Two days. One team. One model. The holes that line up.
Aviation does not audit paperwork to find out whether a fleet is safe. It puts a trained observer in the jumpseat on ordinary flights, under terms that mean nobody gets in trouble, and counts what nearly went wrong. The Safety Diagnostic does the same for the model you have already shipped.
One product team · One model in production · Two days on site · £12,000 fixed, plus VAT
Five layers. Most teams have two and believe they have four.
Each defence around a model has holes. Harm arrives when the holes line up. For each layer we ask the same four questions: is it real, who owns it, when did it last fire, and what happened when it did.
Evals
Is it real, who owns it, when did it last fire?
Guardrails
What do they block, and who has seen them refuse?
Human review
Is the person checking, or approving?
Monitoring
A dashboard somebody opens, or a dashboard?
Rollback
How long, who decides, when was it last rehearsed?
The week before.
An intake call to pick the model and the team. Access to the last three incidents or post-mortems, or the admission that there are none. The release process as practised, the monitoring, any guardrail configuration. Three 30-minute calls: the Head of Product, the lead engineer, and one junior engineer or domain reviewer. Non-jeopardy terms agreed in writing.
Day one: the system.
Morning: the layer map, walked live with the team. Afternoon: observe a release or review session if one is scheduled, otherwise reconstruct the last one with the people who ran it, and run a threat brief on the next release as a live exercise.
Day two: the culture.
Morning: six to eight confidential 25-minute conversations across seniority, three questions each. What has the model nearly done that nobody wrote down? What happened the last time someone raised one? What would you change if nobody could object? This is where the diagnostic earns its price; leadership never has this data. Afternoon: re-investigate one real incident with the three-question template, then a 60-minute readout. Top five findings, first impressions, no slides.
Within five working days.
- The five-layer map of your stack, with the aligned holes marked.
- The top five findings, ranked by severity and likelihood, each with the system change that closes it.
- A threat brief, filled in for your next release: three threats, three watchers, three actions.
- A near-miss channel designed for your team: where it lives, who reviews, how often, what gets counted.
- A one-paragraph just-culture statement drafted for the most senior signature on the team.
- A 90-day plan with owners.
Not compliance mapping against ISO 42001 or the EU AI Act. Not model evaluation. Not security testing. Those are the component, and good people already do them. The diagnostic is about the system around the component, and it is written so that it can sit beside their work without repeating it.
The Standing Review
Monthly · For teams that have had the diagnostic · From £8,000 a month · Three-month minimum
The part of a safety system that decays first is the review nobody owns. The Standing Review runs the near-miss channel the diagnostic designed: a monthly review of what was reported, report volume tracked as a health metric where rising is good, and incident investigation on call when something gets through.
Offered at the readout, not before, and only where the diagnostic found something worth standing behind.
Pick the model you worry about most.
Thirty minutes to choose the team and the model, agree the non-jeopardy terms, and fix the dates. If the diagnostic is the wrong tool for where you are, we will say so on the call.
Book an intake call →