Anyone can call their AI responsible, and everyone does. There is no independent floor under the claim: no body certifies it, no standard anybody must meet. A self-assessment is not defensible to a board, a regulator, or an enterprise security review, however careful its authors.
WHAT IDHARMA IS · INDEPENDENT AI AUDIT · SINCE 2024
iDharma is the independent trust layer for enterprise AI.
We assess the AI you already run against a published standard - and hand back a report your board, customers and regulators can read.
NIST AI RMF
ISO/IEC 42001
EU AI Act
SOC 2
HIPAA
India DPDP
Our promise
“An opinion is a claim. A rating against a standard is evidence.”
Every finding is written against the standard it answers - checkable line by line, by anyone who asks. The fee starts at $5,000, and nothing is charged until you approve it.
Request an AI AuditWhy iDharma exists
Why AI needs an independent check
AI reaches production faster than anything is verified about it. That is not carelessness - it is what the tooling now makes possible - but the arithmetic is unforgiving: finding out after an incident costs far more than finding out before one, and that gap is the whole argument.
Proof is now being demanded rather than requested. The EU AI Act asks for it in writing; boards, investors and enterprise customers ask for it in diligence. An independent read against a published standard is how you supply it - and easier to hold than to explain why you do not.
What we assess
Five dimensions. Scored separately.
Each rated Low, Medium or High - because one overall grade hides the failing one.
- Governance - who owns it, what changed, who signed off
- Data - where it came from, and what bias it carries in
- Fairness - whether outcomes hold up across groups
- Security and compliance - manipulation, and the standards
- NIST AI RMF and ISO/IEC 42001 - AI governance
- EU AI Act - where the system is in its reach
- SOC 2 criteria and HIPAA - controls and health data
- India DPDP - personal data. Not all six reach a system.
Who iDharma is for
Teams that need to trust - and prove - their AI
Companies with AI in production
Teams whose systems are already making decisions and who need an independent read on how they are actually performing - not the read the team that built them would give you, however careful that team is. That question only has an answer in production, which is exactly where this audit looks.
Regulated industries
Health, finance and government, where HIPAA, the EU AI Act and sector rules all make proof non-optional. The obligations are yours whoever built the system, and evidence assembled afterwards is worth far less than evidence collected as you went. That gap is the one this work closes.
If it is not live, this is not it
An audit examines a system in operation. If yours is still being designed there is nothing to examine, and the honest answer is the AI Readiness Assessment instead. We would rather say so here than sell you the wrong engagement. Come back when it is running and there will be something to examine.
What most teams have
“We think our AI is fine.”
What a board can use
Evidence, measured against a published standard.
The difference between those two is the whole job.
- Who it is for
- Companies running AI
- Regulated industries
- Facing a board or regulator
- Enterprise sellers
- Investors & acquirers
The mission
Building the trust layer for enterprise AI
02
The AI economy is the largest technology shift in a generation, and most of what it has shipped is running unverified.
03
A published standard, an evidence-based method, and a report you can put in front of a board. Those three, and nothing mystical.
04
“We think our AI is fine” is not something anybody can hand to a regulator. Evidence is. That is the entire job.
Is this for you?
Three questions. Then you’ll know.
No email. No signup. It can tell you an audit is the wrong call.
Opens in a panel. Close it any time - your answers are kept.
EU AI Act
Your scope check
The calendar
Four moments, and two have already passed.
Two of these are live obligations today and two are still ahead - so they cannot be planned as one deadline, and the documentation runs longest.
-
Scope
Before anythingWhat is in, what is out, and what it costs - agreed with you and approved by you before a charge exists.
-
Evidence
While it runsWe ask for what the work needs and nothing beyond it. What you send is used for this audit and nothing else.
-
Review
Before you see itEvery finding rated against a published rubric and cross-checked, so none of it rests on one reviewer.
-
Report
At the endRatings, findings with their evidence, and what to fix first - written to be handed to somebody else.
The trap
Teams plan for December 2027 and forget that Article 50 is already in force. If your product talks to people or generates media, the disclosure duty applied from August 2026 - two winters before the date on the plan.
Requirement & coverage
What the Act says, what we ship
12 obligations, and the artefact that discharges each one. Paired, so every claim on this page can be checked against the requirement beside it.
- Independent We build, resell and operate no AI systems
- No product line to protect and no fee tied to what an audit finds - which is what makes a finding worth reading.
- Standards-based A published methodology, not a house view
- The rubric is on the Verification Methodology page. A finding names the clause it rests on, so you can check it against the standard.
- Five dimensions Governance, data, fairness, security, compliance
- Each scored Low, Medium or High, separately. One overall grade would hide the dimension that is actually failing.
- Six standards mapped NIST AI RMF, ISO 42001, EU AI Act, SOC 2, HIPAA, DPDP
- Every finding cross-referenced to each standard it touches, so one engagement answers several audiences.
- Evidence-led Documentation, lineage, logs, prior assessments
- We ask for what the work needs and test where access allows. A vendor's own report is evidence we assess, not evidence we accept.
- Cross-checked No finding rests on one reviewer
- Ratings are made against the published rubric and reviewed against the mapped standards before the draft reaches you.
- Actionable Prioritised by consequence, not by ease
- A rating per dimension, findings with their evidence, and a roadmap that says what to fix first and why that one.
- Honest pricing Fixed-scope tiers, published
- Scope and price agreed with you up front, and nothing charged until you approve them. The tiers are on the pricing page.
- Not a certification And we do not issue one
- An audit informs your decisions. It is not a certificate, and anyone offering you one for AI is offering something they cannot back.
- Not legal advice Nor a legal opinion
- We map findings to standards and to the Act where it applies. What that means for your liability is a question for your counsel.
- Not a guarantee A system can pass and still fail later
- An audit is a point-in-time assessment of the system as scoped. A material change is a different system, and we say so.
- Figures are illustrative Turnaround and starting price vary
- Every number on this page describes a typical engagement. Yours is quoted against your own scope before you commit to it.
The engagement
Your AI estate, independently read
From model providers to everyday deployers.
-
Scope
Systems, dimensions and depth, agreed with you. You approve it before anything is charged.
-
Evidence
Documentation, data lineage, model cards, logs, and whatever prior assessments already exist.
-
Testing
Where access allows: bias and fairness tests, adversarial and prompt-injection checks, control verification.
-
Review
Rated against a published rubric and cross-checked against the mapped standards, not one reviewer's opinion.
-
Report
A rating per dimension, findings with their evidence, and a remediation roadmap - in that order.
Struck in your favour
Why teams choose iDharma to read the Act with them
Independent
A reviewer who did not build your AI assesses it. That is what makes the report defensible.
Standards-based
Measured against a published methodology mapped to six standards - not against a vendor's say-so.
Actionable
Risks, compliance gaps and a fix-first roadmap. A prioritised list, not a wall of jargon.
Honest pricing
Fixed-scope tiers, scoped with you, and no payment until you approve what it covers.
Four marks, struck on every report.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you buy.
The audit report
The full assessment in one document: a rating for each of the five dimensions, every finding with the evidence behind it and the standard it maps to, and a remediation roadmap ordered by consequence - written in plain language rather than in the vocabulary of six different frameworks.
Dimension ratings
Governance, data, fairness, security and compliance, each rated Low, Medium or High against the published rubric rather than against a house view.
Standards mapping
Every finding cross-referenced to each of the six standards it touches, so one engagement answers several audiences without being rerun.
Evidence appendix
What each finding rests on - the document, the log, the test result - so a reader can check the conclusion rather than take it on trust.
Remediation roadmap
What to fix first and why that one, ordered by consequence rather than by which change happens to be the cheapest to ship.
Scope record
What was examined, what was not, and why each call was made. The boundary of an assessment is part of what the assessment says.
Walkthrough
A live session on the findings, plus fourteen business days of written follow-up. A report nobody explains is a report nobody acts on.
Format & fee
Real numbers, upfront.
- Scope
- Set by the Act, not by us
- Input
- Your systems and what exists on them
- Re-read
- Annually, or on modification - $0 against your known baseline
The Act fixed the scope, not us, so the fee is flat - nothing to meter, no hourly rate, and nothing is charged until you have approved it.
Request your scan
EU AI Act · Compliance scan
$0 flat
- Independent classification report
- System register, tier by tier
- Article 50 notice text, ready to post
- Annex IV gap list included
Show your hand
Four things you have to be able to produce
The Act is not graded on intent. Each of these is either in your hand on the day an authority asks, or it is not.
The rating,
per dimension
Governance, data, fairness, security and compliance scored separately. One overall grade is the number that hides whichever dimension is actually in trouble.
The finding,
evidenced
Every finding carries the evidence it rests on and the clause it maps to, both ways. A finding you cannot check for yourself is only an opinion with a rating attached.
The roadmap,
ordered
What to fix first, and why that one before all the others. Ranked by consequence rather than by which change happens to be the easiest to ship before quarter end.
The report,
handable
Written to be given to a board, an enterprise buyer or a regulator without a translation layer in between. It is yours, and we do not publish it or name you anywhere.
Four cards, and the date on each one is part of the card.
FAQ
Plain answers
Scope, timing, and the cost of getting it wrong. Answered straight.
Request your scanWhat is iDharma, in one paragraph?
An independent AI audit company. We assess AI systems that organisations already run - across governance, data, fairness, security and compliance - against a published standard, and hand back a report they can act on and defend.
Is an iDharma audit a certification?
No. It informs your decisions. It is not a certification, a legal opinion, or a guarantee that a system is safe or compliant - and anyone offering you one of those for AI is offering something they cannot back.
How long does it take, and what does it cost?
One to four weeks from approved scope for a typical engagement, on fixed-scope tiers quoted before you commit. Nothing is charged until you approve the scope, and both figures vary by system.
Our AI is not live yet. Can you audit it?
Not usefully. An audit examines a system in operation, and there is nothing to examine before there is one. The AI Readiness Assessment is the right engagement at that stage.
Get started
Request your compliance scan
Tell us about your AI systems and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this is a folder someone can assemble in an afternoon, and we name every document first, in writing, before you commit.
- Which AI systems you build or use, and what each decides
- Whether any of it is on the EU market or used there
- Any documentation - model cards, contracts, DPIAs
- Whether you built the system, bought it, or modified one
- Your target readiness date, if you have one
What happens next
- You send the five items we need.
- You get a scoping call within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
Where this page gets its facts
Where the claims on this page come from, and what they are worth - stated, not assumed.
What it is drawn from
- Regulation (EU) 2024/1689 - the AI Act
- Digital Omnibus deferral, Annexes I-IV
- Effective
- 1 January 2023
- Enforced from
- 5 July 2023
What it means
- General information about what the law requires - not legal advice, and no professional relationship arises from reading it. It determines nothing about your own systems.
- Where a scope question is arguable, our reports say so rather than the convenient one.
Scope & limitation
- Do not rest a binding decision on it; engage qualified counsel.
- It covers the EU AI Act alone - GDPR and sectoral rules can reach the same system.
- Use it as a starting point for a scoping conversation, not as your final word.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
ISO/IEC 42001, SOC 2 and NIST AI RMF: Which One Your Buyer Is Actually Asking For
One certifies an organisation, one is an opinion about controls over a window, one is a method with nothing to issue. What each covers — and what none of them answers.
