VITNAEU AI Act Readiness Assessment: Statement of Work
This is the agreement for the EU AI Act Readiness Assessment: US$7,500 fixed, half on signing and half on delivery, ten working days from Day 1, with a draft report on day 8 for factual corrections and the final report on day 10. The assessment is not legal advice and it is not a certification. Clause 6 says so in the text you are accepting.
All fifteen clauses are below, in full. Read them, then fill in the four fields underneath. What gets recorded is the text on this page, exactly as it stands, against your name, your title and the time you accepted it.
EU AI Act Readiness Assessment: Statement of Work
Between COSTRINITY INC., PO Box 1572, Fort Qu'Appelle, SK S0G 1S0, Canada ("COSTRINITY") and [the company legal name entered below], [the company address entered below] ("Client").
1. Services
COSTRINITY will deliver a written EU AI Act readiness assessment covering the AI systems listed in the Client’s completed intake questionnaire (the "Systems"). The assessment comprises nine deliverables: scope and system inventory; role determination per System; obligation mapping with article citations; risk classification per System; gap analysis; record-keeping review against Article 12; a fundamental rights impact assessment starter draft where one is required; a remediation plan ordered by deadline and effort; and an evidence appendix of signed records for the checks performed, verifiable offline with COSTRINITY’s published key. Where any System takes actions on external systems rather than only generating content, the assessment additionally delivers an agent containment review: a documentary and interview-based examination of credential scope, irreversible actions, backup reachability, constraint durability, untrusted input paths, standing privilege, and independent verification. This review inspects configuration and documentation only. It does not test, probe, or attempt any action against the Client’s systems.
2. Out of scope
Legal advice. Certification or attestation of compliance. Penetration testing, model evaluation, or a privacy audit. Any regime other than the EU AI Act (GDPR, national laws, and other jurisdictions are separate engagements). Implementation of remediation. Systems not listed in the intake questionnaire at signing.
3. Timeline
Ten working days from the day COSTRINITY receives the completed questionnaire and access ("Day 1"). Draft report by Day 8 for factual corrections. Final report by Day 10. A walkthrough call within five working days of the final report. Email follow-up for 30 days after delivery for questions arising from the report.
4. Client obligations
Return the intake questionnaire; provide read-only access described in it; make up to three people available for one hour of interviews in total, or return written answers to the same questions if the Client prefers no calls; return factual corrections on the draft within two working days. Delays in these extend the timeline day for day.
5. Fees
USD 7,500, fixed. 50% (USD 3,750) on signing; 50% on delivery of the final report. Net 7 days. No hourly billing; no expenses. If the scoping call or questionnaire reveals materially more Systems than discussed, COSTRINITY will propose a revised scope in writing before Day 1, and the Client may accept it or cancel with a full refund of the first payment.
6. Nature of the work
The assessment is an informed readiness review. It is not legal advice and does not create a lawyer-client relationship. It is not a certification, and no statement in it should be represented to a third party as one. The Client’s counsel makes legal determinations; the report is written to make those determinations faster by citing the article behind every finding.
7. Confidentiality
Each party keeps the other’s non-public information confidential and uses it only for this engagement, for two years after delivery. COSTRINITY will not name the Client publicly without written consent.
8. Data
COSTRINITY accesses only what is needed, read-only, makes no code changes, and stores working materials for 90 days after delivery, then deletes them, keeping only the final report and the signed evidence records. Evidence records contain no personal data of the Client’s users.
9. Ownership
On full payment, the Client owns the report and may use it freely. COSTRINITY retains its methods, templates, tooling, and the right to use anonymised, non-identifying learnings.
10. VITNA
The evidence appendix is produced with VITNA. Nothing in this agreement requires the Client to use VITNA after delivery.
11. Liability
COSTRINITY’s total liability under this agreement is limited to the fees paid. Neither party is liable for indirect or consequential loss.
12. Termination
Either party may end the engagement in writing before Day 1 with a full refund. After Day 1, the Client may end it and pays for work completed pro rata; COSTRINITY delivers what exists at that point.
13. Law
Saskatchewan, Canada.
14. Sub-processors
COSTRINITY uses Anthropic PBC (United States) as a sub-processor for language-model processing of engagement material, under Anthropic’s commercial terms and its data processing addendum. No other sub-processor receives Client material for this engagement. COSTRINITY maintains a written record naming each sub-processor, the categories of information it receives, its location, and the safeguard relied on, and will provide that record to the Client on request. COSTRINITY will give the Client written notice before adding or replacing a sub-processor that receives Client material, and the Client may terminate under clause 12 if it objects. Client material is never used to train a third party’s models.
15. Accountability for transfers
Under PIPEDA a transfer to a third party for processing is a use, not a disclosure, and COSTRINITY remains accountable for Client information while it is held by any sub-processor. COSTRINITY therefore uses contractual means to require each sub-processor to provide a comparable level of protection, and answers to the Client for that protection rather than directing the Client to the sub-processor. Where the Client’s own material contains personal information of its users, the Client remains the accountable organisation for that information and COSTRINITY processes it only on the Client’s instructions and only for this engagement. Clause 8 governs what COSTRINITY retains and for how long; this clause governs who answers for it.
On the COSTRINITY side this is signed by Collin Obey, founder. On your side it is accepted below, by typed name and title rather than a wet signature, which is what clause 13 puts under Saskatchewan law.