Ready When theExaminer Asks.
Prodigium helps US companies govern the AI they use and the cyber risk they carry, and prove both are under control to examiners, regulators, customers and boards. It starts with a four-week assessment: what you have, which rules apply and what to fix first.
Three WaysWe Help
Govern the AI your company uses and the cyber risk it carries, with the evidence kept in one place.
- Inventory every AI tool, feature and model
- Risk tiers matched to industry and state rules
- Policy, approvals and human oversight
- Evidence for examiners and customers
Built on the NIST AI RMF and ISO/IEC 42001
- Program assessment against NIST CSF 2.0
- Board reporting and SEC disclosure readiness
- Incident reporting playbooks for every clock you face
- Fractional CISO advisory and CMMC readiness
Built on the NIST Cybersecurity Framework 2.0
- One register for AI systems and cyber controls
- Owners, risk tiers and review dates
- Evidence linked to every control
- Board-ready reporting
AI Is Already at Workin Every Industry
It screens applicants, triages claims, suggests diagnoses and writes code. Each use answers to a different rule.
- HospitalClinical decision toolSection 1557
- BankCredit modelBank model risk guidance
- InsurerClaims AINAIC AI bulletin
- EmployerHiring AIIllinois HB 3773
- Government contractorCode assistantCMMC
- RetailerCustomer chatbotState consumer AI laws
Illustrative. The rules shown are examples; most companies answer to several at once.
Healthcare andthe Public Sector First
We focus on healthcare and on state and local government and education: AI is arriving fast, the data is sensitive and the public is watching. The method is the same everywhere: the NIST AI Risk Management Framework and the NIST Cybersecurity Framework 2.0, plus the rules your organization answers to.
- HIPAA Security Rule for every AI tool that touches patient data
- Section 1557 rules on patient care decision tools
- AI scribes, triage and coding tools reviewed before rollout
- State rules on AI in patient communications
AI is reaching clinics faster than the policies that govern it
- State AI laws for public agencies, such as AI inventories and telling people when they're dealing with AI
- CJIS Security Policy for police and courts, full compliance by October 1, 2027
- FTC Safeguards Rule for colleges that take federal student aid
- FERPA for student records in AI and ed-tech tools
Agencies and schools must show their AI use is safe, fair and disclosed
We also work with
- Financial servicesNYDFS Part 500, bank model risk guidanceAI and cyber review
- InsuranceNAIC AI bulletin, NYDFS Part 500Written AI program
- Public companiesSEC cyber disclosure in four business daysDisclosure readiness
- EmployersHiring AI laws in four jurisdictionsHiring AI review
- Government contractorsCMMC from November 10, 2026CMMC and AI readiness
- Critical infrastructureCIRCIA 72-hour incident reportingReporting playbook
- Technology and AI vendorsCustomer reviews, ISO/IEC 42001Customer trust pack
- Retail and othersState AI and privacy lawsReadiness assessment
- Not sure which apply?Most companies answer to severalBook a free call
The Clocks AreAlready Running
Reporting deadlines and rule dates now apply to AI and cyber alike.
Read this week's AI and cyber governance update or the AI rules, industry by industry.
One Partner forEvery Stage
From the first inventory to an audit-ready program, for AI and cyber alike.
Discover
Find every AI use and map your cyber controls
Assess
Rate each against the rules that apply
Build
Policies, approvals, controls and playbooks
Prove
The evidence examiners and customers ask for
Sustain
Monthly review of new AI, threats and rules
Findings inPlain English
Every AI use gets one entry in your AI register: who owns it, what data it touches, the rules that apply and what is missing. Leadership can act without reading the regulation.
The vendor's model scores applicants for roles in Illinois, Colorado and California. Two required controls are missing and the contract gives no right to see the vendor's testing.
| Control | Status | Why it matters |
|---|---|---|
| Business owner named | In place | VP, Talent Acquisition |
| Notice that AI is used | Missing | Illinois HB 3773 |
| Bias test across groups | Not run | Discrimination risk |
| Vendor audit rights | Not in contract | Renewal in 60 days |
| Human review of rejections | In place | California and Colorado, 2027 |
Illustrative example, not a real client.
Clear Answersin Four Weeks
Most clients start with a four-week assessment. It ends with a ranked fix list and a plan.
Kickoff and interviews
Leadership, IT, security and the teams that use AI most; a short staff survey
Discovery
Sign-in and network records, vendor AI features, security controls
Risk tiers and gaps
Each AI use and cyber control rated against your rules
Report and readout
Register, gap report, ranked fix list and a leadership briefing
Start Small.Scale With You.
The same services for AI and cyber, in every industry. Only the rules inside change.
- Inventory of AI tools and cyber controls
- Risk tiers and NIST CSF 2.0 maturity
- Gap report against your rules
- Ranked fix list and readout
- AI and cyber policies and owners
- Approval process for new AI
- Incident response and reporting playbooks
- Training and audit documents
- Board and committee reporting
- Review of new AI uses and vendors
- Answers customer questionnaires
- Tracks rule changes for you
Where AI and cyber risk sit in your company, what the rules require and what to do first.
Testing, documentation and human oversight for one high-impact system.
Catch the AI your vendors switch on through routine updates and terms changes, re-tiered against your rules each month.
Your AI scribe or triage tool tested with synthetic patients for fairness, accuracy, privacy and AI disclosure.
One Place forthe Evidence
The Prodigium Platform brings AI systems, cyber controls, owners, approvals and evidence into one register, so the work we do together stays current after we leave. It is in early access, and early clients help shape it.
- In the demo todayThe rules that apply to your company, each with its source; an AI register with risk tiers; controls with owners, due dates and linked evidence; your NIST CSF 2.0 cyber program; a change history; a board report.
- Next, for early-access clientsHosted accounts for your team, evidence file uploads and reminders before reviews are due.
- PlannedAlerts when a vendor adds AI or changes how it uses your data, and scheduled retesting of clinical AI tools after each vendor model update.
Cyber Depth.Hands-On AI.
Prodigium is led by a cybersecurity and AI executive with more than 15 years running cyber, risk and AI programs for large, highly regulated organizations.
- Cyber and AI program leadershipBuilt and ran cybersecurity, cloud and AI strategy at enterprise scale.
- Big 4 and global consultingDeloitte, KPMG, Accenture and Cisco: risk assessments and compliance programs for technology, healthcare and financial services clients.
- Trusted with boards and executivesBriefs senior leaders on cyber and AI risk; keynote speaker at more than 20 industry conferences.
- Builds AI, not only policyProdigium builds and runs production AI under the same controls it recommends.
Speaking on AIand Governance
Keynotes, panels and executive briefings on governing AI and cyber risk, in plain English and grounded in the rules that apply now. More than 20 industry conference keynotes to date.
Upcoming
- Cyber ResilienceGovExec · November 17, 2026
- Orbit Tech (DACIE) 2026Digital, AI and emerging tech summit, Berlin · November 18–21, 2026
- Cyber Resilience at ATARC's CIO & Executive Leadership SummitGovExec and ATARC · Reston, Virginia · December 10, 2026
- PMWC 2027 Silicon ValleyPrecision Medicine World Conference · Santa Clara, California · January 27–29, 2027
- 2027 National Small Business ConferenceNational 8(a) Association · New Orleans, Louisiana · February 1–3, 2027
- AIFOD Nairobi Summit 2027United Nations Office at Nairobi, Kenya · February 17–19, 2027
Recent talks
- AI for Developing Countries Forum (AIFOD), Geneva SummitPalais des Nations, Geneva · August 2026
- AIFOD Bangkok SummitUnited Nations Conference Centre, Bangkok · February 2026
- Cyber Resilience at Scale: Rethinking Endpoint Management in the AI EraGovExec webcast for government and education leaders · on demand
- Ready when the examiner asksWhat examiners, auditors and customers now expect to see for AI and cyber risk, and how to build the evidence before they ask.
- The clocks are already runningSEC, CIRCIA, HIPAA and state incident reporting deadlines, and what a board must decide in the first hours.
- Who governs the scan?Biometric patient identification in healthcare: consent, California's medical privacy rules and the state laws that reach hospitals.
- AI in the public sectorAI inventories, disclosure and trust for state and local government and education.
- Governing the AI you didn't buildVendor and third-party AI risk: contracts, training on your data and evidence you can rely on.
- FormatsConference keynotes and panels, association and industry events, board and leadership briefings, and hands-on workshops.
Insights forAI and Cyber Leaders
A weekly update on the rules that changed, plus plain-English guides for the people who have to act on them.
CIRCIA reaches the White House, the HIPAA Security Rule slips to 2027, and the SEC cyber rules stay in force.
Read this week's update Governing biometric patient identificationPalm vein and fingerprint check-in in California and beyond: the legal map, a governance model, a 90-day plan and vendor questions.
Read the white paper AI scribes and HIPAA: six questions before you signBAAs, training on patient data, accuracy, consent to recording, Section 1557 and security.
Read the articleBook a 30-MinuteExposure Call
No cost and no obligation. You leave the call knowing:
- Which AI and cyber rules apply to your company, and when
- Where your biggest AI and cyber exposure is likely to be
- Whether an assessment makes sense, and what it would cover
info@prodigiumllc.com
Email us to book a callTell us your industry and the states you operate in.