Nobody in your building can answer that. On January 1, you have to answer it in writing.
The room where nobody could answer
Every compliance consultant is selling the answer sheet—the checklist, the policy template, the framework you fill in.
I sell the question.
Ask any of your teams where an automated system makes a decision about a person, who supplied that system, and where its training data came from. Watch what happens. The room gets quiet, someone volunteers to find out, and then nobody does.
That silence is the whole product. It is also, in about four months, a regulatory finding.
What lands January 1, 2027
California’s ADMT rules under the CCPA. Pre-use notice. Opt-out rights. Access rights. And a risk assessment that must be completed before you initiate the processing.
Colorado’s SB 26-189. Same date, same shape—pre-use notices, thirty-day adverse-outcome explanations, meaningful human review.
Both apply when an automated system makes a significant decision: finances, housing, education, employment, or healthcare.
Two clauses do most of the damage.
The assessment has to come before the processing. Your systems are already running. That cannot be fixed retroactively in January.
You cannot offload the liability to the vendor. If a tool you purchased discriminates, you are still the one who used it.
If you sell to companies in those categories, this reaches you anyway—through their procurement questionnaire rather than through the statute. The question arrives the same. You just get asked instead of audited.
On the record, from the people who built it
Anthropic’s own published risk report states that its task-based evaluations no longer capture increases in model capability.
The company that built the system says, in writing, with its logo on it, that it cannot fully characterize what the system does.
That is the foundation your compliance posture currently rests on.
If you have been trying to get a straight answer
You keep asking and keep getting fog. Everyone is helpful. Nobody knows.
That is not a gap in your understanding. The answer does not exist yet, because nobody ever built the record. Every company you assume is more sophisticated than yours is in exactly the same position—they simply have not been asked yet.
It was never you. The infrastructure was never built.
If you would rather be early than safe
Your competitors will produce this document in December, in a panic, because someone made them.
You can have it in October and use it. A company that can answer the provenance question inside a procurement conversation wins deals against companies that cannot. That advantage is widest right now, in the months before it becomes table stakes and stops being worth anything.
This is an acquisition, not a repair.
What it is
Three weeks. I map where automated decisions happen in your business, send four questions to your vendors, and hand you back what came of it.
| Price | $4,000 |
| Duration | Three weeks |
| Your time | Two people, ten business days |
| Scope | Five vendors, ten decision points |
For scale: penalties run $2,500 per violation, $7,500 if intentional. This costs less than two violations.
You get:
- A decision inventory—every place a system makes or shapes a decision about a person
- Provenance findings from four questions sent to your vendors, and the answers they actually give
- An exposure map
- The sequence: what to fix, in what order
- The posture paragraph you hand to procurement, legal, or a customer who asks
The scope is fixed—five vendors, ten touchpoints, two contacts, ten business days. It does not grow, which is why it finishes.
Who this is not for
If your AI writes marketing copy, drafts email, or makes images, you are not covered. Advertising is explicitly excluded from these rules.
Do not buy this. I would rather tell you now than on a call.
Before you book, answer these four questions
Not to me. To yourself.
- Where does an automated system make or influence a decision about a person in your business? Hiring, screening, lending, pricing, eligibility, scheduling, claims, admissions.
- Who supplied that system?
- Where did its training data come from?
- How does it account for bias?
If you answered all four without looking anything up, you have already done this work and you do not need me.
If you stalled on the third one, that is the finding. Book the call.
Or watch it happen to someone else first
Tuesday, September 22, 1:00 p.m. Central. I run this live on a real business, and the room watches them fail to answer.