AI governance and ISO/IEC 42001 readiness
The artefact your enterprise clients ask for first is not a certificate — it is an AI system register and a governance story. We build both, score you honestly against ISO/IEC 42001 Annex A, and hand you a roadmap with effort and cost attached to each step.
Certification and consultancy have to be separate businesses
ISO/IEC 17021-1 requires the body that certifies you to be independent of the consultancy that advised you. Any consultant offering to certify their own work is selling you a problem. We prepare the management system and the evidence pack; an accredited body certifies it.
- A written conflict check before every engagement
- An independence statement in every report
- Introductions to accredited bodies, and we stay out of the room
Stated in advance, delivered as described.
Scored gap analysis
ISO/IEC 42001 Annex A controls assessed one by one, with the specific evidence gap named for each and a priority attached.
AI system register
Complete inventory: purpose, owner, data flows, model, subprocessors, DPIAs, review cadence. The document enterprise procurement asks for before anything else.
AI risk assessment
Likelihood, impact and treatment per system, aligned to your existing risk framework rather than bolted alongside it.
Remediation roadmap
Each step with effort, cost, owner and sequence — so the board can approve a programme rather than a principle.
Full readiness pack
Complete policy set, management-system documentation, governance structure and RACI, and a certification-ready evidence pack.
Governance retainer
From a month: register upkeep, new-tool assessments before rollout, annual policy refresh and quarterly board notes.
Four steps, no surprises.
Scope and boundaries
Which systems and business units are in scope, and what the standard would require of your size of firm. Some firms need the register and the policy, not a certification programme.
Assessment
Six to eighteen days depending on scope: documentation review, interviews, control testing against Annex A.
Roadmap and pack
Prioritised findings and, where you take the full pack, the policy set and evidence pack your certification body will ask for.
Handover to certification
We brief your internal owner, help you choose a certification body, and step back. We never sit in the audit.
Fixed numbers. The invoice matches the proposal.
| Engagement | Cost | Turnaround | What it covers | |
|---|---|---|---|---|
| AI governance gap analysis | $4,500 – $6,000from · ISO/IEC 42001 | 6–18 days |
A scored gap analysis against ISO/IEC 42001 Annex A and the artefact enterprise buyers ask for first: a complete AI system register.
|
Contact us → Estimated range $4,500 – $6,000 · how quotes work |
| AI governance full readiness | $10,000 – $14,000full pack | 3–6 weeks |
The complete management-system build: policy set, governance structure and a certification-ready evidence pack for your accredited body.
|
Contact us → Estimated range $10,000 – $14,000 · how quotes work |
| AI governance retainer | $1,250 – $2,500 / monthper month | Continuous |
For firms whose AI use changes every quarter: register upkeep, new-tool assessments before rollout, and an annual policy refresh.
|
Contact us → Estimated range $1,250 – $2,500 / month · how quotes work |
Payment. 50% on booking, 50% on delivery unless the option says otherwise. Card payment through Stripe, or invoice with bank transfer. Card details never touch our servers. Larger deployments are billed to milestones agreed in writing before work starts.
- Firms deploying AI with corporate or public-sector clients
- AI companies selling into regulated buyers
- Firms whose clients now ask for 42001 posture in tenders
- Firms that want AI governance to look like their AML governance