All services Every engagement has a fixed, published price. Book a strategy call
A practical UK buying guide to AI governance consulting: the five jobs, the four conflicts of interest, the credentials worth checking, the artefacts to demand and the fees to expect.
Two years ago almost nobody sold AI governance. Now everybody does. Strategy houses, law firms, accountancy practices, cyber consultancies, data teams, platform vendors and a large number of newly formed one person advisories all describe themselves in the same words, against the same regulation, to the same buyers.
That makes the decision unusually hard, because the normal signals do not work. Nobody has a ten year track record in a field this young. Case studies are thin because most programmes are still running. Frameworks are public documents, so quoting the EU AI Act or ISO/IEC 42001 back at you proves nothing at all.
This guide sets out the tests that do work. It covers the five separate jobs people mean when they say AI governance consulting, the conflicts of interest that quietly rule some firms out of some of those jobs, the credentials worth checking, the artefacts to demand before you sign, and the commercial shape that protects you. Every fee named here is published on our own service pages.
The short answer. Decide which of five jobs you are buying before you shortlist anyone: finding the AI you already run, building the governance function, running it month by month, certifying it against ISO/IEC 42001, or auditing it independently. Then test the firm for conflicts, because a firm that builds your function cannot credibly audit it and a firm that resells a governance platform cannot advise you neutrally on tooling. Ask for four artefacts from real engagements: a redacted AI register, a written risk tiering rubric, an intake and approval form, and a genuine board report. Insist on named people in the contract, a fixed scope in writing and a defined handover. Our own floors are the AI Governance QuickScan from £15,000 + VAT, the AI Governance Office build from £30,000 + VAT and AI Risk-as-a-Service from £8,000 + VAT per month.
A buyer of cyber security services has decades of signals to lean on. Public certification registers, accredited assessment bodies, named qualifications and a well understood chain of who is allowed to assess whom. AI governance has almost none of that yet, and the gap creates four specific problems.
The first is that experience claims cannot be checked in the usual way. The EU AI Act entered into force in August 2024 and ISO/IEC 42001 was published in December 2023. Anyone claiming long experience is really describing adjacent work such as model risk management, data protection or algorithmic review. That adjacent work is often genuinely relevant. The honest firms tell you which parts of their experience transfer and which do not.
The second is repositioning. A great many teams that sold data strategy, GDPR remediation or cloud migration in 2023 now sell AI governance with substantially the same people. Sometimes the transfer works well. Often it produces a policy document and a spreadsheet, and nothing that survives contact with a live use case.
The third is that the quality of the work stays invisible until something fails. A penetration test finds holes on the day. A governance function proves itself in month four, when an unexpected use case arrives and the process either catches it or does not.
The fourth is that the rules are still moving. The June 2026 Digital Omnibus moved some EU AI Act deadlines and left others exactly where they were. A partner who cannot tell you which is which inside the first meeting is not current, and being current is most of the job.
Most disappointing engagements start with the wrong brief. A request for help with AI governance covers five different pieces of work with different skills, durations and providers. Write down which one you are buying and the shortlist narrows itself.
| The job | What good looks like | Who suits it | Our published floor |
|---|---|---|---|
| Find the AI you already run | Every use case inventoried, including the tools staff adopted without asking, each one risk tiered against written criteria | Firms that do fieldwork and interviews rather than issue a survey and summarise the replies | AI Governance QuickScan from £15,000 + VAT over two weeks |
| Build the function | Policy, intake, tiering, approvals, controls and reporting, piloted on your own use cases before anyone signs a handover | Firms with operating model experience and practitioners who have run a governance function | AI Governance Office from £30,000 + VAT |
| Run it month by month | A named owner keeping the register current, reviewing new use cases within days and writing the board report | Firms willing to take a monthly retainer with the exit designed in from the start | AI Risk-as-a-Service from £8,000 + VAT per month |
| Certify it | An AI management system built to the standard and taken successfully through an external certification audit | Firms with practising lead auditors, working alongside an accredited certification body rather than pretending to be one | ISO/IEC 42001 implementation from £25,000 + VAT |
| Audit it independently | Controls tested, claims verified, evidence behind every verdict, addressed to the board or the audit committee | Firms with no involvement whatsoever in building the thing they are auditing | AI governance review from £15,000 + VAT |
If you cannot decide, buy the first job. Two weeks of evidence prices the other four accurately, and it regularly shows that the thing you assumed you needed is not the thing you need. That is the whole argument for starting small.
This is the section large firms leave out, because it constrains them. Independence in AI governance is a practical matter rather than an abstraction. Four common commercial positions create a real conflict, and each rules a firm out of specific jobs rather than out of the market.
| The position | The conflict it creates | What it rules out | Put this question in writing |
|---|---|---|---|
| The firm also builds your AI | Advice on whether a use case should proceed is advice about its own delivery pipeline | Independent audit, and any final approval decision over systems it built | Which of the AI systems in scope did you build, configure or supply? |
| The firm resells or implements a governance platform | Tooling advice arrives with a commercial preference already attached to it | Neutral tool selection, and any needs assessment where the right answer might be to buy nothing | Do you hold any reseller, referral or partner agreement with a governance platform vendor, and what does it pay you? |
| The firm is also a certification body | Consulting on a management system it will later certify breaks the accreditation rules it operates under | Consulting and certification on the same management system | Are you the certification body, or do you prepare us for one? |
| The firm built the function you now want audited | Reviewing your own design produces confirmation rather than assurance | Independent assurance over its own prior work | If we ask you to audit this in a year, will you do it or hand it to another firm? |
None of these positions is disqualifying by itself. A platform implementer can be an excellent platform implementer. The failure happens when a firm holds one of these positions and sells you the job it is conflicted out of. Ask the four questions in writing and keep the answers with the contract, because a written disclosure changes behaviour in a way a conversation does not.
Credential claims in this market run from serious to decorative. Three tests separate them. Is it awarded by an independent body, does it require assessed competence rather than attendance, and can you verify the named individual rather than the firm.
| The claim | What it means | How to check it |
|---|---|---|
| ISO/IEC 42001 lead auditor | Assessed competence to audit an AI management system against the standard | Ask for the certificate number and the awarding body, then confirm the body is recognised |
| IAPP AI governance professional | A professional certification requiring a passed examination rather than attendance | Ask for the credential holder name and check it against the certification directory |
| ISO/IEC 27001 lead auditor or lead implementer | Directly relevant, because the ISO/IEC 42001 machinery reuses the ISO 27001 structure | Certificate number plus awarding body, and ask how recently they audited |
| Practising auditor on a certification body pool | The individual audits for a living rather than only advising on audits | Ask which certification body, in which scheme, and for how long |
| Certified AI governance professional with no named awarding body | Frequently a two day course with an attendance certificate at the end | Ask who awarded it and whether there was an examination. Silence is the answer |
| Firm level badges such as AI Act ready or responsible AI certified | Self awarded marketing in almost every case, because no accreditation scheme certifies advisory firms in AI governance | Ask which accreditation body issued it and expect no answer |
Credentials are a floor rather than a decision. The strongest single signal is a named individual who both holds a relevant qualification and does the work in front of you, because the most common failure in advisory work is a senior practitioner in the pitch and a graduate analyst in delivery.
Methodology slides cost nothing to produce. Artefacts cost real engagements. Ask for four redacted examples and give the firm a week. What comes back tells you more than any reference call.
Two further requests are worth making where your exposure is regulatory. Ask how the register connects to your data protection impact assessments, because most AI use cases touch personal data and the ICO guidance on AI and data protection expects that link to exist. Then ask what happens procedurally when a use case turns out to be high risk under the EU AI Act, because the answer reveals whether the firm has ever handled one.
The United Kingdom has no AI Act. UK regulation of AI runs through existing regulators applying existing law, following the approach the government set out in its white paper on AI regulation. Your obligations therefore depend on what you do and who you do it with rather than on one statute you can read in an afternoon.
The EU AI Act still reaches a great many UK organisations, because it follows the market rather than the company. If your AI touches EU customers, users or markets it can attach. A capable partner establishes this in a first conversation using three questions. Where are the people affected by the output, what role do you play for each system, and which of your systems fall inside the Article 50 transparency duties. Those duties were never delayed and land on 2 August 2026, with AI content marking following on 2 December 2026.
Two failure modes are worth watching for. The first is a firm selling full conformity work to a UK organisation with no EU exposure at all. The second is the reverse, where a firm reads the June 2026 Digital Omnibus as a general postponement and misses the transparency duties that never moved. Our guide to the EU AI Act for UK companies sets out which dates still stand and which shifted.
Ask about your sector regulator as well. Financial services, healthcare, education and public sector procurement each carry expectations sitting above the general position. A partner who has never dealt with yours will be learning at your expense and on your timetable.
Two models dominate this market. Day rate models transfer scope risk to you, because every meeting, revision and additional workshop is chargeable and the total stays unknown until the end. Fixed fee models transfer that risk to the firm, which is why they require a proper scoping conversation first. For governance work with a defined output, fixed fee is almost always the better purchase.
| Term | What to insist on | Why it matters |
|---|---|---|
| Fee | A published floor and a fixed figure agreed in writing before day one | Removes the open ended exposure that makes governance budgets drift |
| Scope | Written deliverables naming the actual artefacts rather than describing activity | Support with AI governance cannot be tested against anything at the end |
| People | Named individuals in the contract, with notice and consent if they change | Prevents the senior pitch and junior delivery pattern |
| Ownership | The register, policies and rubric are yours, in your systems, in editable form | Governance held inside the firm own template is leverage rather than an asset |
| Exit | A defined handover, and a stated notice period on any retainer | A function you cannot take back is a subscription with a governance label |
| Independence | A written statement of what else the firm sells and where it is affiliated | Makes the conflict test enforceable rather than conversational |
Our own floors are published on the service pages. The AI Governance QuickScan starts from £15,000 + VAT, the AI Governance Office build from £30,000 + VAT, AI Risk-as-a-Service from £8,000 + VAT per month, EU AI Act readiness from £18,000 + VAT, ISO/IEC 42001 implementation from £25,000 + VAT and an independent AI governance review from £15,000 + VAT. Our guide to AI governance cost in the UK explains what moves each figure up from the floor.
We are a specialist advisory and assurance firm. AI governance sits alongside enterprise architecture, cyber assurance, ISO certification support and data governance, which matters because AI governance fails most often at the joins with those disciplines rather than in the middle of any one of them.
What we do. We find the estate in two weeks, build the function and pilot it on your real use cases, run it monthly where you want that, implement ISO/IEC 42001, and audit AI governance built by other people. Fees are published as floors and fixed in writing before work starts. Senior practitioners deliver the work they sold.
What we do not do. We are not a certification body, so we prepare you and an accredited body certifies you. We do not resell AI governance platforms and hold no vendor commissions, which is why our tooling advisory includes the option of buying nothing. We do not audit functions we designed, so where we built it the audit goes to someone else. If what you need is model development, machine learning engineering or data science delivery, we are the wrong firm and will say so in the first call.
Where to start depends on the job. If you do not know what AI you are running, start with the QuickScan. If you know and need the function, start with the Office. If you need an independent opinion on something already built, start with the review. Our related guides cover what AI governance is, the difference between governance and assurance, how to build the office and what ISO 42001 covers. The equivalent buying guide for data work is choosing a data governance firm in the UK. When you are ready, speak to a senior practitioner and bring the honest version of what you have.
In practice it covers five separate jobs: inventorying and risk tiering the AI you already run, designing and building the governance function, operating that function month by month, implementing ISO/IEC 42001 for certification, and independently auditing governance somebody else built. Most firms are strong at one or two of these. Very few are credible across all five, and none can honestly do the build and the independent audit of the same function.
With Intelance the AI Governance QuickScan runs from £15,000 + VAT as a two week fixed fee, governance build programmes from £30,000 + VAT, AI Risk-as-a-Service from £8,000 + VAT per month, EU AI Act readiness from £18,000 + VAT, ISO/IEC 42001 implementation from £25,000 + VAT and an independent AI governance review from £15,000 + VAT. All are floors, fixed in writing after scoping. Across the wider market, day rate engagements are common and make the total hard to predict, which is the main reason we publish fixed floors instead.
Ask for four redacted artefacts from real engagements: an AI register, a written risk tiering rubric, an intake and approval form and a board report. Ask for the names of the people who will do the work and for one contactable owner of a function they built that is still running. Verify individual credentials with the certificate number and awarding body rather than accepting a firm level badge. If the artefacts do not arrive within a week, they do not exist.
It depends on the job and on the conflicts. Large firms bring scale, sector coverage and the ability to staff a wide programme quickly, and they often carry other relationships with you that need declaring. Specialists bring senior people on the actual work and fewer conflicts, with less capacity for very large parallel programmes. The useful question is not size. It is whether the firm can do the specific job you named without a conflict, and whether the people who impressed you in the meeting are the people who will turn up.
No, and a firm that offers both over the same function is telling you something important about its assurance work. Build and independent audit require different positions. We build functions and we audit functions, and where we built it the audit goes to another firm. Boards and audit committees apply this test even where nobody has written it down for AI yet.
Many do, for two reasons. Existing UK law already applies to AI through data protection, equality, consumer, employment and sector specific regulation, and regulators are actively examining AI decisions. Separately, the EU AI Act follows the market rather than the company, so UK organisations whose AI touches EU customers or users can be caught, with Article 50 transparency duties landing on 2 August 2026. The right first step is establishing which of these applies to you.
The inventory, in almost every case. You cannot govern, budget for or defend an estate you have not counted, and shadow AI adopted inside teams is usually a material part of what is running. Two weeks of evidence prices every subsequent decision, and it frequently changes what the organisation thought it needed.
Two weeks for a defensible picture of the estate and the risk tiers. Six to twelve weeks to design, pilot and hand over a function with intake, tiering, approvals and reporting. Three to six months for a certifiable ISO/IEC 42001 management system. The part that determines success is not the build. It is whether the monthly rhythm still runs in month six, which is why the handover and the named owner matter more than the framework.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
