AI-generated imageThe Diagnostic
Know where you stand in three weeks.
The Regulatory Readiness Diagnostic is a fixed-fee assessment of your group against the regimes that apply to it. It ends with a risk-ranked findings report and a costed roadmap. What you do with them is your decision.
Scope
Three workstreams
Workstream A
Data protection
- Review of privacy notices, records of processing, processor agreements, retention and breach procedures
- Mapping of personal-data flows between your entities
- Cross-border transfer positions under each regime that applies, such as the GDPR, the UK GDPR and the Swiss FADP
Workstream B
Your sector regime
- Gap review against the regime your regulator audits, agreed at kick-off
- Covering scope, risk assessment, reporting lines and incident handling. Where the regime is outside Lexaero's own sector experience, a specialist in that regime works alongside Lexaero
- How the regime fits your existing management systems, so it is integrated and adds no parallel process
Workstream C
AI use and AI Act exposure
- Inventory of the AI tools in actual use across operations, sales, HR and administration
- Classification of each use under the EU AI Act
- The obligations that follow, including the AI-literacy duty that applies to every deployer
The Diagnostic is an assessment. It identifies and ranks gaps and does not itself produce the remedial documents. Remediation is quoted as fixed-scope packages once the findings are on the table.
Deliverables
What you receive
Findings report
A written report covering all three workstreams. Each gap is ranked by severity and regulatory exposure.
Roadmap
A board-ready remediation plan: sequenced actions, indicative effort, and a fixed-fee quotation for each package.
Debrief
A one-hour session with your leadership team, on site or by video, to walk through the findings and answer questions.
Timeline
About five to six hours of your team's time across the interviews, the systems walkthrough and the debrief, plus collecting documents. The three weeks assume that documents and interview slots are available as agreed at kick-off.
Three weeks, little disruption
- Week 1
Desk review
Document request and kick-off call. Data-flow and AI-use questionnaires go to the relevant leads.
- Week 2
Interviews
Four to six structured interviews of about 45 minutes with the people who run compliance, IT, HR and operations. A walkthrough of the main systems.
- Week 3
Findings
Analysis, drafting and quality review. The findings report and roadmap are delivered and the debrief is scheduled.
After the Diagnostic
Diagnostic first. A retainer only if it earns one.
- Weeks 1 to 3
Diagnostic
Review, interviews and systems walkthrough. Report and roadmap delivered.
- Week 4
Decision point
You own the roadmap. Carry it out internally, with another firm or with Lexaero. There is no obligation.
- Months 2 to 6
Remediation
Fixed-scope build-out of the priority gaps, sequenced by risk.
- Ongoing
Retainer
Monthly support for the work that keeps arriving.
Terms in brief
- The fee is fixed, stated exclusive of VAT, and set out in a written proposal before any work starts.
- Everything you share is treated as confidential, subject only to disclosure the law requires. It is not covered by legal professional privilege. A mutual non-disclosure agreement can be signed before any document changes hands.
- The findings report and roadmap are yours to use once the fee is paid. You may show them to others, but Lexaero answers for them only to you. Lexaero keeps its own methods and templates.
- Lexaero acts as an independent consultancy under a short written agreement, signed at commissioning, which is governed by Dutch law and sets a limit on liability.
- The Diagnostic is an assessment by a consultancy. It is not a legal opinion from a law firm, and it does not guarantee the outcome of a regulator's audit.