AI governance · Senior delivered, evidence based
AI Governance QuickScan
Every AI use case in your organisation found in two weeks, including the shadow AI in browser extensions and SaaS settings that nobody approved: risk tiered against the EU AI Act and ISO/IEC 42001, control gaps measured, and a plan your board can act on. From £15,000 + VAT fixed, with the EU AI Act transparency duties live from 2 August 2026 and high-risk obligations following from December 2027.
The QuickScan at a glance
Definition
What is an AI governance assessment?
An AI governance assessment establishes three things no board can currently answer from memory: what AI is in use across the organisation, including the shadow AI nobody approved. How each use case tiers against the EU AI Act and ISO/IEC 42001. Which controls exist, which are missing and which are theatre. It ends in a plan, because an inventory without one is just a longer list of worries.
The Intelance AI Governance QuickScan delivers all three in two weeks for a fixed fee from £15,000 + VAT, agreed in writing before day one and senior delivered throughout: the person in the interviews is the person who signs the report and walks your board through it.
If you want a first read before committing, the free AI governance readiness scorecard scores your position across fourteen areas in about five minutes, with no email address required.
The timing is no longer abstract. Prohibitions have applied since February 2025 and general-purpose AI duties since August 2025. The June 2026 Digital Omnibus moved Annex III high-risk obligations to 2 December 2027, while Article 50 transparency duties still land on 2 August 2026, with penalties up to €35 million or 7% of global turnover. Our guide to what AI governance is covers the board questions, and the wider practice is described under AI governance consulting.
Every finding reported
Sanctioned systems, vendor AI and the shadow AI in extensions and SaaS settings.
Tiered against the law
Every use case classified against the EU AI Act risk tiers and ISO/IEC 42001.
Control testing
What exists, what is missing and what is approval theatre.
A board walkthrough
Findings and the plan presented to the people who own the risk.
The hiding places
Six places AI risk hides
The risk is rarely in the systems on the official list. It is in the six places below, and the QuickScan searches all of them. Each card shows what you know at the end.
The real AI inventory
The official list says six systems. The estate says forty: copilots, browser extensions, SaaS features switched on by default and vendor models nobody registered.
Found hereEvery use case inventoried, owned and dated, including the embarrassing ones.EU AI Act exposure
Recruitment screening, credit decisions, biometric tools and safety systems tier as high-risk, whether or not anyone called them AI when they were bought.
Found hereEach use case tiered against the Act as amended, with the post-Omnibus dates mapped.Data pathways
What flows into prompts, training and vendor models: customer records, source code and personal data, usually without anyone ever deciding.
Found hereThe pathways from your data to external models, traced and judged.Vendor AI
AI arriving inside procurement: features in platforms you already run, models inside services you already buy, contracts that never mention it.
Found hereThe vendor AI surface mapped, with the contract gaps named.Controls and approvals
A policy exists, an ethics slide exists, and no actual control between a user and a model exists.
Found hereThe gap between written governance and real enforcement, measured.Standards alignment
Customers and regulators are starting to ask for ISO/IEC 42001 and evidence, rather than assurances.
Found hereWhere you stand against 42001, and what certification would take.How it works
How the ten working days run
The QuickScan runs to a published rhythm, so you know what is happening on every one of the ten days.
Evidence and access
A precise request list and tooling access agreed, so discovery measures the estate rather than the org chart.
Discovery
The inventory built from logs, licences, expenses and interviews: sanctioned AI, vendor AI and shadow AI surfaced together.
Testing and tiering
Each use case tiered against the EU AI Act and ISO/IEC 42001, and the controls around it tested rather than taken on trust.
Validation
Findings validated with their owners, so the report lands as recognition rather than accusation.
Board walkthrough
The inventory, the tiers and the plan presented to the board, with the post-Omnibus clock on one page.
Larger and more complex estates take longer, and we say which on the first call. The findings feed the AI Governance Office directly, so nothing is discovered twice.
Published fees
What the QuickScan usually uncovers next
Every route out of the findings is priced before you commit to it. Some organisations run the plan themselves, and that is a legitimate outcome.
AI Risk-as-a-Service
The governance run for you month by month: the inventory kept alive, new use cases tiered as they appear, and the board kept informed.Best whenAI is spreading faster than anyone can govern it side of desk. FeeFrom £8,000 + VAT / month 02AI Governance Office
The standing function designed and built: decision rights, an AI register, approval routes and board reporting that outlast any one project.Best whenThe QuickScan showed the gap is structural rather than occasional. FeeProgrammes from £30,000 + VAT 03ISO/IEC 42001 Implementation
The AI management system standard, implemented on the same evidence base, for customers and regulators who want certified proof.Best whenThe ask has moved from assurances to certification. FeeAIMS implementationPriced by scope 04
EU AI Act Readiness
Exposure mapped against the Act in depth: roles, obligations, documentation and the route to compliance before enforcement asks first.Best whenThe Act specifically is the board’s worry. FeeReadiness assessmentPriced by scope
The alternatives
This route against the alternatives
Three ways organisations respond when the board asks about AI. The difference is whether anyone looks.
A responsible AI policy and an awareness workshop, written before anyone knows what is running
Nothing. It governs an estate nobody has seen
Ignores it
Organisations certain they run almost no AI
A six month framework programme with a maturity model and a bench of analysts
Plenty, eventually, at programme pace and programme price
2 August 2026 arrives mid-programme
Enterprises with the appetite and the year to spend
Two weeks of evidence: the real inventory, the risk tiers and the plan, from £15,000 + VAT
The actual estate in two weeks, including the shadow AI
Built around the EU AI Act dates, board ready inside a month
Boards that need the real answer before the obligations bite
Scope
What is covered and what is not
You get
A complete AI inventory, including shadow AI and vendor AI, with an owner and a date on every entry.
Every use case tiered against the EU AI Act and ISO/IEC 42001, with the dates as amended mapped.
Controls tested, with the gap between written governance and real enforcement measured.
A costed, sequenced plan with owners and dates, ready for a budget holder.
A board walkthrough, so the people who own the risk hear it first hand.
This is not
A policy exercise. The estate is measured before anything is written about it.
A witch hunt. Shadow AI is surfaced to be governed, and findings are validated with their owners first.
A legal opinion. We map exposure and controls. Where formal legal advice on the Act is needed, we say so plainly.
The end. Most estates need the plan run, and the QuickScan prices exactly what that takes.
Where to start
Typical starting positions
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The standards we hold ourselves to
Senior delivered
The person in your interviews is the person who signs the report and walks your board through it. Nothing is handed to a junior bench.
Evidence over assurances
The inventory is built from logs, licences and expense lines rather than a survey, which is why it finds the shadow AI a questionnaire never will.
Tiered against the law as it applies
Every use case is mapped to the EU AI Act dates that matter, with the dates that stand on one page your board can hold.
One fixed published fee
From £15,000 + VAT depending on how many AI systems you run, agreed in writing before day one.
Governance that ships
The QuickScan ends in a plan with owners and dates, and the AI Governance Office exists only if you want the running done for you.
Who delivers this
Every QuickScan is led by a senior AI governance lead, end to end. Nothing is offshored and nothing is templated.
AI governance guides
All insights
Ready to talk?
Tell us what is driving the timing
Thirty minutes with the person who would run your QuickScan: what prompted the question, what you think you run and when the board next meets. With the 2 August 2026 transparency duties close and the high-risk dates following, two weeks of evidence beats another quarter of assumptions.
FAQs
Questions about the AI Governance QuickScan
What is an AI governance assessment?
A structured, evidence based answer to three questions: what AI is in use across the organisation, including shadow AI. How each use case tiers against the EU AI Act and ISO/IEC 42001. Which controls exist, are missing or are theatre. It ends in a costed plan and a board walkthrough.
How much does an AI governance assessment cost?
The AI Governance QuickScan runs from £15,000 + VAT with Intelance, fixed in writing before day one. The fee depends on how many AI systems you run and how complex the estate is, and larger setups are priced within the same published floor before work starts.
How long does it take?
Two weeks for most organisations: ten working days from evidence request to board walkthrough, to a published day by day rhythm. Larger and more complex estates take longer, and we say which on the first call.
What is shadow AI, and do you find it?
Shadow AI is every model and AI feature in use without approval: browser extensions, personal accounts on public tools, SaaS features switched on by default and vendor models nobody registered. We find it because the inventory is built from logs, licences and expense data rather than a questionnaire, and the shadow estate is usually several times larger than the official one.
Does the EU AI Act apply to UK companies?
Frequently, yes. The Act applies where AI systems are placed on the EU market or their outputs are used in the EU, so UK organisations serving EU customers are commonly in scope regardless of where they are based. The QuickScan maps which of your use cases that touches, and where formal legal advice is needed we say so.
What are the EU AI Act deadlines?
The Act entered into force in August 2024. Prohibitions have applied since February 2025 and general-purpose AI obligations since August 2025. The June 2026 Digital Omnibus moved Annex III high-risk obligations to 2 December 2027 and embedded systems to 2 August 2028, while Article 50 transparency duties land on 2 August 2026 and AI content marking on 2 December 2026. Penalties reach €35 million or 7% of global turnover.
What is ISO/IEC 42001?
The international management system standard for AI: the AI equivalent of ISO 27001, covering governance, risk, controls and continual improvement for AI systems. Customers and regulators increasingly ask for it, and the QuickScan shows where you stand against it and what certification would take.
What is in the report?
The complete inventory with owners and dates, each use case tiered against the EU AI Act and ISO/IEC 42001, the control gaps measured, a costed and sequenced remediation plan, and a board walkthrough. It is written to be acted on, and it feeds the AI Governance Office directly if you want the plan run.
What happens after the QuickScan?
Whatever the findings justify. Some organisations run the plan themselves. Others take AI Risk-as-a-Service from £8,000 + VAT per month, build the AI Governance Office, or proceed to ISO/IEC 42001. Each route is priced before you commit.