A. Service Scope and Client Fit
A1We are not a crypto company. Is this service relevant to us?
Yes, if you use AI, plan for long-lived encrypted data, build connected products or run 5G networks. Web3 is one of six areas; AI governance and post-quantum planning apply to most large organisations.
A2Which sub-service should we start with?
The one closest to a launch or a rule: a smart contract audit before deployment, AI governance if staff already use AI tools, a cryptographic inventory if you hold data that must stay confidential for years, or vehicle and 5G testing before market approval.
A3Do you audit smart contracts on all chains?
Codec Networks audits contracts on major EVM-compatible chains and other common platforms. The scoping call confirms the languages, chains and integrations in scope.
A4Can you review our tokenisation platform before launch?
Yes. Codec Networks reviews issuance, redemption, custody, investor protection and fraud risks, and audits the related smart contracts.
A5How is AI governance different from AI security testing?
Governance sets who owns AI, which uses are allowed and how they are approved. Security testing checks whether specific AI systems can be attacked, for example through prompt injection. Codec Networks provides both.
A6Why think about quantum computing now?
Because data stolen today can be stored and decrypted later, and because changing cryptography across systems and vendors takes years. NIST's draft guidance proposes deprecating vulnerable algorithms after 2030.
A7Do you test vehicles and hardware?
Yes, with the manufacturer's authorisation and in agreed lab or test environments: ECUs, gateways, telematics units, mobile apps and backend APIs.
A8Can you protect our brand in virtual worlds and games?
Yes. Codec Networks maps your virtual presence, monitors for counterfeit goods and impersonation, reviews customer account security and builds takedown playbooks with your counsel.
B. Standards, Laws and Regulatory Alignment
B1What is ISO/IEC 42001?
ISO/IEC 42001:2023 specifies requirements for an AI management system: policies, roles, risk and impact assessment, controls and continual improvement. Organisations can be certified to it by accredited certification bodies.
B2Does India regulate AI?
As general information: India's AI Governance Guidelines, released by MeitY in November 2025, take a principles-based approach under existing laws rather than a separate AI statute. Sector regulators, such as RBI through its FREE-AI Committee report, also give guidance.
B3Which post-quantum standards exist?
NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024. NIST's draft IR 8547 sets out a proposed transition timeline.
B4Which rules apply to VDA platforms?
As general information: a March 2023 notification brought virtual digital asset service providers within the PMLA, with FIU-IND registration and reporting, and the Income-tax Act taxes VDA income and requires TDS. CERT-In's 2022 Directions also cover VDA service providers.
B5What is UNECE Regulation No. 155?
A UN regulation requiring vehicle manufacturers to operate a certified cyber security management system and to show that vehicle types are protected against cyber threats, as a condition of type approval in participating markets. Regulation No. 156 covers software updates.
B6What do India's Telecom Cyber Security Rules require?
As general information: the Telecommunications (Telecom Cyber Security) Rules 2024, notified on 21 November 2024, require telecom entities to appoint a Chief Telecommunication Security Officer and to report security incidents within six hours of becoming aware, with details within 24 hours.
B7Are virtual goods protected by trade mark law?
Trade mark and copyright laws can protect brands and creative works in virtual goods. In February 2023 a US jury found that 'MetaBirkins' NFTs infringed Hermès' trademarks. Brands should take legal advice on registration classes and enforcement.
B8Which standards apply to decentralised identity?
The W3C Decentralized Identifiers v1.0 (2022) and Verifiable Credentials 2.0 (2025) Recommendations, and, for EU-facing services, the European Digital Identity framework under eIDAS 2.
C. Engagement Approach and Delivery
C1How does a smart contract audit work?
Codec Networks agrees the commit and scope, runs automated analysis, reviews the code manually with two auditors, tests critical functions, reports findings by severity and re-audits the fixes.
C2Do you need our source code?
For smart contract and AI system reviews, yes. Code is handled under NDA and Codec Networks' ISO/IEC 27001:2022 certified ISMS.
C3How do you test an AI system safely?
In an agreed environment, with test accounts and data, Codec Networks attempts prompt injection, jailbreaks and data leakage and reviews agent permissions. Live customer data is not used without approval.
C4How do you build a cryptographic inventory?
Through architecture reviews, tool-assisted discovery of certificates, keys and libraries, and vendor questionnaires, producing a cryptographic bill of materials.
C5Do you need test vehicles or lab access?
Yes. Vehicle testing needs test vehicles, benches or ECUs, and written authorisation. Codec Networks agrees the environment and safety rules in advance.
C6Can you test a live 5G network?
Only with the operator's written authorisation and in agreed windows. Most testing is done in lab or staging environments that mirror production.
C7How do you avoid slowing our releases?
Audits and tests are planned around release dates, critical findings are shared immediately, and re-audits focus on changed code.
C8Who decides whether to launch?
The client does. Codec Networks provides findings, residual risks and a launch risk memo for the steering committee or Board.
D. Commercials, Timelines and Effort
D1How are audits and tests priced?
By level and by scope drivers such as lines of code, number of systems, environments and markets. Document 7 gives indicative bands; a written proposal confirms them.
D2How long does a smart contract audit take?
Typically two to six weeks, depending on code size and complexity, plus time for fixes and a re-audit.
D3How long does ISO/IEC 42001 certification take?
Typically four to eight months to readiness, followed by the certification body's audits. It is faster if an ISO/IEC 27001 ISMS already exists.
D4How long does a post-quantum roadmap take?
Typically six to twelve weeks for the inventory and roadmap. The migration itself runs over several years.
D5Are lab, hardware and tool costs included?
No. Test vehicles, hardware, specialist tools and lab time are listed separately in proposals.
D6Do re-audits cost extra?
One re-audit round is included at Basic and Medium levels and two at Advanced; further rounds are priced separately.
D7Can we use a retainer for frequent upgrades?
Yes. Retainers cover upgrade reviews, monitoring and advice for platforms that release often.
D8Do bundles cost less?
Yes. Launch Ready, AI and Digital Assets and Future-Ready Enterprise bundles cost less than their parts because inventories and threat models are reused.
E. Reporting, Evidence and Ongoing Support
E1What will leadership receive?
A short pack: inventories of AI, Web3, cryptography and connected systems, key findings and fixes, launch decisions and roadmap progress.
E2Can we publish the audit report?
Many Web3 projects publish audit reports. Codec Networks agrees the publication format in the engagement terms and reports the commit audited and fixes verified.
E3Does an audit guarantee our contract is safe?
No audit can guarantee the absence of all flaws. Codec Networks reports what was reviewed, how and what was found, and recommends monitoring and bug bounty programmes.
E4How do you keep the AI register current?
Through approval gates for new AI use, owners for each system and quarterly reviews under a retainer.
E5Will you track new rules?
Yes. Under a retainer, Codec Networks tracks AI, VDA, telecom, vehicle and cryptography rules and updates policies and roadmaps.
E6What evidence helps with vehicle type approval?
TARA documents, test reports, cyber security management system processes and software update records, prepared for the approval authority.
E7What happens if an exploit occurs after launch?
Codec Networks' forensic and incident response teams can help, including blockchain tracing and root-cause analysis, and the protocol is re-reviewed.
E8How often should we review our post-quantum roadmap?
At least annually, and when NIST, CERT-In or sector regulators publish new guidance or vendors update their products.
