Your AI risk isn't measured by your headcount.
A ten-person firm putting client files through a public model carries the same exposure as an enterprise doing the same thing. Akkuitt audits your AI use against NIST AI RMF 1.0, and trains your people to use it well.
"Someone has started asking questions."
An insurer at renewal. An enterprise customer's vendor questionnaire. A regulator, a board member, a client. You need a defensible, evidence-based answer about how your organization governs AI, and the documentation to back it.
Governance & Compliance
"We're using AI, but not well."
Staff are experimenting. Results are uneven. Nobody's sure what's allowed, what's worth doing, or who's actually good at it. You need your people trained properly, by role, on your workflows.
Workforce Enablement
Most firms have all three of these, and know about none of them.
Shadow AI is unpriced liability
Staff are already using public tools through a browser. No inventory, no approval path, no retained evidence. You can't govern an estate you can't see.
The questions have started arriving
Enterprise customers are adding AI clauses to security questionnaires. Insurers are asking at renewal. Each expects documentation you may not have.
And the usual training fixes neither
A single all-staff session on prompt writing is useful and evidences nothing. It isn't role-specific, it isn't recorded, and it doesn't touch the workflows where the risk actually sits.
Governance formality is set by exposure, not by size.
Five tiers. Your floor is the one your risk actually requires, calculated from six exposure triggers rather than negotiated.
Tier 0
Ungoverned
Ad-hoc use, zero evidence retained
Tier 1
Baseline
Minimum viable AI management
Tier 2
Managed
Regulated data or human-impact floor
Tier 3
Assured
Independent review, vendor audit
Tier 4
Certified
ISO/IEC 42001 accredited
Most organizations we meet sit at Tier 0, with exposure that indicates Tier 2.
See where you sitWhy Akkuitt
Framework, not opinion
Every finding maps to a named NIST AI RMF 1.0 control. You can check our work, and so can anyone you show it to.
Proportionate
We won't sell a Tier 4 program to an organization whose exposure indicates Tier 1. The tier floor is calculated, not negotiated.
You keep the artifacts
Plain Markdown documents you own, each carrying its own owner, evidence location and review date. Nothing trapped in our systems.
We don't sell the tools
No reseller agreements, no vendor commission, no implementation upsell. The assessment is the product.
Built for firms without a compliance department
The methodology assumes you have no CISO, no legal team, and no MLOps function. Most of our clients don't.
Assessment, not certification
Akkuitt is not an accreditation body. We assess against NIST AI RMF 1.0 and prepare you for a certification body's audit where one is required. The certificate comes from them.
Find out what tier your exposure requires.
Six questions, about two minutes. You see your result straight away, with no sales call and no email required.