Laboratory discipline, applied to AI.
Accredited laboratories survive on four habits. Our founders run an ISO/IEC 17025-accredited, DEA-registered laboratory, so those habits are how Sentinel was built, not a value we aspire to.
Structural impartiality
Independence that is organizational, not promised. We sell no AI products and take no vendor referral fees.
Validated methods
Scoring anchored to published frameworks, NIST AI RMF, ISO/IEC 42001/42005/23894, OWASP, before any engagement begins.
Evidence with custody
Findings traceable to documented evidence your auditors can follow, the same chain-of-custody habit our lab lives under.
Reproducible findings
Reports a third party could re-derive, including when the finding is “you’re in better shape than you feared.”
If you disagree with a finding
Say so in writing. It will be answered by a qualified reviewer who did not write it, within fifteen business days, and the answer will be tied to the evidence. Where you are right, we correct the report and say so. Where we hold the finding, you get the reasons, and your written response travels with the report. Ratings do not move under pressure, and there is no fee for asking. Write to hello@sentinelassurance.group.
The Sentinel Control Map™
Our assessment engine: 47 NIST AI RMF subcategories cross-walked to ISO/IEC 42001 clauses and Annex A controls, each control rated Met, Partly met or Not met on documented evidence. One pass produces your NIST posture, your 42001 readiness, and your safe-harbor narrative simultaneously.
See the Gap Assessment →The AI Deployment Gate
Our system-level instrument: five gates, one non-compensatory GREEN / YELLOW / RED decision, run before deployment and again on change, on schedule and after any incident. The Control Map tells you how your organization governs AI; the Gate tells you whether one specific system is fit to be trusted right now. Sector overlays for HIPAA, GxP, the EU AI Act and U.S. state law score inside the same five gates. Methodology: SG-STD-002.
How the Gate works →What each verdict means
Every Sentinel service ends in a fixed verdict. Each keeps the words its parent instrument or your next step gives it, and each is derived by a published rule, never chosen. This table is SG-REF-VERDICTS-01; the method IDs are the controlled documents behind each service, available on request.
| Service | Verdict words (best to worst) | What fixes it | Method |
|---|---|---|---|
| 1 | GreenLight Readiness SnapshotCLEARED / CONDITIONAL / HELD | Twelve anchor levels and the Gate-S standing, by a fixed rule | SG-MTH-WT-01 |
| 2 | AI Readiness SnapshotCLEARED / CONDITIONAL / HELD | Severity derived from controls R1 to R12 and the HELD test | SG-MTH-RS-01 |
| 3 | AI Exposure BaselineExposure classes A to D per system; no verdict | Four classification tests per inventoried system | SG-MTH-AXB-01 |
| 4 | AI Deployment GateGREEN / YELLOW / RED | Five gate levels converted at the consequence tier; no gate offsets another | SG-STD-002, SG-MTH-GT-01 |
| 5 | AI Governance Gap AssessmentCERTIFICATION-READY BASELINE / SUBSTANTIALLY READY / PARTIALLY READY / EARLY STAGE | 47 control levels, fixed percentage lines, a governance floor, and an inventory-and-owner cap | SG-MTH-CM-01 |
| 6 | Inline AI Vendor Risk AssessmentGO / CONDITIONAL-GO / NO-GO | Weighted score across 32 criteria and the count of critical failures | SG-MTH-VR-01 |
| 7 | Conventional App Gap AssessmentREADY / READY WITH CONDITIONS / NOT READY | Any must-fix finding gives NOT READY; any recommended finding gives READY WITH CONDITIONS | SG-MTH-AG-01 |
| 8 | ISO/IEC 42001 Certification-Readiness ReviewREADY FOR STAGE 2 / READY FOR STAGE 1 / NOT READY | 27 clause ratings with a three-minor escalation; internal audit, management review, and Statement of Applicability conditions | SG-MTH-42K-01 |
| 9 | AI Red-Team AssessmentADEQUATE, FINDINGS CLOSED / ADEQUATE, FINDINGS OPEN / TESTING INADEQUATE | Gating regime elements, required-item coverage, and open Critical or High findings | SG-MTH-RT-01 |
Findings across services carry one client-facing class: must-fix (a store rejects it, the law exposes you, or the verdict turns on it), recommended (fix in the next cycle; the verdict does not turn on it), or future (note it for the roadmap). No verdict on this page is a certification, an approval by any body, or a statement of conformity to a standard or regulation.
Find out where you stand.
Free, 30 minutes, no deck.
The AI Risk Exposure call: we walk your AI footprint, flag your likely obligations, and tell you plainly whether and where you need help.
Book the call →