Common Questions
Questions buyers
ask before calling.
Enterprise buyers research before they engage. These are the questions compliance officers, general counsel, and CISOs ask most frequently.
Does Navard replace our legal counsel or compliance team?+
No. Navard delivers cybersecurity and governance assessments — not legal advice. Our Signed Defensibility Report documents your AI risk posture and due diligence. Your legal counsel interprets regulatory applicability and advises on legal obligations. We work alongside your existing legal and compliance teams, not in place of them.
Can Navard work alongside our existing MSP or IT vendor?+
Yes. Navard's AI governance work operates at the policy, compliance, and security architecture layer — not at the helpdesk or infrastructure management layer. We regularly work in environments where an MSP manages day-to-day IT operations. Our assessments and deployments are designed to integrate with, not replace, existing vendor relationships.
How long does onboarding take before work begins?+
Typically three to five business days from signed engagement letter to active discovery. Onboarding covers scope confirmation, a read-only access request for relevant systems, and a brief intake form completed by your team. For a Tier 1 AI Risk Assessment, the full engagement from onboarding to signed report delivery is 7 business days.
Do you deploy AI models or only assess existing systems?+
Both. Pillar A covers assessment of existing AI systems. Pillar B covers secure design and deployment of new AI agents. Pillar C provides the confidential computing infrastructure to run those agents privately. Clients typically begin with a Pillar A assessment and progress to deployment once the governance foundation is established.
What does the Signed Defensibility Report actually contain?+
The report contains a complete AI system inventory, NIST AI RMF gap analysis across all four functions, regulatory compliance mapping for your applicable frameworks, an OWASP LLM Top 10 security assessment for deployed agents, a risk register with severity ratings, a prioritized remediation roadmap, and a signed attestation by the CISM-credentialed founder. It is formatted for board presentation, regulatory submission, and insurance underwriting.
How does Navard handle confidential client information during an assessment?+
All client data is handled under a signed Master Services Agreement with mutual NDA provisions before any work begins. Healthcare clients receive a Business Associate Agreement prior to any engagement involving PHI. Data accessed during assessments is documented, used only for the defined engagement scope, and deleted within 30 days of engagement close unless contractual retention is required. Navard operates under the same governance standards it recommends to clients.
Does the EU AI Act apply to our US-based organization?+
It may. The EU AI Act applies to any organization that places AI systems on the EU market or whose AI systems affect people in the EU — regardless of where the organization is headquartered. Many US companies incorrectly assume they are exempt. Navard's EU Nexus Assessment determines whether and how the Act applies to your specific operations. Organizations should consult qualified legal counsel regarding the precise legal applicability of any regulation to their circumstances.
What is the minimum engagement size?+
The smallest paid engagement is a Tier 1 AI Risk Assessment at $10,000, covering up to five AI systems with a signed Defensibility Report delivered in seven days. The free AI Exposure Report — which identifies your three highest risk exposures in writing within 48 hours — is available at no cost and requires no commitment.
