Executive AI Advisor turns technical evidence into decisions boards, CEOs, and investors can act on. It produces cited risk assessments, board briefs, and 100-day plans while keeping confidence, limitations, and human judgment explicit.
flowchart LR
A["Company evidence"] --> B["Cited technical findings"]
B --> C["Executive decision"]
C --> D["Accountable action"]
Makes architecture, security, AI governance, cloud cost, delivery, technical debt, and key-person risks visible through ratings, business impact, citations, confidence, owners, timelines, and success measures.
Turns technical findings into the decisions, management questions, limitations, and evidence a board needs for oversight without pulling directors into technology operations.
Converts findings into sequenced 30/60/90-day action, accountable owners, measurable outcomes, dependencies, and board checkpoints for growth, integration, or turnaround.
SampleCo appears investable, but its evidence shows incomplete security governance, concentrated key-person dependency, limited cloud-cost visibility, technical debt that reduces delivery predictability, and no formal AI governance model.
The correct recommendation is not to stop growth. The board should require management to establish ownership, close evidence gaps, and report progress through a measurable 30/60/90-day plan. Executive AI Advisor makes the reasoning inspectable and turns each finding into a decision, owner, timeline, success measure, and board question.
- Executive case study
- From Architecture to Executive Value
- Demo Script
- Quick Start
- Example Board Brief
Beyond the three primary outputs, the platform includes AI governance, AI knowledge governance, AI replicability risk, Cyber Resilience Act readiness, diligence reporting, and cited executive question-answering. These modules reuse the same investigation isolation, retrieval, citation, structured-output, and evaluation pipeline.
Evaluates whether AI-enabled capabilities create durable competitive advantage or can be easily replicated by competitors. Covers proprietary data advantage, workflow and switching costs, knowledge advantage, operational maturity, and governance barriers.
Outputs include overall replicability risk (red/yellow/green), evidence and missing evidence, management questions, board discussion points, recommendations, and a 90-day improvement plan.
See AI Replicability Risk Assessment.
EU Cyber Resilience Act-oriented readiness review for software and product companies. Produces deterministic findings, missing evidence, management questions, board discussion points, and a 90-day readiness plan.
This is diligence and governance support only — not legal advice. Legal counsel should confirm applicability and obligations.
- Technology Risk Scorecard
- Board Brief
- 100-Day Technology Plan
- AI Governance Assessment
- AI Replicability Risk Assessment — defensibility of AI capabilities
- Cyber Resilience Act (CRA) Readiness — generated from active investigations (see Current Capabilities and demo datasets)
- CTOs and technology executives
- PE operating partners
- Boards and investors
- Diligence teams
- AI governance leaders
- Executive decision support for technology diligence and value creation
- Board-level translation of technical findings into business impact
- Investigation workspaces that isolate each company, deal, or portfolio review
- Cited outputs with confidence levels, limitations, owners, timelines, and measurable actions
- AI governance, technology risk, board communication, and post-close planning workflows
- AI replicability risk and Cyber Resilience Act (CRA) readiness assessments for defensibility and regulatory diligence
- Local executive demo UI with Markdown exports and no raw JSON
- Generate Technology Risk Scorecards with red/yellow/green ratings, confidence levels, business impact, owners, timelines, and success metrics
- Generate Board Briefs with executive summaries, top risks, management questions, recommended decisions, citations, confidence, and limitations
- Generate 100-Day Technology Plans for growth equity, acquisition integration, and turnaround scenarios
- Generate AI Governance Assessments covering AI use-case clarity, data governance, security and privacy, model/output evaluation, human oversight, cost controls, auditability, vendor risk, and policy readiness, including acceptable-use policies, knowledge governance, incident response, and board escalation
- Generate AI Knowledge Governance Assessments that evaluate whether an organization is governing enterprise knowledge appropriately across data classification, RAG readiness, enterprise search, sensitive IP protection, private model readiness, auditability, provider risk, and AI cost governance
- Upload PDFs with source type and classification metadata
- Create diligence workspaces and upload multiple PDFs per investigation
- Ask cited executive questions scoped to the active investigation by default
- Generate technology due diligence reports for active investigations
- Generate Cyber Resilience Act readiness assessments for active investigations
- Generate scenario-specific 100-day technology operating plans from diligence findings
- Review 100-day plan executive one-pagers, timeline summaries, risk heatmaps, deliverables, owners, and board checkpoints
- Generate board summaries with citations, confidence, and limitations
- Render workflows in Streamlit without raw JSON
- Export board memos, diligence reports, executive one-pagers, 100-day plans, and evaluation reports as Markdown
- Run deterministic evaluation for citation quality, groundedness, relevance, and executive usefulness
Start here:
For a step-by-step executive demo, use:
Executive AI Advisor is currently safe for a local executive demo on your own machine. It is not ready to expose publicly. Before hosting it on a shared network or public URL, add authentication, lock down the database port, set APP_DEBUG=false, run Uvicorn without --reload, and protect or disable public API docs.
Mock is the default LLM provider. OpenAI, Anthropic, and Grok/xAI keys must be supplied through environment variables or the Streamlit password input for local demo sessions. Streamlit session keys are not saved by the app, and Markdown exports include provider/model metadata but never API keys. Never commit keys to the repository.
Run the lightweight tracked-file secret scan before commits:
python scripts/check_no_secrets.pyShort version:
cp .env.example .env
docker compose up --build
docker compose exec api alembic upgrade head
python -m pip install -r requirements.txt
streamlit run ui/streamlit_app.pyOpen:
- Streamlit UI:
http://localhost:8501 - FastAPI docs:
http://localhost:8000/docs - Health check:
http://localhost:8000/health
- Quick Start
- Methodology
- Exact Demo Tutorial
- User Guide
- Architecture
- From Architecture to Executive Value
- Developer Guide
- Demo Script
- Evaluation
- Governance
- AI Knowledge Governance Assessment
- AI Replicability Risk Assessment
- Security
Use feature branches and pull requests into main. See Contributing, Branch Protection, and Release Checklist for the recommended protected-main workflow, required CI check, and release validation steps.
Executive AI Advisor automates portions of the CTO Operating System advisory methodology through document ingestion, retrieval, citations, diligence reports, board briefs, and 100-day technology plans. See Methodology for how this software platform relates to the CTO Operating System repository.
Executive AI Advisor is the evidence-producing assessment layer for AI Knowledge Governance. It assesses knowledge governance, IP protection, and AI readiness based on uploaded evidence.
This repository is part of a broader Technology Leadership Portfolio: a practical system for assessing, operating, governing, implementing, and measuring technology organizations.
| Layer | Repository | Purpose |
|---|---|---|
| Methodology | CTO Operating System | Defines CTO, diligence, governance, board reporting, and operating partner frameworks |
| Assessment | Executive AI Advisor | Converts company documents into diligence reports, board briefs, CRA readiness assessments, AI governance assessments, and 100-day technology plans |
| Implementation | K8s Platform Blueprint | Provides implementation patterns for platform governance, FinOps, observability, policy controls, and compliance evidence |
| Measurement | Engineering Operating Metrics | Measures delivery flow, review quality, rework, engineering cost, AI usage cost, risk, and engineering governance |
This repository provides the assessment and planning layer. See Technology Leadership Portfolio.
Synthetic diligence datasets are available for local demos and testing:
- SampleCo: mid-market B2B SaaS growth equity diligence.
- FinTechCo: regulated fintech / compliance-heavy diligence.
- AcquisitionTargetCo: founder-led acquisition diligence and M&A integration readiness.
Executive AI Advisor separates company evidence, executive outputs, and evaluation so the same source documents can support multiple board-ready workflows:
- Create or select a diligence workspace for a company or deal.
- Upload and classify source documents.
- Process documents into cited evidence.
- Generate executive-ready scorecards, briefs, plans, and AI governance assessments.
- Export Markdown outputs for board packets, operating reviews, and diligence discussions.
- Evaluate output quality and store evaluation runs.
See Architecture for the full system design.
The Streamlit UI includes an Executive Decision Modules section for board, CEO, PE operating partner, and fractional CTO workflows. These outputs reuse the existing ingestion, retrieval, citation, diligence, and planning pipeline instead of duplicating RAG logic.
Available modules:
- Technology Risk Scorecard: red/yellow/green assessment across architecture, security, AI governance, data handling, cloud/infrastructure, delivery predictability, key-person risk, technical debt, and compliance readiness. Each row includes business impact, owner, timeline, success metric, and evidence where available.
- Board Brief Generator: concise board-ready summary with top technology risks, business impact, recommended board-level actions, decisions needed, management questions, confidence, limitations, and citations.
- 100-Day Technology Plan: scenario-specific operating plan for growth equity, acquisition integration, or turnaround contexts. Outputs include owners, outcomes, success metrics, risks reduced, and board/CEO visibility points.
- AI Governance Assessment: executive review of use case clarity, business alignment, data governance, security/privacy, model evaluation, human review, cost management, auditability, vendor/model dependency, and policy readiness.
API endpoints:
POST /executive/risk-scorecard
POST /executive/board-brief
POST /executive/100-day-plan
POST /executive/ai-governance-assessment
Each endpoint accepts document_set_id, uses the active investigation workspace as scope, and supports Markdown download from Streamlit.
100-Day Technology Plans are generated from Technology Due Diligence Report findings. The plan types are scenario-specific:
growth_equity: scale readiness, governance, delivery predictability, security, AI governance, hiring coverage, and FinOps.acquisition_integration: acquirer coordination, knowledge transfer, identity mapping, data migration readiness, deployment handoff, documentation, and support transition.turnaround: urgent stabilization, spend control, backup validation, production access review, vulnerability triage, production ownership, and operating discipline.
Streamlit renders the plan in two tabs:
- Executive One-Pager: concise board-readable current state, target state, top priorities, first 30 days, board decisions, success metrics, and dependencies.
- Full 100-Day Plan: timeline summary, plan at a glance, risk heatmap, phase-based actions, deliverables, success metrics, citations, board checkpoints, dependencies, and limitations.
Risk and confidence scoring are shown in the Technology Due Diligence Report and carried into the 100-day plan risk heatmap. The heatmap includes category, risk rating, confidence, evidence count, and primary recommended action. CRA Readiness Assessment adds EU Cyber Resilience Act-oriented readiness review for software/product companies, including missing evidence, management questions, board discussion points, and a 90-day readiness plan. Markdown downloads are available for the executive one-pager, full 100-day plan, diligence report, CRA readiness assessment, board memo, and evaluation report. Export filenames include the investigation name, report type, plan type when applicable, and generation timestamp.
Alembic is the source of truth for database schema creation and schema changes. Docker runs alembic upgrade head before starting the API, and the command can be run explicitly after pulling schema changes:
docker compose exec api alembic upgrade headIf a local development volume has stale schema state, see Quick Start or Developer Guide for the reset workflow. docker compose down -v deletes local database data.
Executive AI Advisor is an early portfolio-grade MVP. It is intended to demonstrate CTO-level architecture, AI governance thinking, secure RAG patterns, and executive decision-support workflows.
Implemented:
- FastAPI backend
- PostgreSQL with pgvector
- Docker Compose local stack
- Alembic migrations
- SQLAlchemy models
- PDF upload, parsing, chunking, embeddings, search
- cited Q&A
- board summary generation
- executive risk scorecard, board brief, 100-day plan, and AI governance modules
- technology due diligence report and 100-day plan generation
- CRA readiness assessment
- executive one-pager, timeline summary, and risk heatmap outputs for technology planning
- Streamlit UI
- deterministic evaluation framework
- SLSA provenance and security documentation
Planned:
- authentication and role-based access control
- multi-document synthesis
- background jobs
- richer export formats
- hosted deployment profiles
- RAGAS or LLM-as-judge evaluation
- audit logs and governance dashboards
Apache 2.0. See LICENSE.