CRA and AI Act compliance, audit and hardening of your product and AI systems. For teams that take their security seriously, without slowing down the product roadmap.
Cyber Resilience Act and AI Act roll out in parallel between August 2026 and December 2027. At every milestone, binding obligations. Without demonstrated compliance, no more placement on the EU market, no more updates to already-deployed products. The preparation window is closing.
Prompt injection, data leakage, model poisoning, shadow AI, vendor dependency. Attacks on AI systems don't show up in classic pentests. The cost of an incident exceeds the technical bill by a wide margin.
Your enterprise customer security questionnaires are getting longer. Your investors ask precise questions about AI governance. A credible roadmap has become a commercial prerequisite, not a bonus.
A complete journey, from exposure mapping to technical implementation. To calmly meet the September 2026 and December 2027 milestones.
For editors integrating AI in production (AI natives), as well as those consuming third-party AI services (Bedrock, OpenAI, Mistral, copilots, embedded chatbots).
20 minutes to understand your product, your stack, your regulatory exposure and the questions your customers or investors are already asking. We validate together whether the engagement makes sense, and at what scope.
In-depth review: code, infrastructure, AI pipelines, internal processes. Identification of gaps vs. CRA, AI Act and best practices. Prioritization by business criticality, not dogma.
Implementation of remediations, directly or in-pair with your teams. Target architectures, controls, runbooks. Security is written in code, not in slides.
Complete dossier, audit-ready documentation, prioritized and budgeted roadmap for what comes next. Your teams know exactly what was done, why, and what remains to maintain, autonomously.
I founded WeeSec because product and AI security can't be solved by a checklist, nor by an off-the-shelf tool. It's built with your teams, in your code, over time.
Three pillars, no more: scope what must be scoped, harden what deserves it, and transfer enough so that you leave autonomous.
It depends entirely on scope. An audit can be scoped in a few weeks; a complete implementation spans several months. The initial scoping serves precisely to set a realistic range with you, no commitment.
Depending on the engagement: exposure mapping, detailed audit report, prioritized and budgeted roadmap, documented target architecture, operational runbooks, audit-ready documentation, knowledge transfer workshops. Everything is delivered in a format your teams can take over and evolve.
The founder personally leads engagements, and may bring in senior consultants when the mission calls for it.
Systematically, before any detailed technical exchange. The NDA can be yours or a standard one we provide. Confidentiality is non-negotiable. It's also the baseline posture in this trade.
Cyber Resilience Act, AI Act, ISO 27001, ISO 42001, NIST CSF, NIST AI RMF, OWASP (including LLM Top 10), SOC 2, depending on what serves your situation. The goal is to align with what your customers and the regulator actually expect, not to stack certifications.
Each engagement is scoped according to your exposure and perimeter. Pricing is defined at initial scoping, after understanding your context, not before. Direct Calendly to discuss in 20 minutes.
No commitment, no cold commercial offer. We look together whether the engagement makes sense.
Book a Calendly call