Applied Oversight

The AI Exposure Scan

The AI Exposure Scan: free, cited, one page.

Ten minutes of questions about where you operate and how you use AI, including the AI hiding inside your vendor software. Within two business days you'll receive your Exposure Snapshot: the jurisdictions that reach you, every triggered obligation with its statute citation, your compliance calendar, and the single next step we'd take in your shoes.

What we check

  • State AI laws.
  • The EU AI Act's three paths to US companies, including the output-used-in-the-EU catch-all most advisors miss.
  • Federal sectoral law that never went away: EEOC, ECOA/FCRA, HIPAA, FHA, FTC.
  • Public-sector and government-contractor rules: federal agency AI-use and procurement duties, Section 508, and government contract terms.
  • Whether customizing a vendor's AI quietly made you a "provider" with a much heavier rulebook.

What you get

  • A one-page snapshot, urgency-ranked (live now / within 12 months / ahead), with the full cited detail behind it.
  • Every obligation cited to its legal source.
  • The evidence a regulator would ask you to produce.
  • No obligation, no sales pressure. The snapshot is yours.

See a complete sample snapshot →

Request your scan

The more precisely you answer, the sharper your snapshot. "Not sure" is always an acceptable answer; that's what the scan is for.

A · You and your organization

A few capacities switch on whole lanes of obligations. They're additive: each one turns a lane on without turning any others off, and most organizations answer "No" to the three government questions (a private company is carried by the questions below). If a grant, subcontract, or flow-down might make you a contractor and you're not certain, "Not sure" keeps that lane visible as conditional so it's never dropped.

Are you a US federal agency?
Are you a state or local government body?
Are you a vendor or contractor to a government?

A US federal agency usually isn't also a vendor to government or a state/local body; those describe different organizations. An agency is part of the government; a vendor sells to it. If you're a government corporation (e.g. USPS, TVA) or a contractor-operated entity, check the capacities that truly apply; if you're unsure, "Not sure" is the right answer.

If you contract with a government: are you specifically a contractor to the US Department of Defense?

Skip if you answered "No" to the contractor question above. The FY2026 NDAA covered-AI ban (DeepSeek / High Flyer) binds DoD contractors specifically.

Are you a regulated insurer or health-benefit plan?

Insurance-department AI rules and guidance (Colorado's regulation and New York's DFS guidance) apply specifically to licensed insurers and health plans. A company that merely touches insurance data usually isn't covered. If your insurance role is unusual and you're not certain it counts, "Not sure" keeps it visible as conditional so it's never dropped.

Are you a supervised banking organization (a bank, thrift, or their holding company)?

Federal model-risk guidance (SR 26-2) sets supervisory expectations for supervised banking organizations, most directly those over $30B in assets. A fintech or retailer that merely offers credit is generally not one, but if you're unsure, "Not sure" keeps it visible as conditional.

Where do decisions made with AI reach people? (select every one that applies)
Select every area where AI helps make or inform decisions about individuals.

"Essential / government services" means AI that helps decide a person's access to public benefits (like Medicaid, unemployment, or housing assistance), essential utilities, emergency services, or services from public-service providers such as hospitals and schools.

Do you provide healthcare services or treatment?
Does your business meet a CCPA threshold?

You likely qualify if you're a for-profit business doing business in or selling to California, and any one of these is true:

  • Over $25M in total annual revenue (all sources, including revenue earned outside California)
  • You buy, sell, or share the personal information of 100,000+ California residents or households in a year
  • 50% or more of your revenue comes from selling or sharing personal information

This is about doing business in or selling to California; being headquartered elsewhere doesn't get you out of it. A company based anywhere can qualify if it reaches California residents. If you're not certain, "Not sure" is the right answer, and we'll show you how to confirm it.

Which compliance programs do you already run? (shapes how we'd build on what you have)

B · EU connection

The EU AI Act reaches US companies three ways. The third is the one everyone misses.

Do you have an establishment, subsidiary, or staff in the EU?
Do you use AI to serve, screen, or make decisions about people located in the EU (customers, users, or job candidates)?
Could the output of any AI system you use be used in the EU (reports, scores, or screening results consumed by an EU office, client, or partner)?
Do you place any AI system on the EU market under your own name?

C · Your AI systems

Whether you count as a "deployer" (or have quietly become a "provider") depends on what you did to the tools you use.

For the AI tools you use (including AI features inside vendor software), how did you get or build each one? (select all that apply)
Does AI output substantially assist or replace human decisions, or is it advisory only?
Do you control or curate the data fed into these systems (e.g., the résumés, applications, or records)?

D · Specific uses

These switch specific obligations on or off.

Do customers or the public interact with chatbots or AI-generated content you deploy?
If customers interact with a chatbot: is it companion-style or emotional-support (open-ended conversation) instead of customer-service or transactional?

Skip if you answered "No" above. Colorado's Chatbot Safety Act reaches companion / open-ended public bots; customer-service and transactional bots are expressly excluded. This is a common judgment call, so "Not sure" keeps the companion duties visible as conditional and never silently dropped.

Do you use AI for workplace monitoring, emotion recognition, or biometric identification/categorization?
Do you use AI in credit scoring, or life/health insurance risk assessment or pricing?
Could any AI use plausibly involve intentional manipulation toward harm, intentional discrimination, or sexual deepfakes? (Almost always "no," but Texas requires the screen to be asked.)

The scan is an informational applicability screen based on our verified obligation registry. It is not legal advice and not a substitute for per-system legal review.