AI Sovereignty Scan
In two weeks: where your AI runs, who can reach your data, and what to change first.
Why now
Most boards cannot say where their AI runs. Supervisors, clients and the AI Act now ask.
What the board gets
- AI register Every AI system in use or planned, with owner, data, provider and where it runs.
- Jurisdiction map Which providers fall under US law, which data they can reach, and what that means for the board.
- Regulatory exposure The AI Act, GDPR, DORA and NIS2 duties that apply to each system, with the dates.
- Workload advice Which workloads stay with an external provider, which move to a European cloud, and which belong in-house.
- Board memo Five pages, one recommendation, a first use case and a cost range. Discussed with the board or executive team.
How it works
- Day 1: Kick-off. Interviews with IT, risk, privacy and one business owner. Scope and data access agreed.
- Days 2 to 5: Inventory. Lindstead lists every AI system and traces where its data travels and which law can reach it.
- Days 6 to 8: Exposure and options. Each system is checked against the rules. Hosting options and costs are compared.
- Days 9 to 10: Board memo. Lindstead writes the memo and walks the board or executive team through it.
Who it is for
Organisations that use AI on sensitive data and answer to a supervisor, a regulator or demanding clients.
- Banks, insurers and asset managers under DORA
- Hospitals, health insurers and life sciences
- Ministries, municipalities and agencies
- Law firms, accountants and consultancies
- Energy, water, telecoms and transport operators
- Manufacturers protecting designs and production data
Frequently asked questions
-
A fixed fee, agreed before the start and set by the size of the organisation. There are no follow-up obligations and no commissions from vendors.
-
About six hours in total: a kick-off, four short interviews and the final discussion. Lindstead does the rest.
-
No. The scan works from interviews, contracts, architecture documents and existing registers. No production access is needed.
-
The organisation owns the memo and can act on it alone. Lindstead can also take the first use case to production on infrastructure the organisation controls.
Start with the AI Sovereignty Scan.
A 30-minute intake call settles scope and timing.