All services Every engagement has a fixed, published price. Book a strategy call
AI governance builds control. AI assurance proves it, independently. The clean separation between the two, when you need each, what each costs, and the structural independence rule to demand from anyone offering both.
The two terms travel together in vendor decks and conference agendas, usually as if they were synonyms. They are not, and the difference is expensive to learn by accident. Organisations that confuse them end up with one of two problems: a governance team marking its own homework, or an audit report describing gaps that nobody was hired to fix.
This guide separates the two cleanly, shows where each one earns its keep, and explains the independence rule that should govern anyone offering you both.
The short answer. AI governance is the management system that keeps AI under control: the inventory, approvals, monitoring and evidence an organisation runs for itself. AI assurance is the independent verification that the control works, carried out by someone who did not build it, so that a board, customer, regulator or insurer can rely on the answer. Governance is done by you. Assurance is done to what you did.
AI governance is an operating capability. It answers, continuously: what AI do we run, who approved it, what is each system allowed to do, and how would we know if it went wrong. It is built and run by the organisation itself, and the working design is set out in our enterprise AI governance blueprint.
AI assurance is a verdict. It answers, at a point in time: does the control described exist, does it run, and can the claims made about this system or estate be evidenced. Its defining property is independence: the person giving the verdict must have no stake in what the verdict says.
| Dimension | AI governance | AI assurance |
|---|---|---|
| Purpose | Control: keep AI under named ownership and proportionate approval. | Confidence: prove to someone else that the control works. |
| Done by | Your own people, sometimes with outside help to build it. | A party independent of the people who built or run it. |
| Output | Registers, approvals, monitoring, evidence packs. | A written opinion, review report or certification. |
| Tested against | Your policy, the EU AI Act, ISO/IEC 42001, your risk appetite. | Evidence. Claims are verified at source rather than taken on trust. |
| Timing | Continuous: it runs every day the estate changes. | Point in time, repeated on a cadence or on material change. |
| Relied on by | Management, to run AI safely. | Boards, customers, regulators, insurers, acquirers. |
Three failures follow reliably when the two are blurred.
Self-marked homework reaches the board. When the team that runs AI governance also reports on its effectiveness, the board receives assurance shaped information with none of its properties. Every incumbent has an honest incentive to describe their own controls generously, which is precisely why assurance exists as a separate discipline.
An audit is bought where a build was needed. An assurance review of an organisation with no inventory and no approval path produces an accurate, expensive description of nothing. If the capability does not exist yet, governance comes first. The review comes after there is something to verify.
Self-assessment is offered where independence was demanded. Enterprise customers, insurers and regulators increasingly specify independent verification. A confident internal report, however good, does not meet the specification, and discovering that mid procurement costs deals.
In practice, assurance work arrives in five forms. An independent review of the governance itself: does the inventory exist, does the approval path run, would the evidence survive scrutiny. Our AI Assurance Review is exactly this, from £15,000 + VAT in two to three weeks, and it is the most requested review we run. System level assurance: testing the controls and claims around one material or high risk system before it carries weight. Certification audits: an accredited body examining an AI management system against ISO/IEC 42001. Supplier assurance: verifying what your vendors claim about the AI in their products, covered by our Supplier AI &. Cyber Risk Assessment from £8,500 + VAT. And deal assurance: AI risk examined inside M&A technology due diligence from £15,000, where an inherited ungoverned estate becomes the buyer’s problem on completion day.
One rule keeps the whole arrangement honest: if we built it, we do not assure it. It is the standing principle of our assurance practice, and it deserves to be a standing question in your procurement.
The reason is structural rather than moral. An assessor reviewing their own build has an interest in the answer, and no amount of professionalism removes an interest. It can only be removed by separation. This cuts both ways, and we say so plainly: if Intelance built your AI governance, the independent review of it should be done by someone else, and we will say exactly that when asked. A firm that offers to build your controls and certify its own work in the same engagement is selling you a conflict with a cover page.
So when any adviser, including us, offers both disciplines, ask one question: what happens when the same firm has done both sides of the work? The only good answer is a structural one.
The honest sequencing rule: build before you verify, and never pay the same party to do both on the same work.
An audit is one form of AI assurance, usually the most formal, tested against a defined standard such as ISO/IEC 42001. Assurance is the wider family: independent reviews, system level testing, supplier verification and deal due diligence all belong to it. Everything in the family shares one property: the person giving the opinion did not build the thing being examined.
Yes, for different pieces of work, and never on its own build. A firm can help one client build governance and independently assure another client’s, but assuring work it delivered itself removes the independence that gives assurance its value. Ask any firm offering both how the separation works structurally. If the answer is a promise rather than a structure, treat the assurance as marketing.
At Intelance the prices are published: an independent AI Assurance Review from £15,000 + VAT, delivered in two to three weeks. Supplier AI risk assessment from £8,500 + VAT, and AI risk within M&A technology due diligence from £15,000.
Yes. Certification by an accredited body is a formal kind of assurance: an independent examination of your AI management system against a published standard. It proves the system runs. It does not replace system level testing of individual high risk models, which is why mature organisations use both.
Assurance is point in time, so it decays as the estate changes. A sensible cadence is a full independent review annually, plus reassurance after material change: a new high risk system, a major vendor shift, an incident, or new obligations taking effect. Enterprise customers increasingly expect the annual rhythm.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance