AI Governance Consulting
AI governance for banks, insurers, wealth managers and fintechs that works in production and passes audit — built by an engineer who has shipped platforms inside regulated banks, not a slide deck.
What the engagement covers
Six workstreams, one control set. Each is evidenced so internal audit and your regulator can test it.
AI inventory & risk classification
Every AI system and model in scope — including vendor and embedded AI — classified against EU AI Act risk tiers. Credit scoring and life/health insurance pricing are flagged as Annex III high-risk from day one.
Policy & accountability
AI policy, decision rights and RACI that your management body can sign. Aligned with DORA's requirement that the management body owns ICT risk, not delegated to a committee nobody attends.
Model lifecycle gates
Approval gates from use-case intake to retirement: data checks, validation, bias and robustness testing, human-oversight design, and sign-off by model risk. Built into CI/CD, not a spreadsheet.
Control mapping
One control set mapped to the EU AI Act, DORA, GDPR and ISO/IEC 42001 so each control is designed, evidenced and audited once — not four times by four teams.
Monitoring & incidents
Drift, performance and fairness monitoring, logging that satisfies AI Act record-keeping, and one incident path that feeds both AI Act serious-incident and DORA major-incident reporting.
Third-party AI
Due diligence and contract terms for LLM providers and AI vendors, recorded in your DORA register of information. Covers data residency, retention and exit plans.
What AI governance consulting costs
Fixed-fee, senior-led, no time-and-materials. All prices excluding VAT.
€12k–38k
AI Readiness Assessment with a governance workstream: inventory, risk classification and control gaps against the EU AI Act, DORA and GDPR. 2–6 weeks by scope.
Assessment tiers →Fixed quote
Lifecycle gates, control mapping, monitoring and third-party AI controls implemented in your platforms. Quoted as a fixed fee from the gap analysis, typically 8–12 weeks per business unit.
€60–95k
Governance delivered as one pillar of a full AI operating model design (design only, 8 weeks).
AI operating model →How to choose an AI governance partner
Boutique or large consultancy? Both can be the right answer. These are the typical trade-offs — test them against any firm you shortlist, including us.
| Factor | Specialist boutique | Large consultancy |
|---|---|---|
| Who does the work | The senior person you met in the pitch | Often a partner-led pitch, delivered by a junior-heavy team |
| Pricing model | Fixed fee, quoted after a scoping call | Often time-and-materials or large retainers |
| Output | Controls implemented in your platforms and pipelines | Frequently policy documents and slideware |
| Speed to start | Days to weeks | Weeks to months (procurement, staffing) |
| Independence | Vendor-neutral, no tooling resale | Check for alliance partnerships with the tools they recommend |
| Breadth | Deep on a focused scope | Broad global coverage, many jurisdictions at once |
Six questions to ask before you sign
- Who exactly will do the work, and how many hours of senior time are in the quote?
- Can you show a control you designed running in production — not just a policy?
- How do you map the EU AI Act to DORA and ISO 42001 without duplicating controls?
- What do we own at the end — documents, or working gates, dashboards and evidence?
- Do you resell or partner with any of the governance tools you would recommend?
- Is the price fixed? What triggers a change request?
Frequently asked questions
What does AI governance consulting include?
An AI inventory and EU AI Act risk classification, an AI policy and accountability model, model lifecycle gates, a control set mapped to the EU AI Act, DORA, GDPR and ISO/IEC 42001, monitoring and incident processes, and third-party AI due diligence. The deliverable is working governance — gates in your pipelines and evidence your auditors can test — not only a policy document.
How much does AI governance consulting cost?
Most engagements start with the AI Readiness Assessment, whose governance workstream produces the gap analysis: fixed fee from €12,000 (2 weeks) to €38,000 (enterprise, 4–6 weeks). Implementing the governance build-out is then quoted as a fixed fee from that gap analysis. When governance is part of a wider redesign, it is included in AI Operating Model design (€60,000–€95,000, design only). No time-and-materials.
When do EU AI Act high-risk obligations apply to banks and insurers?
Obligations for Annex III high-risk systems — which include creditworthiness assessment of individuals and risk pricing for life and health insurance — apply from 2 December 2027, after the EU's 2026 Digital Omnibus postponed the original August 2026 date. High-risk AI embedded in regulated products follows in August 2028. Prohibited practices have been banned since February 2025.
Does ISO 42001 certification make us EU AI Act compliant?
No. ISO/IEC 42001 is a voluntary, certifiable AI management system standard. It gives you much of the governance machinery the AI Act expects — risk management, impact assessment, lifecycle controls, internal audit — but it is not a harmonised standard under the AI Act and does not create a presumption of conformity. Use it as the backbone and close the AI Act-specific gaps on top.
How does AI governance fit with DORA?
For financial entities, AI systems are ICT systems. DORA's ICT risk management framework, incident reporting, resilience testing and third-party register already apply to them. Good AI governance extends those DORA processes rather than creating a parallel regime — which is why we map controls once across both.
How long does it take?
The gap analysis takes 2–6 weeks depending on scope. A governance build-out for one business unit typically takes 8–12 weeks. Enterprise-wide programmes are phased by risk: high-risk systems first, so you are ready well before December 2027.
December 2027 is closer than your next budget cycle
30-minute scoping call. You leave with a view of which of your AI systems are high-risk and what to fix first — whether we work together or not.
Book a Scoping Call