The subject is the company
Most AI review looks at a system: a hiring model, a fraud engine, a chatbot. We look at the company. Legal duties and liability attach to the entity and its officers, not to an algorithm, so the subject of our review is the organisation itself and how it governs its use of AI. The question we answer is not whether one model behaves, but whether the board can account for the whole of the company's AI, and show its working.
The Tollivar Framework
The Framework applies a fixed method to a single subject. We work in four passes across the public record and the evidence a company has released, and we read eight governance domains against each other rather than in isolation. We follow the AI across the value chain, upstream and downstream, so supply, deployment, and the effects on rights, environment and customers are all in view. We assess whether and how the company governs that chain. We do not perform each specialist audit ourselves; where a specialist supply chain, human rights or environmental assessment is wanted, it is delivered by partner firms and kept at arm's length, so our review stays independent.
What we report
We do not grade a company compliant or non-compliant. We describe alignment risk, potential exposure, and evidence gaps, in language a board and its advisers can act on. Every engagement produces a Board Note, an Executive Report, an Evidence Annex, and a board presentation. From the second year, the Progress View sets the current position against the last, so the board can see movement rather than a single snapshot.
The register
This is advisory review and guidance. It is not assurance, and it is not a legal opinion. We review and we advise. We do not audit, certify, implement, or provide legal advice, and we hold no product in the systems we review. Counsel advises on the law; we review the evidence. Where a finding turns on legal interpretation, we say so and leave that judgement to your advisers. The value is a documented, independent view the board can rely on internally, with its limits stated, before regulators, investors or claimants form their own.
Read across jurisdictions
AI obligations do not sit in one statute or one culture. We read EU, UK, US and Asian regulatory expectations together, which matters for any company that operates, sells, or reports across borders.