AI governance · Run month by month
AI Risk-as-a-Service
Your AI risk managed month by month by a named senior owner: the register kept alive, new use cases reviewed as they appear, controls checked, vendor changes watched, and the EU AI Act tracked onto one page your board reads. From £8,000 + VAT per month, fixed by scope, with no lock-in by design.
The service at a glance
Definition
What is AI Risk-as-a-Service?
AI Risk-as-a-Service is managed AI risk: the standing work of AI governance run for you month by month. The register kept alive, every new use case reviewed and tiered as it appears, controls checked rather than assumed, vendor and model changes watched, and the regulatory clock tracked. It exists because AI risk moves weekly, and governance built around an annual review is blind for eleven months of the year.
Intelance runs it from £8,000 + VAT per month, fixed by scope, with a named senior owner and no lock-in. The register and every piece of evidence live in your tools and are documented for handover, so the service is also called managed AI risk or an AI risk management service. The work is the same.
The register has to start from a verified picture: the AI Governance QuickScan from £15,000 + VAT provides it in two weeks, and an existing register from elsewhere works too. With the EU AI Act transparency duties live from 2 August 2026 and high-risk obligations following from December 2027, our guide to enterprise AI governance sets out the wider blueprint, and the practice is described under AI governance consulting.
A named senior owner
One accountable person runs your AI risk, month after month.
Your AI risk register stays current
New use cases enter within days of appearing, never at the annual review.
Controls checked
Tested on a rota, because controls decay quietly between audits.
One page for the board
Adoption, risk and the regulatory clock, monthly, in business terms.
The rhythm
What gets done month by month
Six standing jobs keep AI risk governed at the pace it moves. Each card shows the output your board and your next auditor will look for.
The register is maintained every month
Every AI use case current, owned and tiered, with new arrivals entering within days rather than at the annual refresh.
The outputA register the board and the auditor can both trust, any week of the year.Change watch
Vendors ship new AI features weekly, and the models under your existing tools change without announcement. Somebody has to notice.
The outputMaterial changes caught and re-tiered before they become surprises.Use case reviews
New ideas reviewed and tiered against the EU AI Act and your risk appetite, at a pace teams can plan around.
The outputAnswers in days, so shadow AI never looks faster than the process.Control checks
The controls between users and models tested on a rota: access, data boundaries, human oversight and logging.
The outputEvidence that accumulates monthly instead of being rebuilt for audits.Regulatory tracking
The EU AI Act obligations, UK developments and sector rules mapped to your actual use cases as both evolve.
The outputThe dates as amended, owned and dated, never news.The monthly report
What is running, what changed, what was approved, what went wrong and what is coming, on one page.
The outputA board that answers AI questions from this month rather than last year.How it works
How the service runs
The service starts from whatever state the register is in, settles into a monthly rhythm, and scales up or hands over on your terms.
Take-on
The register adopted or built, owners confirmed, the tiering checked and the rhythm agreed with a named senior owner.
The rhythm
Reviews, change watch, control checks and the one page report, every month, whatever else is happening.
The deep re-tier
The whole register re-examined against the current law and the current estate, because drift is quiet.
Change and incident
A vendor drops a new model or something goes wrong: the service absorbs it, re-tiers it and briefs the board.
Scale or take back
Step up to the fuller retained office, hand the rhythm to your own team, or carry on. The exit is designed in.
Starting from an unknown estate? The QuickScan gives the service its evidence base in two weeks. The fuller retained governance office, which adds forums, approvals and policy upkeep, is priced by scope above the base retainer.
Published fees
The services around the retainer
Every route in and out of the retainer is priced here, before you ask.
AI Governance QuickScan
The starting register: every use case found including shadow AI, tiered against the EU AI Act, in two weeks. Take-on starts from it directly.Best whenNobody yet has an inventory worth keeping alive. FeeFrom £15,000 + VAT2 weeks 02
AI Governance Office
The standing function designed and built: decision rights, intake, approval routes and board reporting. The fuller retained model adds forums, approvals and policy upkeep, priced by scope.Best whenThe gap is structural: intake and approvals need building too. FeeProgrammes from £30,000 + VAT 03ISO/IEC 42001 Implementation
The AI management system standard, implemented on the same register and evidence base this service keeps alive.Best whenCustomers or regulators want certified proof. FeeAIMS implementationPriced by scope 04
EU AI Act Readiness
Exposure mapped against the Act in depth: roles, obligations, documentation and the route to compliance before enforcement asks first.Best whenThe Act specifically is the board’s worry. FeeReadiness assessmentPriced by scope
The alternatives
This route against the alternatives
Three ways organisations handle AI risk after the first assessment. The difference is what happens in the gaps.
A consultant reviews AI risk once a year and leaves a report
The state of play on one day out of 365
Eleven blind months between reviews
Static estates with almost no AI adoption
AI risk added to the day job of whoever seemed most willing
Whatever survives the day job, which is less each quarter
The register decays quietly until an incident reads it aloud
Genuinely tiny AI footprints with slack and discipline
A named senior owner running the rhythm, from £8,000 + VAT per month
Changes within days: new use cases, new models, new obligations
Designed out: the rhythm runs whatever else is happening
Organisations where AI arrives faster than anyone can govern it
Scope
What is covered and what is not
You get
A named senior owner, accountable to you monthly, running the whole rhythm.
The six standing jobs run to schedule: register, change watch, reviews, control checks, tracking, report.
Tiering mapped to the frameworks that matter: the EU AI Act, ISO/IEC 42001 and the NIST AI RMF.
Evidence accumulating monthly in your tools, ready for any audit or customer question.
A documented handover from month one, so taking it in house is a decision rather than a rescue.
This is not
A lock-in. No minimum beyond take-on, and the register and evidence stay in your tools throughout.
An assessment on repeat. The service lives in the gaps between reviews, which is where AI risk moves.
The full governance office. Forums, approvals and policy upkeep are the fuller retained office, priced by scope above the base retainer.
A substitute for decisions. High-risk calls still land with your leadership. We make sure they arrive early and well framed.
Where to start
Typical starting positions
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The standards we hold ourselves to
The gaps are the job
AI risk moves between reviews: new tools weekly, models changing silently, obligations landing on a legal timetable. The service exists precisely there.
A named senior owner
One accountable person, month after month, so context never resets and the board always has someone to ask.
Mapped to the frameworks that matter
The EU AI Act, ISO/IEC 42001 and the NIST AI RMF, tracked as they evolve and translated into plain English.
Priced by scope and published
From £8,000 + VAT per month, fixed and agreed in writing, with the drivers of the fee stated plainly.
The exit is designed in
The register and evidence live in your tools with the handover documented from month one. Take it in house or step up to the fuller office, either way cleanly.
Who delivers this
Every retainer has a named senior owner, end to end. Nothing is offshored and nothing sits in a queue.
AI governance guides
All insights
Ready to talk?
Tell us how fast AI is moving for you
Thirty minutes with the person who would own your register: what you run, what arrived this quarter and who answers when the board asks. If the answer is that nobody knows, the QuickScan comes first, and we will say so.
FAQs
Questions about AI Risk-as-a-Service
What is AI Risk-as-a-Service?
The standing work of AI governance run for you month by month: the register kept alive, new use cases reviewed and tiered within days, controls checked on a rota, vendor and model changes watched, the regulatory clock tracked, and a one page report to the board. A named senior owner runs it, and the register stays yours.
How much does AI Risk-as-a-Service cost?
From £8,000 + VAT per month with Intelance, fixed by scope and agreed in writing. The fee is driven by how many AI systems you run and how fast new ones arrive. There is no lock-in beyond take-on, and the fuller retained governance office, which adds forums, approvals and policy upkeep, is priced by scope above the base retainer.
What gets done each month?
Six standing jobs: the register maintained with new use cases entering within days, change watch across vendors and models, use case reviews and tiering, control checks on a rota, regulatory tracking against the EU AI Act and beyond, and the one page monthly report. You see all six in every report.
Is this the same as managed AI risk or an AI risk management service?
Yes. AI Risk-as-a-Service, managed AI risk and AI risk management service describe the same arrangement: the standing work run externally with a named owner, evidence in your tools and a documented route to take it in house.
What is an AI risk register, and who owns it?
The living record of every AI use case: what it is, who owns it, what data it touches, how it tiers against the EU AI Act and your risk appetite, and what controls sit around it. It is yours throughout. We keep it alive in your tools, and it leaves with you if you ever take the rhythm in house.
How does take-on work?
Inside a month: the register is adopted or built, owners are confirmed, the tiering is checked and the rhythm is agreed. The QuickScan from £15,000 + VAT provides the starting picture where none exists, and an existing register from another provider works too.
Which frameworks is it mapped to?
The EU AI Act as amended by the June 2026 Omnibus, including the 2 December 2027 Annex III obligations. ISO/IEC 42001, so the evidence supports certification later. The NIST AI RMF for organisations reporting to US stakeholders. Tracking translates changes into what they mean for your actual use cases.
What happens when something goes wrong mid-month?
The service absorbs it: the incident is triaged, the affected use cases are re-tiered, the controls are rechecked and the board is briefed with what happened, what changed and what is being fixed. Change and incident handling is part of the rhythm rather than an extra.
Can we take it in house later?
Yes, cleanly. The register and evidence live in your tools, the handover is documented from month one, and organisations that build their own capability leave with a running system. Some clients also step the other way, into the fuller retained office. Both directions are designed in.