added where it applies. No hourly billing.
Do you sign an NDA?
Yes, on request, before any material is shared. Findings from commercial work are never published without your written consent, and then only anonymised.
Can we prove the audit happened without revealing our data?
Yes, within limits. At the end of each commercial audit I hash every transcript and log, combine the hashes into a Merkle tree and sign its root with the date. With your consent the root is published; it reveals nothing about the content and names neither you nor the system. Later you can show any single item to a regulator, an insurer or your board, together with a short proof that it belongs to the audited set, without disclosing the rest. What this proves: that the evidence existed in that form on that date and has not been altered since. What it does not prove: that the findings are right. That rests on the published method and on the report.
Is this a regulatory conformity assessment?
No. This is not a conformity assessment under the EU AI Act, not a certification, and not a legal opinion. It is an independent technical audit. If a formal conformity assessment is what is required, an accredited body is the correct supplier and will be recommended.
Do you have client references?
Not yet. The commercial practice starts in 2026, and I do not publish references that cannot be checked. Instead I show evidence: seven publications with DOIs, a public method, and experiments on my own domains, whose server logs, Google Search Console and Bing Webmaster Tools data I can show on request.
What do I receive at the end?
A written report containing the complete method used, the raw transcripts or logs, the findings with their evidence attached, and an explicit statement of what the work could not establish. Everything is reproducible by your own team from the report alone.
Can I check the method before hiring anyone?
Yes. The three-prompt protocol is published verbatim and free to run on any model in about ten minutes, and the full study is an open-access preprint with a permanent DOI. Run it first. A paid audit is worth buying only if the free version returns something that concerns you.
Do you work in English and outside Poland?
Yes. Reports are written in English or Polish, and all services are delivered remotely. Clients in Poland can also use the Polish-language offer at aisecurity.org.pl.