Himalogic AI PACE Report

Answer the questions one section at a time. At the end you get a private link to your AI PACE Report.

1. About you

Please answer the questions in this section before continuing.

Name

Work email

Your role

Founder / CEO CTO / head of engineering / technical lead Product Legal, compliance, or risk Operations Other

Other role

When your company decides how to handle something like compliance, who makes the call?

I do I share the decision with one or two others I recommend, someone else decides Honestly not sure yet

How would you describe your relationship to the technical side of your AI?

I build it myself I direct the people who build it I understand what it does but not how I mostly know it exists

Why this matters: We use this to write your report at the right level. No wrong answer.

2. About your business

Please answer the questions in this section before continuing.

In a sentence, what does your company sell?

Industry

Software / SaaS Education / edtech Healthcare / health tech Financial services / fintech / insurance HR / recruiting / workforce Marketing / media / content Retail / ecommerce Government or public sector Other

Other industry

Why this matters: Some industries carry extra AI rules on top of the general ones, especially education, finance, hiring, and health.

Who are your customers?

Businesses Consumers Both Government agencies

Company size

Just me 2 to 10 11 to 50 51 to 200 200+

Where is your company based?Country

State

Where are your customers or users?

United States

Which states?

All states are selected by default. Uncheck a state only if you actively block or exclude customers or users in that state. Someone selling into the United States usually leaves every state checked.

Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware District of Columbia Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Maryland Massachusetts Michigan Minnesota Mississippi Missouri Montana Nebraska Nevada New Hampshire New Jersey New Mexico New York North Carolina North Dakota Ohio Oklahoma Oregon Pennsylvania Rhode Island South Carolina South Dakota Tennessee Texas Utah Vermont Virginia Washington West Virginia Wisconsin Wyoming

European Union / EEA United Kingdom Canada Elsewhere

Where?

I don't actually know where all our users are

Why this matters: AI laws generally follow your users, not your headquarters. A company with no EU office can still be covered by the EU AI Act if its AI is used by people in the EU. If you checked "I don't actually know," that's worth knowing too.

3. How you use AI

Please answer the questions in this section before continuing.

Which of these describe your company today?

Our team uses AI tools like ChatGPT or Claude for internal work We've built prototypes with tools like Lovable, Bolt, or similar Our product includes AI features built on someone else's model (OpenAI, Anthropic, Google, etc.) We've fine-tuned or retrained a model on our own data We've trained our own model We have AI agents that take actions on their own (sending emails, updating records, making purchases) None of these yet, but we're planning to

Why this matters: The rules treat a company that uses AI very differently from one that provides it. Each step down this list moves you closer to provider territory, which carries the heavier obligations.

Does your AI appear to customers under your company's name or brand?

Yes, it's part of our product Partly, it's labeled as powered by another company No, it's internal only

Why this matters: Under the EU AI Act, putting an AI system on the market under your own name is part of what makes you a "provider." Many companies building on top of OpenAI or Anthropic assume the model company carries the compliance load. Often it doesn't.

Have you changed the underlying model in any way, like fine-tuning it on your data or changing what it was designed to do?

Yes We're planning to No Not sure

Why this matters: Modifying a model, or using an AI system for a purpose its maker didn't intend, can shift you from "deployer" to "provider" in the eyes of the regulation. Most companies find this out late.

4. What your AI touches

Please answer the questions in this section before continuing.

Does your AI ever influence a decision about a person?

Whether someone gets hired, promoted, or let go Whether someone gets a loan, credit, or insurance, or at what price Whether a student is admitted Whether someone gets access to housing, benefits, or essential services Medical or health-related decisions Identifying people from their face, voice, or other biometrics None of these

Why this matters: These are the areas most AI laws treat as "high-risk." In the EU, most high-risk obligations apply from December 2, 2027. Some US states and cities already regulate AI in hiring and lending. If you checked any of these, the classification question is usually one for a lawyer, and it's worth asking early.

Does your AI talk directly with people, like a chatbot, voice agent, or assistant?

Yes No

Why this matters: In the EU, people generally have to be told when they're interacting with an AI. This transparency rule applies regardless of risk level.

Does your AI generate images, audio, video, or text that ends up in front of the public?

Yes No

Why this matters: There are disclosure and labeling requirements for AI-generated content, and for content that could pass as real.

Does your AI process any of these?

Personal information about customers or users Information about children Health information Financial information Biometric data (faces, voices, fingerprints) None of these

Why this matters: AI laws stack on top of privacy laws like GDPR. Personal data in an AI system usually means two sets of obligations, not one.

Do you use AI to monitor or evaluate your own employees, or to read people's emotions?

Yes No Not sure

Why this matters: Using AI to infer emotions in the workplace or in schools has been prohibited in the EU since February 2025, with narrow exceptions. Several monitoring tools on the market do this quietly.

5. Visibility and control

Please answer the questions in this section before continuing.

If your AI gave a customer a wrong or harmful answer tomorrow, how would you find out?

We monitor outputs and would catch it ourselves We'd probably see it in logs eventually A customer would tell us We probably wouldn't

Why this matters: Most frameworks expect you to monitor AI after it launches, not just test it before. If "a customer would tell us" was your honest answer, you're in good company, and it's one of the most common gaps we see.

If a customer asked why your AI made a specific decision or gave a specific answer, could you show them?

Yes Partly No Not sure

Why this matters: Being able to trace an output back to its inputs, model, and version is a core expectation in ISO 42001 and the EU AI Act. It's also what you'll want when something goes wrong.

Do you know which version of which model is running in your product right now?

Yes Roughly No

Why this matters: Model providers update models, sometimes without much notice. If behavior changes, you'll want to know what changed.

Could you list every AI tool your team uses, including the ones people signed up for on their own?

Yes Mostly No

Why this matters: An inventory of AI systems is the first thing almost every framework asks for. Most companies discover more tools than they expected.

If you needed to switch off an AI feature immediately, who would do it, and how long would it take?

Someone specific, within minutes We'd figure it out within a day I'm not sure

Why this matters: Human oversight, including the ability to stop the system, is a requirement for high-risk AI and good practice for everything else.

6. Where you are now

Please answer the questions in this section before continuing.

Has a customer or prospect ever sent you a security or AI questionnaire before signing?

Yes, and AI questions are showing up more Yes, but mostly security, not AI Not yet What's an AI questionnaire?

Why this matters: This is often how compliance shows up for the first time. A prospect's procurement team sends a spreadsheet with a hundred questions, and the deal waits until you answer. The first time it happened to us, the reaction was "wait, what?" If it hasn't happened to you yet, it likely will once you start selling to larger companies.

Which of these do you already have?

SOC 2 ISO 27001 ISO 42001 A written AI use policy None yet

Why this matters: If you already have SOC 2 or ISO 27001, a good share of the groundwork for AI governance is already in place. ISO 42001 is built on the same structure as ISO 27001.

How have you handled compliance work in the past?

Did it ourselves Hired a consultant Used a platform like Vanta or Drata Haven't had to yet

7. What's ahead

Please answer the questions in this section before continuing.

What prompted you to look into this?

Curiosity after watching a video A customer, prospect, or investor asked about it We're planning a new AI product or feature We're entering a new market Something went wrong Legal or a board member raised it Other

Other reason

When do you expect your next AI feature or product to reach customers?

It's already live Within 3 months 3 to 12 months More than a year out No plans yet

Which best describes where you want your AI to go?

Keep using off-the-shelf tools Add AI features to our product using existing models Build something custom: our own models, fine-tuning, or specialized workflows Not sure yet, that's part of what we're figuring out

What would you most like to get out of your AI PACE Report?

8. Wrap-up

Please answer the questions in this section before continuing.

Would you like a copy sent to anyone else on your team?

Up to 3 people. Leave unused rows blank.

Person 1

NameRoleEmail

Person 2

NameRoleEmail

Person 3

NameRoleEmail

Why this matters: AI compliance usually touches more than one person: someone technical, someone on the business side, sometimes legal.

Would a conversation about your specific situation be useful?

Yes, I'd like that Maybe later No thanks, the report is enough

[CONTENT NEEDED: privacy notice]

I agree to submit my answers.

JavaScript is off, so every section is shown at once. You can still submit the form.[data-step][hidden],[data-show-if][hidden],[data-person-row][hidden]{display:block !important}