Four weeks. £18,000 fixed. ISO 27001 and SOC 2-aligned controls mapped to your AI surface, a model risk management framework your regulator will recognise, human-in-the-loop and audit logging where they matter, and the written documentation an auditor will actually accept.
You ship AI into a regulated sector — financial services, healthcare, defence, forensics, critical infrastructure, legal — or you sell into enterprise customers whose procurement teams have started asking specific questions about how your AI is governed. You do not have six months to stand up an internal risk function. You need a framework your team can operate, documentation an auditor will accept, and controls mapped onto the standards your customers test against.
Week 1: scoping workshop with founder / CTO / data protection officer. We map your current state against the relevant standards. Week 2: drafting the controls and the framework. Week 3: implementation support — sitting in on sprints to make sure the framework actually lands in the code, not just the policy doc. Week 4: final documentation pack, walkthrough with the team, and (if relevant) a dry-run Q&A simulating an external audit.
No — that role must sit inside your organisation to satisfy most regulators. I equip whoever does hold it with the controls, documentation, and evidence base they need to do the job.
Yes, to the extent relevant to your system. If you operate a system that is high-risk under Annex III, the framework covers the Article 9 risk-management, Article 10 data-governance, and Article 15 robustness requirements. Specific conformity assessment remains a separate external process.
Yes, and often should. Governance wired in during build is far cheaper than governance retrofitted afterwards.
Book a 30-minute discovery call. I will tell you honestly whether this engagement is the right fit or whether you need a different path.
Book discovery call →