AI security · Compliance

AI compliance readiness.

Regulators, auditors and your biggest customers are starting to ask the same question: how do you know your AI is safe? We check your AI against the rules you answer to, close the gaps and build the evidence pack they will ask for.

Get a fixed-price quote Which rules apply to you
Gap check against each rulePolicies, records and test evidenceSupport on audit day
In plain words

AI compliance readiness turns “we think our AI is fine” into evidence an auditor accepts. We map each AI system to the rules that apply (the DPDP Act, ISO/IEC 42001, SOC 2, the EU AI Act, and sector rules from RBI, SEBI or IRDAI), find the gaps, write the missing policies and records, and add red team results as testing evidence. We prepare you for the audit; an accredited body or licensed auditor issues any certificate.

Duration
4–12 weeks
Frameworks
DPDP · ISO 42001 · SOC 2 · EU AI Act
Includes
Policies, records, test evidence
Pricing
Fixed fee
Key dates

The AI rulebook is filling up fast.

The dates that matter for companies in India building or using AI, including those selling into Europe.

JUL 2025CERT-In audits cover AINOV 2025DPDP Rules notifiedMAY 2026CERT-In AI blueprintAUG 2026EU AI transparency dutiesMAY 2027DPDP fully enforceableDEC 2027EU high-risk AI rulesAUG 2028EU AI in regulated products TODAY · NOV 2026
  1. JUL 2025CERT-In audits cover AI
  2. NOV 2025DPDP Rules notified
  3. MAY 2026CERT-In AI blueprint
  4. AUG 2026EU AI transparency duties
  5. MAY 2027DPDP fully enforceable
  6. DEC 2027EU high-risk AI rules
  7. AUG 2028EU AI in regulated products

EU dates follow the AI Act as amended by the Digital Omnibus, in force since 27 July 2026. DPDP full enforcement is 18 months after the Rules were notified. CERT-In’s blueprint is advisory.

What applies to you

Which rules cover your AI.

How it works

From gap check to audit day.

  1. Weeks 1–2

    Gap check

    We list your AI systems, map each to the rules that apply and score every requirement.

  2. Weeks 2–4

    Policy design

    AI policy, risk and impact assessment templates, vendor rules and roles, written for your business.

  3. Weeks 3–8

    Testing evidence

    Red team and data-leak tests run and mapped to the controls auditors check.

  4. Weeks 8–10

    Internal review

    A mock audit with the questions your auditor or customer will ask.

  5. Weeks 10–12

    Audit ready

    Evidence pack organised, and we sit beside you on audit day.

Why evidence matters

Templates fill folders. Evidence passes audits.

A policy template pack

Quick to buy, rarely enough on audit day.

  • Gives you documents to fill in
  • Not tailored to your AI systems
  • No proof the AI was actually tested
  • No help when the auditor asks follow-up questions

HanulSec readiness

Documents plus the testing behind them.

  • Policies written for your business and systems
  • Red team results as real testing evidence
  • One evidence pack mapped to several frameworks
  • Support through the audit itself
What you get

One evidence pack, many frameworks.

HANULSECAI compliance gap report CLIENTSample · lending app with AI underwriting SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical2High5Medium8Low3 MAPPED · DPDP · ISO 42001 · EU AI ACT AUDIT READY Sample layout, not client data
  • 01
    Gap report

    Every requirement scored met, partly met or missing, with the work to close it.

  • 02
    Policies and records

    AI policy, AI inventory, risk register, impact assessments and vendor checks.

  • 03
    Testing evidence pack

    Red team and data-leak results mapped to each control.

  • 04
    Board briefing

    A short session for leaders on duties, risks and the plan.

  • 05
    Audit-day support

    We help answer auditor questions and close last-minute gaps.

Questions

Questions buyers ask before they call us.

Q01Do you issue ISO 42001 or SOC 2 certificates?
No. ISO certificates come from accredited certification bodies, and SOC 2 reports from licensed CPA firms. We get you ready, run the testing that provides evidence and support you through the audit. Keeping preparation and certification separate is what makes the certificate trustworthy.
Q02Which rule should we start with?
If you handle personal data of people in India, start with the DPDP Act: it is law, and penalties reach ₹250 crore. If enterprise customers ask about AI governance, ISO/IEC 42001 is the clearest proof. If your AI is used in the EU, check your EU AI Act risk category now.
Q03Does the EU AI Act apply to an Indian company?
It can. It applies to providers that place AI systems on the EU market, and to providers and deployers outside the EU when their AI’s output is used in the EU. An Indian SaaS company with EU customers may well be in scope.
Q04Can one project cover several frameworks?
Yes. ISO/IEC 42001, the NIST AI RMF, SOC 2 and the EU AI Act overlap heavily. We build one set of controls and evidence and map it to each framework you need.
Q05How long does it take?
Four to twelve weeks. Companies that already hold ISO 27001 or SOC 2 are usually at the shorter end.
Q06What does it cost?
A fixed fee after a free scoping call. It depends on the number of AI systems, how many frameworks you need, how mature your existing security programme is and how much testing is included.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings