Echelon AdvisoryAI risk & compliance
§ 0

Echelon Advisory Services
Independent practice

Controls that hold up when the AI ships, the supplier changes, or the regulator asks.

I help product, risk and compliance teams turn the NIST AI RMF, ISO/IEC 42001 and the EU AI Act into working controls, evidence and escalation paths. Fourteen years in trust & safety, product safety and compliance operations, most of it at marketplace and platform scale.

Run the free 4-minute AI RMF check Book an intro call
14+ yrstrust, safety & compliance
15+markets in one compliance program
$5.1Bprogram value overseen
200+person operations led
Excerpt · control crosswalkAI RMF 1.0 → ISO/IEC 42001 → EU AI Act
NIST AI RMFWhat has to existISO/IEC 42001EU AI Act
MAP 4.1Legal and technical risk of third-party models, data and APIs is assessed and written downA.10Art. 25
MANAGE 2.4A named person can disengage or roll back the system, and has rehearsed itA.9Art. 14
MANAGE 4.3Incidents reach users, vendors and regulators on a defined clockA.8.4Art. 73
Three rows from a working crosswalk. Every engagement leaves you with the full register and the evidence behind each line.
§ 1 Services

Fixed scope.
Named deliverables.

What I do

Most governance work stops at a policy PDF. Mine ends with artefacts your engineers, auditors and incident leads will actually open: registers, decision gates, runbooks and test plans tied to specific control IDs.

AI RMF profile and evidence register

NIST AI 100-1NIST AI 600-1ISO/IEC 42001

A current-state and target-state profile across all 72 AI RMF subcategories, scoped to the systems you actually run. Each subcategory gets an owner, the evidence that proves it, and a status an auditor can check.

You get
  • AI system inventory, including shadow tools
  • Subcategory-level evidence register
  • Crosswalk to ISO/IEC 42001 Annex A and EU AI Act articles
  • Prioritised remediation backlog
Length
4–6 weeks

AI launch readiness reviews

MAP 5.1MEASURE 1.1MEASURE 2.7

The pre-launch safety assessment workflow I ran for consumer AI features, adapted to your release cycle. Risk tiering decides how deep each review goes, so low-risk changes don't queue behind high-risk ones.

You get
  • Risk-tiering rubric and intake form
  • Test plan with pass/fail thresholds set before testing
  • Abuse, prompt-injection and data-leak test cases
  • Launch gate with sign-off roles
Length
3–5 weeks, then per-launch support

Agent and tool-use controls

GOVERN 6.1MANAGE 2.4EU AI Act Art. 14

For AI agents that can call tools, move data or take actions. I define what an agent may do unattended, what needs a human, and what gets logged, then test that the boundaries hold.

You get
  • Action allow-list by risk tier
  • Human-approval thresholds
  • Audit log specification
  • Kill-switch and rollback runbook
Length
3–4 weeks

Incident and escalation systems

MANAGE 4.1MANAGE 4.3Lean Six Sigma

Severity scales, response clocks and root-cause method for AI and product-safety incidents. Built from running escalation for a 30-person team handling high-severity child-safety cases.

You get
  • Severity matrix with examples from your product
  • Escalation paths and SLAs
  • Root-cause and corrective-action template
  • Regulator and user notification playbook
Length
2–4 weeks

Supplier and product compliance intelligence

CPSCEU GPSRMAP 4.1

Regulatory horizon scanning and supplier evidence checks for physical products and for the models and datasets you buy. Same discipline, two kinds of supply chain.

You get
  • Market-by-market requirement map
  • Supplier and model-vendor questionnaires
  • Change-detection routine for new rules
  • Category risk tiers
Length
Project or monthly retainer
§ 2 Free tool

12 questions
About 4 minutes

How ready is your AI program for an audit?

Twelve questions drawn from NIST AI RMF subcategories, three per function. You see your score straight away. Leave your email and I'll send the full gap report with the three fixes I'd make first.

  • Scores for Govern, Map, Measure and Manage
  • Gaps tied to specific control IDs
  • Free written read-out from me
Start the check
Example result
Govern
3/6
Map
3/6
Measure
2/6
Manage
2/6

Top gap: MANAGE 2.4 no tested way to switch the system off.

§ 3 Case files

Two from practice.
Two from public research.

Case files

CF-01 · Supply chainIn-house role, 2020–2024

Scaling children's product compliance from toys to every children's category

A global marketplace ran a product-safety compliance program built for toys. Between 2022 and 2023 new US federal rules widened what counted as a regulated children's product: button and coin cell batteries under Reese's Law, clothing-storage tip-over under the STURDY Act, and drawstrings on children's outerwear.

Each rule hit thousands of sellers and listings that had never been in scope. The program had to absorb them without blocking legitimate sellers.

What I did

  • Led six risk managers and a 30-person escalation team as the first line for safety incidents
  • Built the regulatory intake that turned each new rule into category rules, seller documentation asks and enforcement thresholds
  • Set up child-safety incident escalation with Six Sigma root-cause reviews for high-severity cases
  • Partnered with Product on horizon scanning of social media, forums and blogs for harm reports that never reached official channels

Why it matters for AI

Model providers, datasets and plugins are suppliers. The same pattern applies: tier them, ask for evidence, and watch for signals outside your own reporting channels.

Read: CPSC compliance after Reese's Law →

15+markets covered
$5.1Bprogram value
~2 yrsto extend scope from toys to all children's products
CF-02 · AI risk researchDesk review, Nov 2026

Four 2026 surveys, one pattern: incidents are common and almost nobody slows down

OneTrust surveyed 1,200 senior decision-makers in eight countries. 86% had at least one AI-related incident in the past year. Only 27% paused or slowed deployment in response. A third saw staff use unapproved AI because the approved route was too slow.

DigiCert, Spacelift and Proofpoint found the same shape from different angles: incidents in the large majority of organisations, and only a minority ready to investigate them properly.

My reading

The gap is operational. Teams have policies. They lack an owner who can pause a system, an approval path fast enough to beat shadow use, and an incident process that works across tools. Those are buildable in weeks.

Read the full analysis →

OneTrust 2026, % of respondents
Source
  1. OneTrust, AI-Ready Governance Report, Sep 2026
CF-03 · NIST frameworksDesk review, Nov 2026

What NIST AI RMF adoption looks like in practice, and where it breaks

The AI RMF is voluntary and has no certification. NIST is revising it under the White House AI Action Plan, added a Generative AI Profile in 2024, and in April 2026 published a concept note for a critical infrastructure profile. A draft Cyber AI Profile now ties it to CSF 2.0.

Where adoption breaks

  • "Aligned with NIST" with no trace from a subcategory to an owner and a piece of evidence
  • Profiles built once for an audit, never updated when a model or vendor changes
  • Separate AI, privacy and security registers that describe the same control three ways

Read the full analysis →

72subcategories in AI RMF 1.0
12GenAI risk categories in NIST AI 600-1
0certifications offered. Evidence is the only proof.
CF-04 · Data governanceEchelon engagement

Privacy audits for two non-bank lenders using customer data in AI models

Two regulated lenders were collecting customer data for credit and fraud models under a new data protection law. Neither had a clear rule for what could be reused for model training or how long it could be kept.

What I did

  • Audited consent capture, purpose limitation and retention against the law's requirements
  • Set standards for what data may feed model training, and when it must be deleted
  • Scored each lender with a multi-jurisdiction privacy framework so gaps read the same way under GDPR
2regulated lenders audited
1scoring model across multiple privacy regimes
§ 4 Process

Same order every time

How an engagement runs

  1. Step 1 · Week 0

    Scoping call

    45 minutes. We pick the systems in scope and the framework you answer to.

  2. Step 2 · Weeks 1–2

    Evidence review

    I read what exists and interview owners. No 200-question survey.

  3. Step 3 · Weeks 2–4

    Gap register

    Every gap tied to a control ID, an owner and an effort estimate.

  4. Step 4 · Weeks 4+

    Build and hand over

    We fix the top gaps together. Your team runs it after I leave.

§ 5 Insights

Latest writing

Recent insights

AI risk researchNov 2026

AI incidents in 2026: four surveys, one pattern

A side-by-side reading of the 2026 OneTrust, DigiCert, Spacelift and Proofpoint AI risk surveys: how common AI incidents are, why deployment rarely slows, and the three controls that close the gap.

All insights
§ 6 About

Maneesha Pandey
Founder

About Echelon

Echelon Advisory is a small independent practice run by me, Maneesha Pandey. I've spent fourteen years where policy meets operations: trust & safety, product safety, regulatory compliance and the escalation desks that sit behind them.

I've built governance in places that move fast. That includes AI safety launch reviews for consumer AI features, a children's product compliance program across fifteen markets, and large operations teams for a US financial services client.

I work with companies in the US, UK, EU and Asia-Pacific that are shipping AI or selling physical products across borders and need their controls to stand up to scrutiny.

I also write about AI governance and enterprise AI on Substack.

AI safety assessment workflows, consumer AI featuresGoogle T&S · contract
Children's product safety and regulatory intelligenceAmazon · 2020–24
Operations and GRC, 200+ person teamsMphasis · 2008–18
Lean Six Sigma Green BeltCertification
Trust & Safety Professional AssociationMember
§ 7 Contact

Reply within two working days

Start a conversation

Tell me what you're shipping and what's driving the timeline. If you've run the readiness check, your result is attached automatically.

I'll only use your details to reply to this message.

Emailmaneeshapnd52@gmail.com
LinkedInin/maneesha-pandey
WritingSubstackNotes on AI governance and enterprise AI