Do you know where AI is at work in your company?
Your staff use ChatGPT, Copilot and AI features in dozens of other apps. In two to six weeks we find out exactly what, with which data and how an attacker could reach it — and give you a plan to put it right.
AI reached companies faster than the rules did
Shadow AI
Personal ChatGPT accounts, browser extensions, AI inside Canva, Notion or Zoom. Management and IT know about few of them.
Data out of control
Contracts, client data and source code go into prompts — often to a vendor allowed to train on them or store them outside the EU.
A new attack surface
AI agents with mailbox access, exposed local models, API keys in repositories and a website chatbot that can be talked into anything.
Obligations already apply
AI Act: prohibited practices and AI literacy since February 2025, transparency since August 2026, high-risk systems from December 2027. NIS2 obligations reach ever more companies.
Seven areas. Technically verified, not just a questionnaire.
We verify claims against real sources — Microsoft 365 or Google Workspace settings, DNS, an internet scan. We do not need the content of emails, documents or AI conversations.
Governance
AI policy, accountable person, list of approved tools, AI literacy training and its records.
Inventory and shadow AI
Every AI tool actually in use — including personal accounts, browser extensions and local models.
Data and vendors
Which data goes where, whether the vendor trains on it, where it is stored, whether a data processing agreement is in place.
Identities and permissions
AI apps that can read all mail and files, consents granted without approval, missing MFA, licences of former staff.
Attack surface
Internet-facing AI servers, vector databases and tools without a password, leaked API keys, DDoS resilience.
Agents and automation
What AI agents and automations may do without a human, what data they can reach, whether they can be switched off at once.
Regulation
Classification under the AI Act, links to NIS2, GDPR and employee monitoring rules.
Five steps, fixed deadline, fixed price
Preparation
Contract, NDA, data processing agreement and written authorisation for testing. We agree scope and contacts.
Collection
Kick-off workshop, read-only connection to Microsoft 365 or Google Workspace, 14 days of AI service monitoring via DNS, anonymous staff survey.
Testing
Internet attack surface scan, leaked key search, review of AI app and agent permissions, optionally a test of your chatbot.
Evaluation
Score 0–100, findings by severity with references to specific provisions. A second person reviews every report.
Hand-over
Report, remediation plan, AI policy template and a presentation to management. Critical findings are reported immediately, not at the end.
Outputs you can act on straight away
- AI inventory — tools, users, data, vendors
- Data flow map — department → tool → vendor → country
- Technical findings with evidence and fix
- AI Act classification and links to NIS2 and GDPR
- AI Risk Score overall and per area
- Remediation plan with priorities and deadlines
- Templates for an AI policy, approved tool list and training material
- One-page management summary, no jargon
Priced by company size, known up front
Prices exclude VAT; approximate EUR amounts at CZK 25/€. Travel within the Czech Republic is included.
Start
- Inventory and shadow AI
- Attack surface and leaked key scan
- Report and remediation plan
- AI policy template
- Online presentation
Business
- Everything in Start
- Staff survey and interviews
- App and agent permissions
- AI Act / NIS2 / GDPR matrix
- On-site presentation
Pro
- Everything in Business
- Sampling by department
- DPIA for one AI system
- Test of one chatbot
- Management workshop
Enterprise
- Multiple sites
- ISO/IEC 42001 readiness
- High-risk systems
- Individual schedule
We deduct 50 % of the audit price from the first year of AI Shield Monitor if you order it within 30 days of the report. First 10 companies: 30 % off in exchange for a reference.
A certificate anyone can verify — and one you can lose
After the audit you can earn the Protectione AI Secure mark at three levels. Anyone can verify it online. With AI Shield Monitor the criteria are checked daily — if a company stops meeting them and does not fix the gap, the certificate is suspended.
AI Ready
AI under control at a basic level: rules, tool list, training, no critical finding. Valid for 12 months.
AI Secure
Score 85+, findings fixed within 14 days, continuous AI Shield Monitor oversight. Verified continuously.
AI Secure+
For companies with their own chatbot or AI agents: regular testing, human approval of irreversible actions, a rehearsed incident procedure.
A Protectione AI Secure certificate confirms that the criteria of the Protectione AI Secure Certification Rules were met as of the stated date and within the stated scope. It is neither a conformity assessment under Regulation (EU) 2024/1689 nor a certification by an accredited certification body, and it does not replace legal advice.
What people ask most
Is this a statutory cybersecurity audit?
No. The AI audit is an expert review of AI use and related security risks. We do map the results to NIS2 obligations, so it helps with those too.
Will you see our emails, documents or AI conversations?
No. We connect to Microsoft 365 or Google Workspace read-only, for settings and access records. We neither read nor need any content.
Do we have to inform staff?
Yes — monitoring access to AI services is employee monitoring. We give you a template notice to adapt and send out.
How much of our time does it take?
Typically a 90-minute kick-off, an hour with your IT to connect services, short interviews with a few people and the results presentation. The rest is on us.
What if we cannot fix the findings right away?
The remediation plan ranks findings by severity. We recommend fixing critical ones within 72 hours and the rest step by step. With AI Shield Monitor you see what is done and your score improves as you go.
Protectione is not a law firm and does not provide legal services. Information on legislation is for guidance only.
For business and public bodies
We find out which AI tools your people use and where data goes, watch your attack surface and DDoS, and prepare you for NIS2 obligations. In plain language, with evidence for inspectors and customers alike. Learn more →
AI Shield Monitor
An app for the web, desktop and mobile that continuously shows which AI tools are in use, when sensitive data goes into them, what is exposed to the internet and whether a DDoS attack is heading your way. Learn more →
Start with a 30-minute call
We go through how your company uses AI and what the law asks of you, and tell you whether an audit makes sense or a smaller step will do.