Seven AI systems, no owner, and an enterprise renewal in 14 weeks
Sample case study: Kestrova Ltd is a fictional company. Its people, systems, vendors, findings and figures are invented to show how a Bhaviyo engagement works across all three tiers. It is not a real client, and nothing here is a promise of results.
The situation
Kestrova is a fictional Manchester-based HR and talent-management SaaS with 140 staff, selling to employers in 28 countries. About 45% of its revenue comes from the EU. It has a SOC 2 Type II report but no ISO management system.
Three pressures landed in one quarter: a Dutch enterprise customer asked for an ISO/IEC 42001 roadmap at renewal, a Nordic tender asked how AI impact on job applicants is assessed, and Series C due diligence included an AI risk section. Two of its AI systems are used in hiring and workforce decisions.
Tier 1 · AIMS Gap Assessment (3 weeks)
Kestrova reported four AI systems. Bhaviyo found seven, including a job-advert feature shipped to 40 beta customers without review.
7 AI systems found (4 reported)
Illustrative8 Red, 7 Amber, 0 Green across 15 areas
Illustrative19 prioritised actions
IllustrativeKey findings
- F-01:Sales material said a recruiter reviews every AI ranking. An auto-decline setting could reject applicants with no human review.
- F-02:A prediction model was trained on pooled customer HR data, but the contract did not clearly allow it.
- F-03:Everyone assumed the LLM vendor did not retain data. Nobody had checked the settings.
Tier 2 · AI Governance Readiness (6 weeks)
Bhaviyo built Kestrova's first AI risk method and assessed three systems. A technical review of the training pipeline found an attrition model using sick days and parental leave as features, proxies for health and sex that no policy document would have revealed.
24 risks documented
Illustrative3 impact assessments
IllustrativeAI policy approved by the board
IllustrativeGeneral Counsel used Bhaviyo's impact assessment as the factual basis for her own EU AI Act analysis. The legal conclusion was hers, not Bhaviyo's.
Tier 3 · End-to-End AIMS Implementation (22 weeks)
Kestrova's first management system, built from scratch: seven procedures, five AI objectives, an independent internal audit and a first management review. In week 12, a real AI incident (a job advert asking for a "young, energetic" team) became the first live test of the new incident procedure.
31 risks documented
Illustrative7 procedures approved
IllustrativeStage 1 Readiness Pack delivered
IllustrativeKestrova booked its Stage 1 audit directly with an accredited certification body. The outcome is the certification body's decision.
What it cost (illustrative, standard rates)
| Tier | Price basis | Credit | Paid |
|---|---|---|---|
| Tier 1 | £1,750 standard | — | £1,750 upfront |
| Tier 2 | £4,500 + £950 extra AI system | −£1,750 (upgraded within 30 days) | £3,700 upfront |
| Tier 3 | £12,500 base + £4,000 size uplift (140 staff) + £1,500 extra AI system | −£1,500 (upgraded within 60 days) | £16,500 in instalments |
| Total | £21,950 |
Prices in GBP. Certification body fees are paid by the client directly.
What Bhaviyo did not do
- —Give legal advice or classify any system under the EU AI Act
- —Perform the internal audit of the system it implemented
- —Run bias, penetration or model testing
- —Issue or guarantee certification
“We thought we had four AI systems and a policy problem. We had seven systems and an evidence problem. Bhaviyo read our training notebooks and our vendor contracts in the same week, and left us with documents our small team can actually run.”
See it for yourself
Download sample deliverables (fictional data) from the Deliverables screen of the demo workspace.