Know where you stand — the portal is already open.
The Texas AG complaint portal has been open since September 1, 2026. EU AI Act Annex III obligations activate August 2, 2026. Five working days, written output, honest recommendation about what to build first.
$5,000 · 5 working days · Fixed scope · Written report + executive debrief
Three questions you'll have answers to.
By the end of week one, you have a written report mapping these three answers to your specific environment.
Where is AI in our workflows?
Most organizations cannot produce a complete inventory. Shadow LLM usage is more universal than leaders think. We turn structured discovery into a first-pass inventory that reflects reality, not hope.
What documentation would actually pass?
TRAIGA Sec. 552.105 substantial-compliance defense. EU AI Act Annex IV technical files. NIST AI RMF profiles. ISO 42001 Annex A controls. We assess each against your current state and quantify what's missing.
What is your exposure if disclosure happened tomorrow?
Exposure is not uniform. We map your specific regulatory surface — TRAIGA, EU AI Act, Title VII, ECOA, ADA, Section 1557, NIST AI RMF, ISO 42001 — and translate to concrete penalty ranges and evidence requirements.
Three written artifacts.
Not a slide deck. Not a Notion dashboard. Documents you can hand to your board, your regulator, or your defense counsel.
One-page executive gap report.
Current state mapped against the four frameworks that apply to you, with a color-coded readiness score per pillar and per regime.
Recommended engagement tier.
Tier 1 (Texas Ready), Tier 2 (Cross-Border Binder), or Tier 3 (Governance-as-a-Service) — with rationale specific to your environment.
Prioritized fix list.
Ordered by risk exposure and time-to-remediate. Broken into “fix now” and “next quarter” categories so the punch list is operational, not aspirational.
Five days. Day-by-day structure.
Fixed scope, fixed schedule, written output. From kickoff Monday morning to defensibility statement on Friday.
Kickoff call (60 min).
We meet with your executive sponsor and functional owners — IT, legal, HR, operations, compliance — walk you through the framework, and collect initial inputs. Standard NDA signed before any data moves.
- Executive sponsor + functional owner interviews
- Standard mutual NDA before any data moves
- Initial scope + timeline confirmed in writing
Structured analysis.
Structured 30-minute interviews with 3–5 functional leads. Review of your current AI policies, DPIAs, vendor questionnaires, and system-of-record entries. Mapping gap results against the four frameworks that apply to you.
- Structured functional-lead interviews (30 min each)
- Policy, DPIA, and vendor questionnaire audit
- Four-framework artifact-state mapping
Delivery + debrief.
30-minute executive debrief with Matthew Bertram — Q&A on findings, tier recommendation, next-step sequencing. You walk away with a one-page Gap Report, a prioritized fix list, and a defensibility statement suitable for general counsel or board.
- Color-coded readiness score for all nine DIG artifacts
- Must-have-by-September vs. 90-day prioritization
- Written defensibility statement for counsel / board
Every finding maps back to DIG — Digital Information Governance, ModalPoint's framework for defensible AI-influenced decisions (USPTO Reg. No. 8147558). The readiness score covers all nine DIG artifacts across the four DIG pillars.
Operators who need it in writing.
Operators in regulated industries with AI-influenced decision workflows who need to know — in writing — whether their current governance holds up. Priced against the value of a single avoided regulatory exposure.
Texas operators facing TRAIGA enforcement on September 1, 2026 — with the AG complaint portal opening that day.
Organizations with EU customer base or AI-generated output consumed in the EU, where Article 2(1)(c) applies whether or not you have a European office.
Regulated-industry executives in healthcare, financial services, energy, and professional services where simultaneous TRAIGA + federal civil rights exposure compounds.
Boards and counsel who need a defensibility statement they can put in front of a regulator, an underwriter, or a plaintiff — not a slide deck.
Matthew Bertram
President, ModalPoint · CEO, EWR Digital
Twenty-five years in energy commercialization. Author of the DIG framework. NIST AI Cyber Profile + Zero Trust CoI member. Goldman Sachs 10KSB graduate.
Five dates that shape your binder.
The 5-Day Assessment maps your current AI exposure against this calendar. Each date triggers a specific obligation; each row tells you what has to be in writing before it lands.
NIST opens AI RMF Critical Infrastructure Profile process. Concept note + Community of Interest. Energy is one of 16 critical infrastructure sectors. Federal anchor for “what good looks like.”
EU AI Act Annex III high-risk obligations apply. Article 11 technical documentation, Article 12 automated logging, Article 14 human oversight, serious-incident reporting SOP. Reaches any third-country provider whose output is used in the Union.
Texas AG online complaint portal goes live. TRAIGA enforcement trigger. Sec. 552.105 rebuttable presumption of reasonable care via NIST AI RMF substantial compliance. $10K–$200K per violation + $40K/day continuing.
EU Product Liability Directive applies to AI. AI becomes a “product” under strict liability. No negligence required — just defect and damage. Extra-territorial reach for AI outputs used in the EU market.
Title VII / ECOA / FHA / ADA / Sec. 1557. Federal civil rights statutes already attach to AI-driven employment, lending, housing, healthcare, and access on a strict-liability disparate-impact basis. TRAIGA's intent-only language does NOT preempt these.
Not ready for the five days?
Run the interactive AI Compliance Checker for a first read on your regulatory surface — then bring the results to a scoping call.
Running the 5-day Assessment.
Practical questions from operators preparing for the 5-day Governance Readiness Assessment.
What information do we need to provide before the 5 days start?+
Does the Assessment require IT access to our systems?+
How do you handle confidentiality during the assessment?+
Can we run the Assessment without telling our AI vendors?+
What changes after September 1, 2026 that makes this urgent?+
Question we didn't cover? Bring it to a 30-min discovery call →
Reviewed by Matthew Bertram, President, ModalPoint · Certified AI Auditor (CAIA). Last reviewed July 2026.
Book a Governance Readiness call
We respond to every request within one business day. If we're not the right fit, we'll say so. If we are, we'll send a project brief with start dates and a fixed-fee letter. $5,000 · 5 working days · Fixed scope.