One fixed price against an asymmetric bill.
The cost of an AI governance failure is not the assessment you skipped. It is the skilled-person review commissioned at your expense, the supervisory action, or the allocator mandate you cannot defend. AIssure is the fixed-price, board-ready answer that sits on the right side of that arithmetic.
The bill you are actually underwriting
The question a CFO should ask is not "what does an assessment cost?" but "what does not having one cost, and who decides that number?" With AI governance, the answer is uncomfortable on both counts: the sums are large, and it is the supervisor — not you — who sets them.
The clearest signal is in the numbers on skilled-person reviews. The FCA can commission a Section 166 review of a firm at that firm's own expense; those reviews now average around £460,000, and the count commissioned rose roughly 124% in a single year. That is before remediation, before management time, and before the reputational drag. Set one fixed-price engagement, priced up front, against an open-ended review you do not control, and the asymmetry is the entire argument.
A supervisory action is a cost the regulator sizes and you pay. A fixed-price assessment is a cost you size and cap in advance. The choice between them is the CFO's to make — but only before the event, not after.
The procurement gate is a capital question
The exposure is not only supervisory. Allocators, institutional clients and RFP processes are increasingly writing ISO/IEC 42001 evidence and AI governance attestations into their due diligence — today, not at some future deadline. A mandate lost because your firm could not evidence how it governs its AI is a revenue event that lands directly in the forecast.
The regulatory clock reinforces the point without needing to be overstated. Under the EU AI Act, prohibited-practice rules and general-purpose AI obligations are already in force, with penalties reaching €35m or 7% of global turnover, and further obligations phase in over time. The honest board framing is not a countdown to a single date — it is that the buyers and gatekeepers who control your mandates are moving now, and preparation time cannot be bought back later.
A fixed-price, defensible answer
AIssure turns the audit from a bespoke consulting spend into a fixed-scope, fixed-price product — so the cost is known before you commit, and the output is a board-ready document rather than a stack of billable hours. Every finding is traced to the primary regulatory clause it was tested against and reproducible on re-performance, which is what makes the answer stand up to a supervisor, an allocator's due-diligence team, or your own audit committee. It is an independent, point-in-time opinion over your governance: it attests, it does not operate — and that separation is what gives the attestation weight.
One engagement, or one event.
The same exposure, priced two ways. One number you set in advance; one the regulator or the market sets for you.
| One AIssure engagement | One supervisory action or lost mandate | |
|---|---|---|
| Cost basis | Fixed scope, priced up front — a known, capped number. | ~£460k average Section 166 review, plus unbounded remediation, or a lost mandate booked as lost revenue. |
| Who sets it | You — before the gate, on your own timetable. | The supervisor or the allocator — after the event, on theirs. |
| Timing | Board-ready in ~5 weeks; ~8 weeks for a first pilot. | On the regulator's clock, or the day a due-diligence questionnaire arrives unanswered. |
| What you are left with | A defensible evidence base and a remediation plan you can act on. | An enforcement record, and an allocator on notice. |
Related
The productised AI governance audit
What it is, what it delivers, and why it is fixed in scope and price.
→ ProcessHow an engagement runs
Five weeks, three delivery models, one board pack.
→ By roleFor the CRO
Absolute defensibility under SMCR accountability.
→ CoverageRegulations & standards
The eight jurisdictions and the instruments within them.
→The economics of assurance — the questions we get.
What a CFO, an audit committee, and a procurement team ask about the cost of an AI governance audit — and the cost of skipping it.
What is the return on a productised AI governance audit?
It is best read as an asymmetric-cost decision, not a conventional ROI. One fixed-price engagement is set against the tail it protects you from: an FCA skilled-person review under Section 166 now averages around £460,000 and the number commissioned rose roughly 124% in a year, and a lost allocator mandate is a revenue event, not a line item. The engagement is a small, known cost bought to cap a large, uncertain one.
How is a fixed-price engagement priced and scoped?
The scope is fixed and the price is agreed up front, so there is no open-ended day-rate exposure. A full assessment runs to a board-ready report in about five weeks; a first pilot is typically scoped at eight weeks end-to-end. It is delivered three ways to suit how your firm buys — self-serve, run-for-you, or white-label through an existing adviser.
Is this a compliance cost or a commercial one?
Commercial. Allocators, consultants and RFPs increasingly write ISO/IEC 42001 evidence into due diligence today, so the ability to produce a defensible AI governance answer protects mandates you already hold and unlocks ones you are bidding for. The compliance benefit is real, but the case that reaches the board is about mandate retention and cost of capital.
Start with a thirty-minute read on your readiness.
A high-level, question-only session — 12 to 16 questions, no evidence to prepare — for an initial view of your AI governance maturity and readiness. It sets the scene for a full engagement: the audit platform deployed and evidence-based assessments run, self-serve or consultant-supported.