1. Initial contact
Provide a concise summary of the issue, affected business unit, time sensitivity and the outcome you need. This can be a board question, regulator request, incident, diligence need or implementation decision.
SERVICES / DAVIS & ASSOCIATES ADVISORY, LLC
Senior judgment.
Work you can put into practice.
Start with the decision your organization needs to make. I help identify the exposure, define who owns it, organize the evidence and turn priorities into an executable plan.
Begin with a short introductory message: the business decision, jurisdiction, sector, operating problem, incident, transaction or regulatory question you need to address. Sensitive material should be shared only after scope, communication preferences and any necessary engagement terms are confirmed.
Services are scoped by written agreement. Prices are quoted after scoping; no checkout or recurring billing is enabled. Specialist legal, tax, assurance and managed-security services require the appropriate engagement and provider.
2. Scoping and fit
I review the issue, identify likely workstreams, confirm whether the matter fits the advisory model and clarify which disciplines are implicated: legal, cybersecurity, privacy, operations, resilience or evidence.
3. Formal engagement
Following agreement on scope and engagement terms, appropriate arrangements can be established for further materials. Detailed or sensitive documents are not requested through the public contact form.
SPECIALIST PRACTICES / GOVERNANCE & EVIDENCE
When the explanation has to stand up.
From the examination room to the courtroom: senior, hands-on judgment at the intersection of cybersecurity, AI governance and defensible evidence.
REGULATOR-FACING SPECIALIST
CISO-led AI governance.
Built for examination.
AI governance has a security function that needs a named owner. I bring a sitting CISO’s perspective to making that responsibility operational.
At RiteCheck, an NYDFS-regulated financial services business, I serve as Chief Information Security Officer. I bring that operating perspective to AI governance: define the risk, assign responsibility, test the control and organize the evidence so an examiner can follow it.
The CISO leads AI-related cybersecurity risk. Legal, compliance, privacy and business owners retain their respective responsibilities; board oversight remains essential. This is shared accountability with a clear security owner, not a claim that every AI obligation belongs exclusively to the CISO.
NYDFS’s AI cybersecurity guidance applies the existing Part 500 framework to AI-related cyber risks; it does not create a separate AI certification. Applicability and exemptions must be assessed for the entity.
“Examiners will be human long after analysts aren’t.”
Richard E. Davis · A working premise for accountable governance
| The question | Engagement deliverable | What leadership can use |
|---|---|---|
| What AI is in use, and who owns its risks? | AI and vendor inventory; risk assessment; decision-rights and ownership matrix; applicable Part 500 control mapping. | A documented scope and named accountability, including material exceptions. |
| Do the controls operate as described? | Control-to-evidence register; targeted testing; supplier assurance review; AI DDR telemetry and evidence-coverage design. | Test results, source provenance and explicit coverage limitations rather than policy assertions alone. |
| Can management answer and act? | Examiner-response support; indexed evidence package; CISO and board reporting; remediation tracker and response rehearsal. | A coherent account of the risk, control, result and corrective action, with responsible owners. |
For: CISOs, compliance officers, general counsel, boards and NYDFS-regulated organizations. Engagement: readiness review, examination support or ongoing advisory. No examination outcome or regulatory endorsement is promised.
Discuss examination readiness ↗AI INCIDENT EXPERT WITNESS & LITIGATION SUPPORT
Explain what the agent did.
Show what the evidence proves.
When an AI-enabled process causes loss, a fluent account of events is not enough. Counsel needs an independent technical reconstruction that can be examined, challenged and explained.
I translate agent spans, tool calls, delegated identities, policy decisions and downstream records into a comprehensible account of system behavior. The analysis distinguishes the agent’s narration from independent evidence, and an observed sequence from a supported conclusion about cause.
AI DDR — AI Deviation Detection and Response — supplies the investigative frame: compare approved authority with observed behavior, identify control failures and preserve the evidence behind each finding. A trace ID links observations; it does not, by itself, authenticate a person or prove an outcome.
Expert opinions remain independent of the retaining party’s desired result. Alternative explanations, missing telemetry, sampling, clock uncertainty and limits on reproducibility belong in the analysis, not in a footnote after the conclusion.
| Workstream | What the work examines | Potential deliverable |
|---|---|---|
| Preservation & reconstruction | Model and tool versions; prompts where lawfully available; span context; identities; approvals; retrieval sources; original target-system logs and chain of custody. | Evidence inventory, preservation plan and a source-linked event chronology. |
| Authority, controls & causation | Approved scope versus executed actions; policy-gate and dispatcher records; access controls; evidence gaps; alternative explanations and downstream effects. | Reproducible technical analysis, control-failure assessment and clearly bounded opinions. |
| Reports, testimony & demonstratives | Technical issues within the agreed scope, with methods, assumptions and limits made explicit for the intended audience. | Consulting analysis or an expert report; deposition/trial support and testimony where retained and qualified. |
For: counsel, insurers, boards and investigators. Engagement: conflict check, written scope and agreed evidence access. Expert qualification and admissibility are case-specific and determined by the court; no outcome is guaranteed.
Discuss an expert engagement ↗Explore the method: inter-agentic threat atlas · harness telemetry to Elastic. The interactive resources are educational simulations, not evidence from a client matter. For the federal evidentiary framework, see the Federal Rules of Evidence, including Rule 702.
BROADER ADVISORY
Leadership across the operating program.
Specialist work connects to the full range of AI governance, cyber resilience and executive advisory services below.
Monthly retainer
vCISO & cyber resilience
Executive security leadership without adding a full-time CISO role.
- Who this helps
- Owners, CEOs and CFOs of growing organizations
- What you receive
- A prioritized risk roadmap; accountable owners; leadership reporting; oversight of IT and security suppliers.
- How the work proceeds
- Assess business priorities, operating controls and dependencies; establish a practical cadence for decisions and remediation.
Strategy and oversight; 24/7 monitoring and hands-on remediation require separate scope.
Discuss this engagement ↗Project or retainer
AI governance & safe adoption
Move useful AI into operation with clear authority, testing and oversight.
- Who this helps
- CEOs, GCs, CIOs, risk leaders and AI sponsors
- What you receive
- AI/use-case inventory; decision-rights model; risk tiers; approval workflow; monitoring and evaluation plan.
- How the work proceeds
- Assess the complete AI-enabled process, including vendors, data, permissions, tools, people and downstream actions.
Illustrative 4-6 week planning scope; dependent on systems, access and stakeholders.
Discuss this engagement ↗Project
Regulatory readiness & evidence
Understand which questions to resolve and assemble evidence that supports a defensible response.
- Who this helps
- Compliance, legal, audit and executive teams
- What you receive
- Entity/activity/jurisdiction scoping; obligation-to-control mapping; gap register; evidence plan and remediation priorities.
- How the work proceeds
- Translate applicable requirements into responsibilities and testable controls, working with jurisdiction-qualified counsel when needed.
Not a guarantee of compliance or a substitute for a jurisdiction-specific legal opinion.
Discuss this engagement ↗Project or retainer
Incident readiness & response coordination
Prepare leaders to contain disruption, preserve evidence and coordinate decisions under pressure.
- Who this helps
- Owners, operations, legal and security leaders
- What you receive
- Response playbooks; tabletop exercise; escalation roles; evidence-preservation plan; recovery priorities.
- How the work proceeds
- Test business and technical response together, including supplier failure and AI-enabled incident scenarios.
No emergency or 24/7 response service is implied without a separate agreement.
Discuss this engagement ↗Project or retainer
Data protection & privacy
Know what information matters, where it goes and who is accountable for its use.
- Who this helps
- Organizations handling customer, employee or sensitive business information
- What you receive
- Data map; classification and retention approach; vendor/data-flow review; privacy-control roadmap.
- How the work proceeds
- Connect business uses, access, retention, cross-border handling and incident evidence.
Local counsel and specialist tax/privacy advice may be required; no automatic DPO appointment.
Discuss this engagement ↗Project
AI monitoring & assurance evidence
Turn operating signals into evidence leaders can use.
- Who this helps
- CISOs, CIOs, engineering, internal audit and compliance
- What you receive
- Telemetry/evidence design; AI Harness review; detection use cases; coverage/retention requirements; reporting model.
- How the work proceeds
- Use OpenTelemetry and existing security platforms to connect authorized actions with observed outcomes and material exceptions.
Design/advisory scope; implementation, licensing and managed operations are separately agreed.
Discuss this engagement ↗Project or retainer
Supplier & supply-chain assurance
Understand the risk inherited from critical technology and business providers.
- Who this helps
- Procurement, operations, legal and security teams
- What you receive
- Critical supplier shortlist; due-diligence evidence assessment; dependency map; remediation and contract questions.
- How the work proceeds
- Review vendor controls, software/AI dependencies, incident duties and concentration exposure.
Assessments rely on available evidence; testing requires written authorization.
Discuss this engagement ↗Session
Board & executive briefing
A decision-focused session on the risk, choices and evidence leadership needs.
- Who this helps
- Boards, committees, executive teams and investors
- What you receive
- Pre-read; tailored briefing; management questions; decision/action record and follow-up priorities.
- How the work proceeds
- Frame cyber, AI and regulatory questions around operations, financial exposure, customers and accountable decisions.
Illustrative planning range; preparation and stakeholder scope to be agreed.
Discuss this engagement ↗Workshop
AI Harness workshop
See where a proposed AI action becomes a business consequence.
- Who this helps
- Leadership teams, process owners and delivery teams
- What you receive
- One workflow map; authority/evidence assessment; prioritized control tests and next-step brief.
- How the work proceeds
- Work through the 19-component model against a nominated business process; make assumptions and dependencies visible.
Educational/advisory workshop, not a production implementation or certification.
Discuss this engagement ↗Project or retainer
Cross-border governance advisory
Connect headquarters oversight with the obligations of the markets, data and operations you actually touch.
- Who this helps
- Businesses based in the US, Europe or Japan with cross-border activity
- What you receive
- Activity and jurisdiction map; operating responsibility model; prioritized technical/legal questions; coordinated work plan.
- How the work proceeds
- Bring cybersecurity, AI governance, privacy, supplier and operational considerations into one decision view.
Local licensed counsel, tax and invoicing specialists engaged where needed; language capacity confirmed in scope.
Discuss this engagement ↗Specialist research
Commissioned research and briefings
A source-linked research starting point tailored to the organization and its priorities.
- Who this helps
- Governance professionals and cross-functional teams
- What you receive
- Proposed curated reference access; topic/jurisdiction selections; dated review notes and agreed research briefings.
- How the work proceeds
- Define the organization profile, source scope, review cadence and permitted reuse before launching the service.
Bespoke research and update schedules are agreed separately. All published website resources are freely accessible.
Discuss this engagement ↗Davis & Associates Advisory, LLC · Professional advisory
Start with the decision you need to make.
Describe the challenge, business objective or assurance question. An introductory discussion can determine whether advisory services are a good fit.