Hire an AI Consultant · Seattle, WA

Hire an AI consultant in Seattle.

Seattle's enterprise AI problems are governance problems before they are technology problems. Microsoft ISVs and Amazon suppliers operate in procurement environments where customers ask detailed questions about AI security controls. Boeing contractors process technical data that may be ITAR-controlled or subject to program-specific security requirements. Healthcare operators face HIPAA obligations that extend to the AI tools their employees use.

The common failure: a company approves an AI tool without a formal assessment, employees use it with proprietary customer data, and the exposure surfaces 12 months later in a vendor security review. The corrective action costs more than the original assessment would have.

Fixed scope, flexible pricing based on complexity. Three to four weeks. Written deliverables yours to keep.

How we work

Tell us about your AI governance or vendor risk question.

What enterprise AI governance actually requires.

AI governance is not a policy document. It is a set of operational controls that prevent specific, identifiable harms. The document is only as effective as the controls it establishes.

A written acceptable use policy

Without a written policy, employees use their judgment about which AI tools to use with which data. That judgment is not consistent. An engineer at a Microsoft ISV feeding customer source code into an unapproved AI coding tool has created IP exposure for the company and potentially violated the customer's contract terms. A written policy with a specific approved tool list removes the ambiguity. Building the policy requires 2 to 4 weeks of stakeholder input and review. It is not a legal document. It is an operational one.

A vendor assessment process before procurement

Enterprise procurement of AI tools requires a security assessment before contract signature. After signature, the options are limited: renegotiate the DPA (difficult), accept the risk (problematic for enterprise customers), or terminate the contract (expensive). A 5-day pre-signature assessment reviews the vendor's SOC 2 report, data processing agreement, subprocessor list, model training opt-out status, and incident notification terms. Most Amazon supplier relationships require the supplier to represent that their own AI tools meet specific security standards. A vendor who fails that standard creates a downstream compliance problem.

Model risk management for high-stakes decisions

Seattle's healthcare operators and financial services companies face model risk management obligations that go beyond acceptable use. An AI model supporting a clinical or credit decision must have documented validation, ongoing performance monitoring, and a defined review process for model updates. These requirements apply even if the model is a vendor product. The organization deploying the model is responsible for its outcomes, not the vendor.

Employee awareness training

A policy that employees haven't read doesn't exist operationally. A 30-minute annual training covering what employees are and are not authorized to do with AI tools, with a completion attestation, satisfies most customer AI security questionnaire requirements. The training content should be specific to your approved tool list, not generic AI awareness content.

The vendor risk assessment process.

A structured 5-day assessment that tells you whether an AI vendor meets the security requirements for your data classification and customer obligations, before the contract is signed.

Data flow mapping

Document exactly what data the tool will process, how it is transmitted to the vendor, where it is stored, and whether it is used in model training. Most exposures come from training data use that employees don't know about.

SOC 2 scope review

Review the vendor's SOC 2 report against your data use pattern. Confirm that model training and inference pipelines are in scope. Identify complementary user entity controls the vendor assumes you have in place.

DPA and subprocessor review

Review the data processing agreement for customer data rights, retention limits, model training opt-out, incident notification timelines, and subprocessor obligations. Flag terms that conflict with your customer contract requirements.

Customer contract alignment

For Microsoft ISVs and Amazon suppliers: confirm that the vendor's DPA is compatible with the AI security representations you make in your customer contracts. Gaps must be resolved before procurement.

Written risk assessment

A one-page risk summary suitable for procurement approval, with any required remediation conditions documented. The document can be shared with your customer if requested.

Ongoing monitoring checklist

AI vendors update their terms and model infrastructure without prominent notice. A quarterly monitoring checklist ensures the original assessment stays current.

Aerospace and export control considerations for AI tools.

Boeing contractors and aerospace suppliers process technical data that may be EAR or ITAR controlled. The standard commercial AI tool approval process is not sufficient.

Technical data classification

Before an AI tool can be approved for use with technical data, the data must be classified. EAR-controlled technical data has different handling requirements than ITAR-controlled technical data, and some data is CUI but not subject to either. An AI tool approved for CUI processing may still be prohibited for ITAR-controlled inputs. The classification determination should be made by the organization's export control function, but the AI consultant's job is to frame the right question and ensure the procurement process includes that review.

US-person-only access requirements

For ITAR-controlled inputs, the AI vendor's infrastructure must be accessible only by US persons. This requirement applies to the vendor's engineering and operations teams, not just to the customer-facing API. Many AI vendors have non-US-person engineers with access to model training infrastructure. A compliant configuration typically requires the enterprise version of the AI product with specific contractual commitments about personnel access. General-purpose consumer tiers do not provide these commitments.

How we work with Seattle clients.

No platform to sell

We do not resell AI tools. Vendor assessment outcomes are based on your requirements, not on whether we have a referral relationship with the vendor. If a vendor fails the assessment, we say so.

Fixed scope before any work starts

Discovery call, written scope document, fixed price. The scope is agreed before work starts. No open-ended retainer, no hourly billing, no monthly invoice where the amount varies.

Documents your compliance team can use

Deliverables are written to be shared with your legal, compliance, and procurement teams. Risk assessments include the evidence behind the conclusion. Policy documents include the rationale for each requirement. Not slide decks.

Governance questions we get from Seattle clients.

What does an AI acceptable use policy need to cover that policies often miss?: Most AI acceptable use policies define permitted tools and prohibited data types, then stop. The gaps that create real exposure: (1) Handling of AI-generated outputs. If an employee uses an approved AI tool to draft a customer-facing document, what review is required before it goes out? Most policies don't say. (2) Model training opt-out requirements. Several AI vendors train on user inputs by default. The policy needs to specify which vendors have been configured to opt out of training, and what the employee must do if a new tool has not been evaluated yet. (3) Vendor change notification. AI vendors update their models and data processing terms without prominent notice. The policy needs to establish a vendor monitoring process, not just a one-time approval. (4) Personal device use. Employees accessing AI tools on personal devices for work purposes are outside corporate IT controls. The policy needs to address whether personal device use is permitted and under what conditions.
How do you assess whether an AI vendor's SOC 2 report actually covers your data use patterns?: A SOC 2 Type II report tells you that the vendor's controls were in place and operating effectively for the period examined. It does not tell you whether those controls apply to your specific data use pattern. The assessment involves three steps. First, identify the trust service criteria in scope for the report: availability, confidentiality, processing integrity, privacy, and security. Not all vendors include all criteria. Second, review the system description to determine whether model training and inference pipelines are in scope. Many SOC 2 reports cover the vendor's production systems but exclude the data science environments where model training occurs. Third, examine the complementary user entity controls. These are controls the vendor assumes you have in place. If the vendor's SOC 2 assumes you have enforced MFA and you haven't, the control is only partially in effect. For enterprise procurement, a SOC 2 that doesn't cover training pipelines or assumes controls you haven't implemented is not a reliable basis for approving the vendor.
What export control considerations apply when aerospace contractors use AI tools for technical data?: The primary regime is EAR (Export Administration Regulations) and, for defense-related technical data, ITAR. An AI tool that processes controlled technical data -- design specifications, manufacturing process documentation, test results -- must be operated by US persons and must not transmit the data to infrastructure accessible by non-US-person personnel of the service provider. Boeing and its suppliers face an additional layer: most Boeing programs have program-specific security requirements that are more restrictive than EAR/ITAR minimums. An AI tool that passes general ITAR review may fail a program-specific security assessment. The evaluation process involves reviewing the vendor's data processing infrastructure, subprocessor list, and employee access controls, then comparing those controls against the applicable program requirements. General-purpose AI tools like Copilot and ChatGPT have been provisioned with compliant configurations by Microsoft and OpenAI, respectively, but the compliant version is not the default -- it requires specific licensing and configuration.
How long does building a full enterprise AI governance framework take, and what is the minimum viable version?: A full enterprise AI governance framework -- covering acceptable use policy, vendor risk assessment process, model risk management policy, employee training, and ongoing monitoring -- takes 10 to 14 weeks to build from scratch, assuming at least two internal stakeholders are available for review and approval. Most of the time is spent in stakeholder alignment, not in document drafting. The minimum viable version, suitable for a company that needs to respond to a customer AI security questionnaire or pass a procurement audit, takes 3 to 4 weeks and includes: a written acceptable use policy with approved tool list, a vendor assessment checklist, and a one-page AI risk classification framework that categorizes use cases by data sensitivity and decision impact. This version covers the most common audit questions and establishes the policy infrastructure for expanding later.

Build the AI governance program before the customer audit asks for it.

Describe your AI tool procurement question or governance gap. We reply within one business day with a rough scope and price range. No commitment required.

Hire an AI consultant in Seattle.

Fixed scope, flexible pricing based on complexity. Three to four weeks. Written deliverables yours to keep.

What enterprise AI governance actually requires.

AI governance is not a policy document. It is a set of operational controls that prevent specific, identifiable harms. The document is only as effective as the controls it establishes.

A written acceptable use policy

A vendor assessment process before procurement

Model risk management for high-stakes decisions

Employee awareness training

The vendor risk assessment process.

A structured 5-day assessment that tells you whether an AI vendor meets the security requirements for your data classification and customer obligations, before the contract is signed.

Data flow mapping

SOC 2 scope review

DPA and subprocessor review

Customer contract alignment

Written risk assessment

A one-page risk summary suitable for procurement approval, with any required remediation conditions documented. The document can be shared with your customer if requested.

Ongoing monitoring checklist

AI vendors update their terms and model infrastructure without prominent notice. A quarterly monitoring checklist ensures the original assessment stays current.

Aerospace and export control considerations for AI tools.

Boeing contractors and aerospace suppliers process technical data that may be EAR or ITAR controlled. The standard commercial AI tool approval process is not sufficient.

Technical data classification

US-person-only access requirements

How we work with Seattle clients.

No platform to sell

We do not resell AI tools. Vendor assessment outcomes are based on your requirements, not on whether we have a referral relationship with the vendor. If a vendor fails the assessment, we say so.

Fixed scope before any work starts

Discovery call, written scope document, fixed price. The scope is agreed before work starts. No open-ended retainer, no hourly billing, no monthly invoice where the amount varies.

Documents your compliance team can use

Governance questions we get from Seattle clients.

What does an AI acceptable use policy need to cover that policies often miss?

Most AI acceptable use policies define permitted tools and prohibited data types, then stop. The gaps that create real exposure: (1) Handling of AI-generated outputs. If an employee uses an approved AI tool to draft a customer-facing document, what review is required before it goes out? Most policies don't say. (2) Model training opt-out requirements. Several AI vendors train on user inputs by default. The policy needs to specify which vendors have been configured to opt out of training, and what the employee must do if a new tool has not been evaluated yet. (3) Vendor change notification. AI vendors update their models and data processing terms without prominent notice. The policy needs to establish a vendor monitoring process, not just a one-time approval. (4) Personal device use. Employees accessing AI tools on personal devices for work purposes are outside corporate IT controls. The policy needs to address whether personal device use is permitted and under what conditions.

How do you assess whether an AI vendor's SOC 2 report actually covers your data use patterns?

A SOC 2 Type II report tells you that the vendor's controls were in place and operating effectively for the period examined. It does not tell you whether those controls apply to your specific data use pattern. The assessment involves three steps. First, identify the trust service criteria in scope for the report: availability, confidentiality, processing integrity, privacy, and security. Not all vendors include all criteria. Second, review the system description to determine whether model training and inference pipelines are in scope. Many SOC 2 reports cover the vendor's production systems but exclude the data science environments where model training occurs. Third, examine the complementary user entity controls. These are controls the vendor assumes you have in place. If the vendor's SOC 2 assumes you have enforced MFA and you haven't, the control is only partially in effect. For enterprise procurement, a SOC 2 that doesn't cover training pipelines or assumes controls you haven't implemented is not a reliable basis for approving the vendor.

What export control considerations apply when aerospace contractors use AI tools for technical data?

The primary regime is EAR (Export Administration Regulations) and, for defense-related technical data, ITAR. An AI tool that processes controlled technical data -- design specifications, manufacturing process documentation, test results -- must be operated by US persons and must not transmit the data to infrastructure accessible by non-US-person personnel of the service provider. Boeing and its suppliers face an additional layer: most Boeing programs have program-specific security requirements that are more restrictive than EAR/ITAR minimums. An AI tool that passes general ITAR review may fail a program-specific security assessment. The evaluation process involves reviewing the vendor's data processing infrastructure, subprocessor list, and employee access controls, then comparing those controls against the applicable program requirements. General-purpose AI tools like Copilot and ChatGPT have been provisioned with compliant configurations by Microsoft and OpenAI, respectively, but the compliant version is not the default -- it requires specific licensing and configuration.

How long does building a full enterprise AI governance framework take, and what is the minimum viable version?

A full enterprise AI governance framework -- covering acceptable use policy, vendor risk assessment process, model risk management policy, employee training, and ongoing monitoring -- takes 10 to 14 weeks to build from scratch, assuming at least two internal stakeholders are available for review and approval. Most of the time is spent in stakeholder alignment, not in document drafting. The minimum viable version, suitable for a company that needs to respond to a customer AI security questionnaire or pass a procurement audit, takes 3 to 4 weeks and includes: a written acceptable use policy with approved tool list, a vendor assessment checklist, and a one-page AI risk classification framework that categorizes use cases by data sensitivity and decision impact. This version covers the most common audit questions and establishes the policy infrastructure for expanding later.

Build the AI governance program before the customer audit asks for it.

Describe your AI tool procurement question or governance gap. We reply within one business day with a rough scope and price range. No commitment required.