Your cloud provider secures its platform. Proving that the data entering it came from a trusted device, passed integrity checks and was approved for AI use stays with you.
Since September 11, 2026, manufacturers of connected products sold in the EU must report actively exploited vulnerabilities within 24 hours. AI regulators and enterprise customers are asking a related question: what trained this model, and can you show it?
What the assessment covers
- Device and data flow map. Every path from device to gateway to cloud AI service, including where data is stored and where it trains models.
- Identity and integrity review. How devices authenticate, how certificates are checked and revoked, and what validation happens before data reaches a model.
- Lineage readiness. Whether a production model can be traced back to the devices and firmware versions behind its training data.
- CRA reporting readiness. Who owns the 24-hour early warning, what triggers it, and what evidence exists to support it.
- Agent action review. Where AI agents read device data or send commands back to devices: which actions they can take and where a person must approve. Includes screening for instructions hidden in device data.
What you get
A written gap report scored against CRA reporting obligations, ISO/IEC 42001 and the NIST AI Risk Management Framework, with IEC 62443 and the NIST IoT device baselines as the security reference, plus a prioritized 90-day remediation plan your engineering team can act on.
Clients who continue can turn those findings into ongoing, control-mapped evidence produced from their own gateways.
Who it's for
Companies that ship connected products into the EU, medical device and remote monitoring teams, logistics and cold chain operators, and any organization training models on sensor data.
How it works
- Scoping call. Confirm which devices and frameworks are in scope.
- Discovery. Sessions with engineering and compliance leads over three to four weeks.
- Readout. The gap report and remediation plan, walked through with your team.
Your devices, gateways and cloud accounts stay under your control throughout. We review and advise; we never take operational ownership of your infrastructure.