Services
Five ways to work with us.
Our engagements are fixed-fee and fixed-duration, so you know the number before you start.
Normatum Brief
A two-hour session for your leadership on what your AI is actually doing.
- What you get
- A two-hour workshop for your leadership, a scoping questionnaire beforehand, and a leave-behind handout.
- How long
- Two hours
- Who it's for
- Leadership teams
Normatum Diagnostic
Every AI use case in your business, scored, with your highest exposure named.
- What you get
- An inventory of the AI tools you use, a map of the data they touch, a gap analysis, a findings report, a prioritised remediation roadmap, and a board-ready one-page summary.
- How long
- Two weeks
- Who it's for
- Firms that need to know where their AI exposure sits
Not included: penetration testing, legal opinions, or model auditing.
Normatum Drift Review
An assessment of your agentic workflows against the framework we published.
- What you get
- An inventory of your agentic workflows — what each agent can touch and what it can send — assessed against Chain of Intent, with a report on where drift is likely and which controls close it: scope constraints, tool permissions, human checkpoints, logging and escalation triggers.
- Who it's for
- Firms running AI agents in their workflows
Normatum Policy Pack
The employee GenAI policy, the tool register, and the training that makes them stick.
- What you get
- A GenAI acceptable use policy tailored to your firm, supporting procedures, an approved tool register, an impact assessment template for new tools, a 60–90 minute staff training session, an employee attestation form and a manager's guide — mapped to the PCPD's employee GenAI checklist.
- Who it's for
- Employers whose staff already use generative AI tools
Advisory Retainer
Ongoing governance for firms without a compliance function.
- What you get
- A monthly regulatory update bulletin — we watch the PCPD, SFC, HKMA, the Intellectual Property Department and EU AI Act developments — a quarterly review, and ongoing advice within agreed hours and response times.
- How long
- Monthly; minimum term to be set
- Who it's for
- Firms without a compliance function
When we send you elsewhere
Knowing our limits is part of the service.
- A formal legal opinion, privilege, regulator correspondence or a disputeA Hong Kong law firm with a regulatory practice
- A certificate for tenders or overseas partnersAn ISO 42001 certification body
- A multi-jurisdiction group programme, or anything touching your statutory auditA Big Four firm
- Building or deploying an AI systemAn AI implementation consultancy
- Penetration testing, security assessment or incident responseA cybersecurity specialist
- Deep model validation or bias auditing at technical depthA specialist technical assurance provider
- You are genuinely too small to need usNobody. We will point you at the PCPD's free checklist and say so
Not sure which one you need? That is what the first call is for.Book a 30-minute call