# Echelon Advisory

> Independent AI risk and compliance advisory founded by Maneesha Pandey. Echelon turns the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act into working controls, evidence registers and escalation paths for product, risk and compliance teams in the US, UK, EU and Asia-Pacific.

Founder background: 14+ years in trust & safety, product safety and compliance operations. AI safety assessment workflows for consumer AI features (Google Trust & Safety, contract); children's product safety and regulatory intelligence across 15+ markets for a $5.1B compliance program (Amazon, 2020–2024); operations and GRC with 200+ person teams (Mphasis, 2008–2018). Lean Six Sigma Green Belt. Member, Trust & Safety Professional Association.

Contact: maneeshapnd52@gmail.com · https://www.linkedin.com/in/maneesha-pandey

## Services

- [NIST AI RMF profile and evidence register](https://echelon-advisory.adminace.org/#svc-rmf): current and target-state profile across all 72 AI RMF subcategories, owners and evidence per subcategory, crosswalk to ISO/IEC 42001 Annex A and EU AI Act articles. 4–6 weeks.
- [AI launch readiness reviews](https://echelon-advisory.adminace.org/#svc-launch): risk-tiered pre-launch safety assessment, pass/fail thresholds, abuse, prompt-injection and data-leak tests, launch sign-off gate. 3–5 weeks.
- [AI agent and tool-use controls](https://echelon-advisory.adminace.org/#svc-agents): action allow-lists by risk tier, human approval thresholds, audit log specification, kill-switch and rollback runbook. 3–4 weeks.
- [Incident and escalation systems](https://echelon-advisory.adminace.org/#svc-incident): severity matrix, escalation paths and SLAs, root-cause and corrective action method, regulator and user notification playbook. 2–4 weeks.
- [Supplier and product compliance intelligence](https://echelon-advisory.adminace.org/#svc-supply): regulatory horizon scanning, CPSC and EU GPSR requirement maps, supplier and model-vendor evidence checks.

## Free tool

- [NIST AI RMF readiness check](https://echelon-advisory.adminace.org/nist-ai-rmf-readiness-check/): 12 questions mapped to AI RMF subcategories (GOVERN 1.6, 2.1, 6.1; MAP 1.1, 4.1, 5.1; MEASURE 1.1, 2.7, 3.1; MANAGE 2.4, 4.1, 4.3). Instant score per function and top gaps by control ID.

## Articles

- [AI incidents in 2026: four surveys, one pattern](https://echelon-advisory.adminace.org/blog/posts/ai-incident-surveys-2026.html): A side-by-side reading of the 2026 OneTrust, DigiCert, Spacelift and Proofpoint AI risk surveys: how common AI incidents are, why deployment rarely slows, and the three controls that close the gap.
- [NIST AI RMF in 2026: what adoption looks like, and where it breaks](https://echelon-advisory.adminace.org/blog/posts/nist-ai-rmf-adoption-2026.html): Where the NIST AI Risk Management Framework stands in late 2026: the GenAI profile, the critical infrastructure profile, the revision under the AI Action Plan, the Cyber AI Profile, and the three ways adoption usually fails.
- [Building a Trust & Safety Program from Scratch: Lessons from Amazon, Google, and TikTok](https://echelon-advisory.adminace.org/blog/posts/building-trust-safety-program-from-scratch.html): A phased plan for standing up trust & safety: when to start, what to build in the first month, which policies and tools come next, and the mistakes that cost the most.
- [CPSC Compliance for Amazon Sellers and Marketplaces: What You Need to Know After Reese's Law](https://echelon-advisory.adminace.org/blog/posts/cpsc-compliance-amazon-sellers-marketplaces.html): What CPSC rules mean for marketplace sellers of children's products and button-battery goods: Reese's Law, testing and certificates, recalls, and how marketplaces enforce them.
- [Digital Services Act Compliance: Building Content Moderation Infrastructure That Scales](https://echelon-advisory.adminace.org/blog/posts/dsa-compliance-content-moderation-2026.html): How platforms meet DSA duties in practice: notice-and-action, statements of reasons, appeals, transparency reports, and the moderation tooling that holds up at scale.
- [EU AI Act Compliance: What High-Risk AI System Providers Need to Know in 2026](https://echelon-advisory.adminace.org/blog/posts/eu-ai-act-compliance-high-risk-systems.html): What providers of high-risk AI systems must do under the EU AI Act, including the deadlines moved by the 2026 AI Omnibus, conformity assessment, and a practical roadmap.
- [Fractional Chief Safety Officer: When Startups Need Executive Safety Leadership Without Full-Time Headcount](https://echelon-advisory.adminace.org/blog/posts/fractional-chief-safety-officer-startups.html): When a startup needs senior safety leadership before it can justify a full-time hire, what a fractional Chief Safety Officer does, and how to scope the role.
- [Building Regulatory Intelligence Systems: How to Monitor and Respond to Regulatory Changes at Scale](https://echelon-advisory.adminace.org/blog/posts/regulatory-intelligence-systems-compliance-monitoring.html): How to track regulatory change across markets and turn it into product, policy and enforcement decisions before deadlines hit.
- [Trust & Safety Due Diligence: What Investors Miss When Evaluating Platforms](https://echelon-advisory.adminace.org/blog/posts/trust-safety-due-diligence-investors.html): The trust & safety questions investors should ask before backing a platform, the red flags that predict regulatory and reputational loss, and how to size the risk.