Why DEBIR and not a large integrator certified under ISO 42001?
We are not certified under ISO 42001 and we don’t say we are. We deliver the documents an auditor of that standard would ask for: policy, impact assessment, registry, model cards and incident protocol, mapped to the NIST AI RMF and to SR 26-2. The difference: perimeter, identity and operation in one dedicated team, from day one to month twelve.
Infrastructure providers sell compute, consultancies sell strategy and startups sell an agent for a single use case. DEBIR brings the three together and does not sell compute: it designs and installs the perimeter, and the hardware is yours.
Sources
- DEBIR governance framework, “what we don’t claim”.
- ISO/IEC 42001:2023, NIST AI RMF 1.0 and SR 26-2 (2026), as references.
Regulatory framework verified against primary sources on November 1, 2026.
- What data leaves my perimeter when I use private AI?
- Do you use our customers’ data to train the model?
- How are data subject rights and the right to object to automated decisions handled?
- What happens if there is a data breach in the system?
- How is the system isolated from the internet and the public cloud?
Discovery sessions, no commitment
With technology, compliance and two process owners. Includes an offline demonstration prepared for your sector, without using your company’s data.
Inventory and obligations
Data in four levels and a first review of what your sector requires.
Three candidate use cases
And the Assessment proposal. The Discovery is credited against the Assessment.
Founding clients program
Three seats, with an explicit discount in exchange for a publishable case and a reference.
Terms
Discovery and evidence pilot at no cost, Assessment at a discount, in exchange for a publishable case, a reference and feedback. Continuous operation is always paid at list price.