Before you approve an AI tool for your organization, know exactly where it fails on HIPAA, SOX, and data sovereignty. One vendor. One structured report. A clear Go, Conditional Go, or No-Go verdict.
Every AVRA runs the same standard, in two layers.
The 3 gates — binary, checked first, matched to your industry
BAA availability
Records retention and supervisory access
Third-party disclosure and confidentiality terms
No score offsets it. A vendor with no BAA available at all doesn't get to look like a conditional pass because the rest of their paperwork is polished.
The 9 scored criteria — where it's a matter of degree, not disqualification
Source document, document type, date verified, verified by. Every line traces back to something you can hand a regulator or cite in a contract negotiation.
Every AVRA report closes with one of three verdicts, with conditions where applicable.
Vendor meets all material criteria for your regulatory environment. Approved with standard usage controls.
Vendor passes most criteria but has specific gaps. Report includes the contractual controls or usage restrictions required before approval.
Vendor fails one or more critical criteria. Report explains the specific disqualifiers and recommends alternatives where possible.
Compliance officers evaluating a new AI tool before adding it to the approved technology list.
Legal and procurement teams who need documented due diligence before signing a vendor contract.
CISOs auditing existing approved tools that were onboarded without formal security review.
Healthcare and fintech operators who need documented evidence of AI vendor due diligence for regulatory audits.
Checkout asks for the vendor and exact tier, your industry, and what your people use it for.
We run the industry gate and the nine scored criteria against the vendor's own live documentation.
Email your signed order form or DPA excerpt and we add the contract divergence check. Same price, same 48 hours.
Go, Conditional Go or No-Go, with conditions and the exact question to put to the vendor in writing.
One vendor per report. If you need multiple vendors assessed, each is priced at $997. Contact us about bundle pricing for three or more vendors assessed simultaneously.
The report specifies the exact conditions required — for example, "requires a signed HIPAA BAA before any PHI-adjacent use" or "restrict to internal tooling use only, no client data." These conditions are written to be usable directly in your vendor contract or internal usage policy.
Yes. The findings document specific gaps in the vendor's current offering, written to be handed to a vendor directly in a contract negotiation — BAA additions, data retention reductions, or deletion commitments.
If you're auditing an existing tool registry of 5+ tools, that may be better served by a full forensic engagement. Request a briefing to discuss scope and pricing.
$997 to document your due diligence is a small fraction of what one failed regulatory audit costs.