Diagnostic Sprint · Engagement v1
Turn an ML evaluation claim into auditable evidence. Written deliverables, fixed scope.
Three tiers, written-first, with scheduled calls available at every stage. We author PRML manifests for your existing evaluation claims, anchor them on the appropriate public or private registry, and write the audit memo your reviewer, regulator, or customer can cite. Every deliverable in writing. No discovery loop. No payment processor in the middle. SEPA bank transfer in EUR; invoicing is structured by engagement tier.
Note: these engagements are scoped and quoted in writing. The fixed-price starting point is an Acceptance Evidence Pack: €4,500, one AI system, up to three criteria.
Pick the engagement that matches your claim count and timeline.
Each tier is fixed-scope, and its price is fixed in a written quote before work starts. No discovery phase, no hourly billing. The differences below are the differences. Everything ships in writing; everything is yours to cite, fork, and reuse.
Single existing evaluation claim, locked into a PRML manifest, registry-anchored, audit memo delivered. For a compliance officer or eval engineer who needs an independently verifiable artifact for one specific claim before a regulator or customer asks.
Deliverables:
- One PRML manifest, registry-anchored at registry.falsify.dev
- Audit memo, 6-8 pages PDF: threat model, manifest fields, residual risk
- Re-derivation script (Python, 30-50 lines) for independent verification
- Citation block (BibTeX + Zenodo DOI format) for your model card or paper
- 5 business days written Q&A window post-delivery, 48-hour response SLA
Payment: 100% upfront, single invoice, SEPA bank transfer
Three evaluation claims, CI pipeline deployed, full audit report. For an AI team at a regulated provider that needs CI-level enforcement (block merges that tamper or regress against locked thresholds) and an audit-grade evidence package for the next regulator interaction.
Deliverables:
- Three PRML manifests, registry-anchored
- CI pipeline deployment: prml-verify-action wired in, set to fail builds on tamper or regression
- Audit report, 12-15 pages PDF: per-manifest threat model, regulator-mappable evidence (EU AI Act Article 12 / NIST AI RMF / ISO 42001), residual risk register
- Re-derivation scripts per manifest
- 30-day support window post-delivery, unlimited written Q&A, 48-hour response SLA
- 1-page closing memo: what's defensible now, what's still open
Payment: 50% / 50% SEPA bank transfer in two milestones (kickoff and audit-report delivery)
Up to 12 manifests, isolated private registry instance, personalized regulatory crosswalk PDF, two written executive briefings. For a regulated AI provider, notified body, or large research org under EU AI Act high-risk status (2 Dec 2027 deadline) or pursuing ISO 42001 certification.
Deliverables:
- Up to 12 PRML manifests, registry-anchored on your isolated instance
- Isolated private registry: registry.<your-org>.com (Cloudflare Worker + KV), basic auth, audit log endpoint, monitored uptime during the engagement window
- CI pipeline deployment across up to 5 repositories
- Personalized regulatory crosswalk PDF, 20-30 pages: EU AI Act Articles 12 & 18 + optional NIST AI RMF + optional ISO/IEC 42001 mapping, each control linked to a specific manifest hash
- Two written executive briefings, 4-6 pages each (mid-engagement status & close-out defensibility statement)
- 60-day support window post-delivery, including responses to your auditor or notified body during their review
- Right of citation in your compliance documentation and regulator filings
Three variants:
- Standard: up to 8 manifests, 3 repos, one framework
- Plus: up to 12 manifests, 5 repos, two frameworks
- Premium: full envelope, all three frameworks + custom mapping to one additional standard (e.g. MITRE ATLAS, NIST AI 600-1)
Payment: 33% / 33% / 34% in three milestones, three invoices. Net-30 procurement terms available. Scope and terms agreed per engagement. On-site work is scoped separately based on location, security requirements and engagement needs.
The price is quoted in writing with the scope memo and fixed at engagement start. Timelines count from kickoff, once the signed scope memo and the access and documents it names are in hand, and assume written review comments within one business day. No mid-engagement upsells, no scope-creep billing, no out-of-scope charges beyond the Enterprise add-ons listed above.
Threshold pre-registration is fifteen years old. The cryptographic version is what survives a hostile reviewer.
SR 11-7 was 2011 (replaced by SR 26-2 in April 2026). EBA/GL/2017/16 came later. Internal MRM teams have been documenting threshold commitments for over a decade. The bind has always been signature plus workflow plus trust: defensible inside an institution that wants to defend it, increasingly thin in front of a reviewer that doesn't.
PRML doesn't replace any of that. It produces a SHA-256 hash that any toolchain can re-derive against canonical bytes, mechanically verifiable rather than procedurally trustable. Same content. Same fields. Different proof shape.
The Sprint is the wrapper that produces that hash for one of your published claims in three business days. If your model is sitting in an MRM queue or a notified-body submission and the binding constraint is "show us the receipt", that's what we ship.
Five artefacts you can hand to a reviewer or an auditor.
Every deliverable is yours to keep, share, and re-use. The PRML manifest and the verifier are MIT-licensed; the audit report is plain Markdown with cryptographic citations.
A 9-field PRML manifest committing one published claim (metric, comparator, threshold, dataset (id + content hash), seed, producer, claim id, timestamp, spec version) to a SHA-256 hash. Anchored on registry.falsify.dev so anyone can re-derive and verify.
Reference verifier (Python, JS, Go, or Rust, your pick) wired into your CI. Re-runs the claim, computes the canonical hash, exits 0 / 10 / 3 for pass / fail / tamper. No vendor lock-in.
A 6–10 page Markdown report covering: what was claimed, what was committed, how to verify, and §8.1 limitations specific to your claim. Citable in papers, model cards, and notified-body submissions.
A registry.falsify.dev/<hash> page anyone can land on. Citable in README badges, papers, and reviewer responses. Optional: keep it private until you publish the underlying claim.
A wired-in studio-11-co/prml-verify-action@v2 workflow in your repo: five-line composite Action, exits non-zero on tampered or regressed claims, optional public registry anchor. Same artefact that gets cited in the audit report.
Fixed scope. Fixed price. No discovery loop.
One week, five written checkpoints. Audit Review collapses the same flow into 3 business days for a single claim. Enterprise runs it across 2 weeks with a written progress note at the midpoint. Timelines count from kickoff, once the signed scope memo and the access and documents it names are in hand, and assume written review comments within one business day. Every step is written; scheduled video calls are available at any checkpoint, and call decisions are confirmed in writing.
You email hello@falsify.dev. We reply within one business day; the 2-page scope document (naming the claims, target regulators, CI integration points, and the invoice) follows within two business days. You sign the scope memo electronically. A scoping call is available whenever you want one; none is required.
Three claims locked from the candidate list in your scope memo. Three PRML manifest drafts written, sent for written review. You comment in writing; one revision round; manifests frozen by end of day 2.
prml-verify-action wired into your CI. Re-runs the claims end-to-end against your dataset hashes. If a claim doesn't reproduce, you find out before the receipt goes public. That's a feature. Progress note delivered end of day 3.
Draft of the 12–15 page report sent for review. You comment in writing; one revision round. Includes per-manifest §8.1 limitations and regulator-mappable evidence for the framework(s) you named at scope time.
Final report delivered as PDF. Manifests committed to the registry (public or private depending on tier). Re-derivation scripts attached. 30-day written-Q&A support window opens with 48-hour response SLA.
A sprint is the right shape for some teams. For others it isn’t.
Honest signal upfront beats a discovery call that ends in a no.
Specification-author delivery.
Engagements are led directly by the author of the PRML specification.
Founder of Falsify OÜ. Author of the PRML specification and of the four reference implementations (Python, JS, Go, Rust). Works on evaluation integrity: making the success criteria behind an AI claim independently checkable after the fact. Engagements are structured under English-law SOWs.
If your scope doesn't fit any of the three tiers, the reply will say so plainly. No follow-up sequence, no nurture flow. The scope document arrives in writing within two business days of your first email; the invoice rides with it. From there it's a bank transfer and start.
Want only the hosted platform without a written engagement? See Pro pricing: subscription registry with ten-year retention, self-serve, no assurance deliverable attached.
Email hello@falsify.dev →