Service
Fractional AI Governance Retainer
A fractional AI governance retainer gives you ongoing access to a senior AI governance lawyer and a senior AI/DevOps engineer on a monthly basis, covering new AI system reviews, regulatory change monitoring, surveillance audit preparation, customer security questionnaires, and the internal audit and management review cycles ISO/IEC 42001 requires. ai42001 offers this from a defined number of days per month with a named response SLA. It exists because certification is the beginning of the obligation, not the end: your AIMS has to demonstrably operate, your AI systems keep changing, and the EU AI Act's obligations keep phasing in.
- Timeline
- Monthly, 3-month minimum, cancel with 30 days' notice
- Your effort
- A standing monthly review plus ad-hoc access
- Pricing
- Monthly retainer, tiered by days per month
Fit
Who this is for
This is for you if
- You are certified and now need to prove the AIMS is actually operating at your surveillance audit.
- You ship new AI features often and need each one reviewed and risk-classified before launch.
- Enterprise security questionnaires and AI due-diligence requests are eating your team's week.
- You need senior AI governance judgement, but a full-time hire is not justified yet.
This isn't for you if
- You need a one-off project with a fixed end date — one of our other engagements fits better.
- You have an in-house AI governance team already; we would rather train them than duplicate them.
Scope
What's included
Every item below is delivered by our team working in parallel — the legal analysis and the technical work happen together, not in sequence.
- New AI system and feature reviews
- Every new AI system or material model change gets risk-classified, impact-assessed, and added to the register before launch — not discovered at audit time.
- Regulatory change monitoring
- We track EU AI Act implementation milestones, harmonised standards, guidance from the EU AI Office, NIST updates, and relevant sectoral rules, and tell you what actually changes for you.
- Surveillance audit preparation
- We keep your evidence current year-round and prepare your annual surveillance audit, so it never becomes a scramble.
- Internal audit and management review
- We run the recurring internal audits and facilitate management reviews on the cadence your AIMS commits to.
- Customer and procurement support
- We answer the AI governance sections of security questionnaires, RFPs, and enterprise due-diligence packs — often the fastest payback on the retainer.
- Contract and DPA review
- Our team reviews AI-related clauses in customer contracts, vendor agreements, and data processing addenda as they come up.
- Technical control maintenance
- Our team keeps evidence automation, evaluation gates, and logging working as your stack evolves — including when the pipeline that generated your audit evidence gets refactored.
- Named response SLA
- A defined response time on a shared channel, so an urgent procurement question does not wait for a scheduled call.
Deliverables
What you actually receive
- Monthly AI governance report and risk register update
- Reviewed and classified new AI systems and features
- Regulatory change briefings with a clear "what this means for you"
- Completed internal audits and management review minutes
- Surveillance-audit-ready evidence, maintained continuously
- Turnaround on questionnaires, RFPs, and AI contract clauses
The outcome
Your AI Management System stays alive and audit-ready between certifications, and your engineering and sales teams stop losing days to governance questions.
Other engagements
- 3–4 weeksGap AssessmentA 3–4 week diagnostic that tells you exactly how far you are from ISO/IEC 42001 certification, and what it will cost to close the distance.
- 3–6 months, depending on scope and AI system countFull ImplementationA 3–6 month engagement that builds your entire AI Management System — documentation, technical controls, and automated evidence — to the point where you are audit-ready.
- 4–8 weeks, plus audit daysAudit SupportWe prepare your evidence, rehearse your team, and sit with you through Stage 1 and Stage 2 so the audit is an inspection, not an interrogation.
Next step
Talk to us about fractional retainer
A 30-minute call with our team. We will scope it properly, tell you what it costs, and tell you if a different engagement is a better fit for where you actually are.