Done with you, not by you
Software gets you a system of record. These three engagements get you the work done inside it — scoped, time-boxed, and finished with artefacts you own.
Every figure below is a starting point, not a quote. Scope and price are settled in a conversation once we know how many AI systems you run, what they do and what evidence already exists — and if a $390 report or a software plan would serve you better, we will say so.
Ten questions, no call required — you get a dated PDF with the scope, the deliverables and what is explicitly out of scope.
AI Act Readiness Sprint
A bounded engagement that ends with a documented answer to “what does the AI Act require of us, and what do we do about it”, not a slide deck of considerations.
- Who it is for
- Companies shipping AI into the EU that need to know — on paper, with reasons — which obligations are theirs before the 2026 and 2027 dates.
- How long
- 3–4 weeks from kick-off
What you are left holding
- AI system inventory — every system, its role (provider or deployer) and its EU exposure
- Risk classification file per system, with the Articles and Annexes each conclusion rests on
- Obligation plan: the duties that follow, sequenced against the statutory dates, with an owner per line
- Article 50 transparency wording — the disclosure, marking and notice text your product actually needs
- Annex IV technical documentation skeleton, populated with what you already have and flagged where you do not
- A written hand-over walkthrough with your team
What this is not
- Legal advice — we are not a law firm and this does not replace your counsel's review
- A certificate, attestation or mark of any kind
- Implementation of the fixes we identify (we can scope that separately)
- Regulator submissions or correspondence on your behalf
Tell us how many AI systems you run and what they do. We come back with a scope, a fixed fee and a start date — or with an honest “you do not need this yet”.
ISO 42001 Readiness
Preparation for the Stage 1 and Stage 2 audits of an accredited certification body: the AI management system built, evidenced and rehearsed.
- Who it is for
- Teams that have been asked for ISO/IEC 42001 by a customer or an investor and need the management system to exist before an auditor looks at it.
- How long
- 8–12 weeks, depending on scope and evidence maturity
What you are left holding
- Scope definition and gap assessment against every ISO/IEC 42001 clause and Annex A control
- Statement of Applicability (SoA) with a written justification for each inclusion and exclusion
- AI policy set, roles and responsibilities, and the risk and impact assessment process
- Evidence pack assembled and mapped clause by clause, so the auditor is handed a trail rather than a promise
- One internal audit, executed and reported, with corrective actions tracked to closure
- Management review pack and a Stage 1 readiness verdict — including “not yet” if that is the truth
What this is not
- The certificate itself. Only an accredited certification body can audit and certify you — we are not one, we do not issue certificates, and no engagement here guarantees a certification outcome
- Acting as your internal auditor after certification (independence rules), or as your certification body
- Legal advice
- The certification body's own audit fees, which you pay them directly
Send us the certification scope you have in mind and whether a customer has set a date. We assess what exists today before quoting.
Fractional AI Governance Officer
A senior AI governance practitioner on retainer: the standing duties that do not end when a project does.
- Who it is for
- Organisations that need a named, accountable governance function but are years away from justifying a full-time hire.
- How long
- Monthly retainer, 3-month minimum, 30 days' notice to stop
What you are left holding
- A named person accountable for AI governance, with agreed hours and a response time
- Continuous monitoring of your obligation register as systems ship and change
- Regulatory radar: what changed in the AI Act, harmonised standards and guidance, and whether it touches you
- Incident readiness — the serious-incident reporting path defined, and rehearsed rather than assumed
- Vendor and supplier AI assessments, including the questionnaires your customers send you
- A monthly written report your board or your customers can read
What this is not
- A full-time employee, or someone available outside the agreed hours
- Legal advice, or signing anything as your legal representative
- Certification, attestation or audit sign-off
- Building your product's technical fixes
Tell us how many systems you run and what triggered the need. We propose an hours band and a monthly fee.
Ask for a scope and a fee
Four fields. A person reads it and replies within 2 business days — with a proposal, or with an honest note that you do not need this yet.
Prefer to buy software and do it yourself? See the plans.
Questions about the engagements
Do you issue the ISO 42001 certificate?+
No. Certification is audited and issued by an accredited certification body, and we are not one. We prepare your management system, evidence and internal audit so that their Stage 1 and Stage 2 audits go smoothly, and we tell you plainly if you are not ready. No engagement here promises a certification outcome.
Is this legal advice?+
No. We are not a law firm and nothing we deliver replaces your own counsel. What we produce is documented compliance work — classifications with the Articles behind them, obligation plans, evidence and technical documentation — which is exactly the material your lawyers should be reviewing rather than assembling.
Why is the price shown as a starting point?+
Because a precise number before we know your system count, sector and evidence maturity would be a guess dressed as a quote. The figures on this page are the entry point for each engagement; the final scope and fee are agreed in writing after a scoping conversation, and we will tell you if a $390 report or a software plan serves you better.
Do we need a Conformly subscription as well?+
No. The engagements stand alone. Most clients do end up wanting the platform afterwards, because an obligation plan that lives in a document goes stale the moment the next system ships — but that is a separate decision and we do not make it a condition.
How is the readiness sprint different from the $390 report?+
The report is one AI system, generated from your answers, delivered as a document. The sprint is your whole estate, worked through with practitioners: inventory, per-system classification with written reasoning, a sequenced obligation plan with owners, Article 50 wording and an Annex IV skeleton, ending in a hand-over to your team.
What happens after we send an enquiry?+
A person reads it and replies within 2 business days, either proposing a scope, a fee and a start date, or saying that you do not need the engagement yet. There is no automated sales sequence behind this form.