EngagementsFixed-scope & retainerRegulated AI

Four ways to start.

Four engagements, scoped around outcomes and your effort rather than hours, and advisory hours for a single question that needs no engagement. Each one reduces a different risk: not knowing where you stand, reaching 1 May 2027 without the records OSFI E-23 asks for, building the wrong architecture, or operating a system no one is governing. The flagship is the AI Governance Teardown, a two-week, fixed-fee, MESA-scored examination delivered board-ready. The Teardown, the Sprint and the Retainer are the concrete entry points to the AI-Native Enterprise Accelerator.

§ 01The engagements
01 · The flagship · Fixed fee

The AI Governance Teardown

Fixed feeShared on the Fit Call
Two weeks · fixed fee · readout on Day 10

A MESA-scored, evidence-required examination of how you govern your AI, delivered board-ready, so you can answer the regulator before the regulator asks.

  • The Governance Gap Report, a MESA-scored findings register where every finding traces to evidence.
  • The Remediation Roadmap, sequenced Now, Next, and Later with owners and effort bands.
  • A one-hour findings readout for your executive team on Day 10.
  • A one-page board summary a director can absorb in ninety seconds.
  • Scored against a fifty-question MESA instrument across the four layers; no production data leaves your environment.

Best forRegulated institutions with AI in or near production and a real obligation to answer for it: banks, insurers, fintechs, healthcare providers, and public-sector bodies. The land in the engagement ladder, conducted by the person who wrote the frameworks it uses.

MESA Self-AssessmentSix-pillar MRMFive-Gate ModelAI Vendor Risk FrameworkAIRP14-framework crosswalk
02 · Design · Fixed fee

Regulated AI Architecture Sprint

Fixed feeShared on the Fit Call
4 to 6 weeks · fixed fee · design & handoff

Design the target architecture for LLMs, agents, RAG, observability, and the compliance controls, so a team moves from experiment to production without building it twice.

  • A current-state and target-state architecture review.
  • An LLM routing and model-selection strategy, the NexusCore gateway pattern.
  • Agent orchestration and workflow design, the planner-executor-verifier-generator pattern.
  • A security, logging, auditability, and observability blueprint.
  • An implementation backlog and a clean engineering handoff.

Best forCTOs, product leaders, and platform teams that already know what they want to build and need a sound technical and governance design before they commit. Both strategic and concrete, so the technical value is visible without a full transformation program.

NexusCore routingPEVG agentsAgentic RAGEvidence-grade observabilityPolicy-as-code
03 · Ongoing · Monthly retainer

Enterprise AI Advisory Retainer

MonthlyShared on the Fit Call
Three-month terms · renewable monthly or quarterly

Executive-level guidance and oversight as you operationalize AI: a senior architect in the room for the decisions that are expensive to get wrong.

  • Monthly executive advisory calls.
  • Architecture and governance reviews on live initiatives.
  • Priority support on vendor, model, and policy decisions.
  • Review of AI roadmaps, initiatives, and risks.
  • Optional participation in steering committees or working groups.

Best forEnterprises running multiple AI initiatives, or internal teams that want a fractional Chief AI Officer rather than a full-time hire. The relationship that keeps a governed platform governed after launch.

Fractional Chief AI OfficerVendor & model reviewPARA operationsGovernance oversight
04 · OSFI E-23 · Fixed fee

E-23 Readiness Review

Fixed feeShared on the Fit Call
Three weeks · fixed fee · remote, with one day on site

Your model risk framework read against OSFI Guideline E-23, two or three of your own systems tested against the handbook’s five artifacts, and a dated gap plan to 1 May 2027, when E-23 takes effect.

  • A dated gap plan to 1 May 2027, every gap with one owner and one date, in dependency order.
  • Artifact status for the sampled systems: which of the five artifacts exist, which exist in name only, and which are missing.
  • A one-page board summary, readable by a director who saw nothing else.
  • Your own answers beside the evidence, if you took the free E-23 readiness check first.

Best forFederally regulated financial institutions in Canada with AI or vendor models in the inventory and 1 May 2027 on the calendar. It is the readiness assessment named at the back of OSFI E-23 for AI Systems, delivered personally, not staffed to a bench.

OSFI E-23Five-Gate ModelMESA altitudesBOE DeclarationAI Vendor Risk Framework
05 · Entry · Published rate

Advisory hours

Per hourCAD 450
Booked in one-hour blocks against a named question · no prior engagement required

One decision, answered by the person who wrote the frameworks the other four engagements use. Not an examination and not a relationship: an hour of judgment, where an hour of judgment is what the problem actually needs.

  • A question you can state in a paragraph, sent ahead so the hour starts with the answer rather than the context.
  • A live call with you and whoever else needs to hear it first-hand.
  • A written summary of what was said and what it implies, inside two working days, so the decision has a record.
  • No report, no roadmap, no scoring. If the answer turns out to need one, you will be told that on the call rather than sold it afterwards.

Best forA design review before it ships, a second read on a question a regulator has asked, or a sanity check on an architecture that is already half built. It is also the honest entry point for anyone who is not ready to commission a Teardown and should not be pushed into one.

Why this one has a number on itThis is the only published price on the site, and the reason is narrow: an hour has no scope to negotiate. The Teardown, the E-23 Readiness Review, the Sprint and the retainer are quoted against work that does not exist yet, so any number posted next to them would be a number nobody could stand behind. That is not true of an hour.

MESAFive-Gate ModelPEVG agentsModel riskJurisdictional tables
In the GCC

Every engagement above is available to institutions in Saudi Arabia and across the GCC: delivered on site or remotely, in English or Arabic, and contracted through iSystematic Inc. The Teardown reads governance artifacts, not customer records, so no production data leaves your environment. SAMA, CBUAE, SDAIA, DIFC, ADGM, QCB and AAOIFI are mapped as distinct regimes in the published Enterprise Playbook. The booking calendar runs on Central Time, so for a call inside the Gulf working day, write first and an early slot is arranged.

§ 02How the fee works

One published number, and four that are not.

Advisory hours are CAD 450 an hour, booked in one-hour blocks, and that number is on the page because an hour is a unit that cannot be argued about. The other four are scoped against your data residency, your regulators and your risk appetite, and the fee is shared on the free Fit Call once that scope exists.

Fixed fees

The Teardown, the E-23 Readiness Review and the Architecture Sprint are quoted as fixed fees, because project-based pricing is the honest way to price clearly scoped examination and design work. You know the cost before it starts.

Monthly retainer

The Advisory Retainer is a monthly fee with a three-month term, because ongoing oversight is a relationship, not a deliverable. Renewable monthly or quarterly. It follows a delivered Teardown rather than starting cold: a retainer keeps a governance posture current, so there has to be an examined posture to keep current first.

Hourly, in one place only

Programs are not billed by the hour: a fixed-scope package serves a regulated initiative better and protects both sides from low-value task work. Advisory hours are the deliberate exception, for the case where the problem really is one question, and they are capped at what they are rather than growing into an undeclared project.

Shared on the call

For the four scoped engagements, rather than post a number that fits no one, the fee is shared on the Fit Call once the scope is clear. The Fit Call is free, thirty minutes, and qualifies the work in both directions: if what you need is a validation vendor rather than an architect, you will be told so on the call.

§ 03One path, three entry points

The AI-Native Enterprise Accelerator.

The Teardown, the Sprint and the Retainer are entry points to one structured path, delivered through iSystematic. You can start anywhere and stop at any stage.

Assess
The AI Governance Teardown scores your governance against the MESA Framework and locates the gaps a regulator would find first.
Template & Implement
The Architecture Sprint adapts the controls to your stack, your residency boundaries, and your obligations, then hands engineering a backlog to build.
Operate
The Advisory Retainer keeps the governed control plane governed: oversight, reviews, and senior judgment as the platform grows.
§ 04Start
Begin with a conversation

The right engagement depends on where you are. Book a 30-minute call and we will scope it together, or send a note describing the AI you are putting into production and the obligations it has to meet. Engagements run as fixed-scope work or an advisory retainer, delivered through iSystematic.

Book a consultation · Start a conversation · Read the published playbook

RelatedAcross this practice
§ 05Ask an assistantLive, no key

Ask your AI assistant instead.

This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is identify_relevant_service, list_consultation_slots and book_consultation, which map a described problem to an engagement shape, read real availability, and book a real 30 minute conversation. Booking writes to a real calendar and emails the attendee, so confirm the time with the person first.

01 · Connect
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcp

Claude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client and every tool, in its own words; each call is logged by tool, outcome and duration only, never with what you asked.

02 · Ask

“Using Concylium, here is my situation: we have put an LLM into a regulated decision and our regulator has started asking questions. Work out which engagement shape fits and why, then show me real availability.”

It routes to a shape and shows the reasoning, so you can disagree with it. It reads live availability and can book a real conversation. It cannot agree a fee or a scope.

Fin · Engagements