Fee
Register to see indicative feesConfirmed in writing after scoping01 / Assessment · Standard
AI Governance Starter
You need a defensible position on AI governance in weeks, not quarters, and the full programme has not been funded.
AssessAssessment
Typical duration
2 weeksFixed: bounded by designPrimary artefact
Minimum viable AI policyPlus 2 moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What AI Governance Starter is
A deliberately bounded two-week engagement that produces the smallest set of governance artefacts that would survive a board question or a customer questionnaire.
And what this service produces
It is not a full governance framework and does not pretend to be. It is the defensible minimum, built so it extends into the full programme rather than being thrown away.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- You need something defensible before the full programme can be funded.
- Your organisation is smaller than our usual fit band. This service exists for you.
- A board or customer deadline is inside a month.
- You are testing whether we are worth a larger engagement.
02
The usual trigger
- A board meeting is in three weeks.
- A customer questionnaire has a deadline.
- Budget for the full programme is in the next cycle.
- You need to show movement while scoping the real work.
06 / The obligation
What "defensible minimum" actually means
There is a version of AI governance that takes a quarter and a version that takes a fortnight, and the difference is not quality. It is coverage.
Four questions answered
The two-week version answers four questions: what AI do we use, who decides about it, what are the rules, and what happens when something goes wrong.
What it leaves out
It does not integrate with procurement, does not survive an ISO audit, and does not cover systems nobody has told you about. That is a real limitation, and we would rather state it here than discover it together in month three.
What it does give you
What it does do is give an accountable person something to stand behind, and give the full programme a foundation rather than a blank page.
This buys you a defensible position and roughly a quarter of breathing room. It does not buy you a governance framework, and we say so on the page rather than in the closing meeting.
07 / What you receive
Three artefacts. Each one yours to keep.
- 01
Minimum viable AI policy
Short, applied, and written so someone could use it next week to refuse something.
Policy documentExecutive sign-off - 02
Accountability map
Who decides, who is consulted, who is accountable, for the AI you know about.
One-page mapExecutive team - 03
AI use snapshot
The systems you are aware of, documented, with the known gaps in that list named.
RegisterGovernance owner
08 / Scope
The whole system is visible before work begins.
Snapshot
- Known AI systems documented
- Obvious gaps in the list named
- Data exposure flagged at a high level
Policy
- Minimum viable AI policy drafted
- Acceptable use rules
- Escalation path
Accountability
- Decision rights for known systems
- Named accountable executive
- Board reporting line
Extension plan
- What this does not cover, listed
- What the full programme adds
- Sequenced and costed
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Snapshot of known AI systems
- Minimum viable AI policy
- Accountability for known systems
- Extension plan, sequenced and costed
Not included
- Discovery of shadow AI: We document what you know about. Finding what you do not is the full engagement.
- Process integration: No procurement or change-management integration at this scope.
- Certification readiness: This does not prepare you for ISO 42001 in any meaningful way.
10 / How we do it
A traceable path from scope to evidence.
Snapshot and drafting
One workshop, then the policy and map drafted against what you actually have.
Review and sign-off
One review cycle, then executive sign-off and a named owner.
Mapped againstISO/IEC 42001NIST AI RMF
11 / Timeline
2 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Week 1
Workshop and drafting
One workshop, then the policy and accountability map drafted.
Customer effort
One half-day workshop with the accountable executive and one technical lead.
Week 2
Review, sign-off and extension plan
Two weeks, fixed, and roughly 7 hours of your team's time. The extension plan is part of the deliverable: you leave knowing exactly what this did not cover.
Customer effort
One review cycle, roughly 3 hours.
Our work: 2 weeks
12 / Scope check
Test whether AI Governance Starter
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your engagement lead
Steve Sharma
Founder & Principal
Runs the workshop and drafts the artefacts personally. At this scope nothing is delegated because there is no time to.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
The limitations are published, not discovered.
What this does not cover is a deliverable, not a conversation in month three.
It extends rather than being thrown away.
Every artefact is built to become part of the full framework, not to be replaced by it.
It fits organisations below our usual band.
This is the one service where our usual fit band does not apply, and we say so on the page.
15 / The boundary
What this engagement does not claim.
Scope
This is a bounded minimum.
It does not find AI you do not know about, it does not integrate with your processes, and it does not prepare you for certification.
Operations
We are not a managed security service.
We do not run your SOC or monitor your environment.
Framework
A two-week engagement cannot produce a governance framework.
We would rather say that here than imply otherwise.
References
Mapped to two references.
The artefacts map to ISO/IEC 42001 and the NIST AI RMF.
17 / Cost
Fixed fee · confirmed in writing after scoping
Register to see indicative fees
Price your scopeWhat moves the fee
Only if scope needs to grow. The scope is fixed by design, so we stop and re-quote rather than extending quietly.
Fixed fee, fixed scope, two weeksPolicy, accountability map and AI use snapshotA sequenced, costed extension plan
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
20 / FAQ
The questions that change the decision.
For a defensible minimum, yes. For a governance framework, no, and the difference is coverage, not quality. The extension plan tells you exactly what is missing, which is the honest version of this answer.
Most of them. It will not survive an ISO 42001 audit and we would not claim otherwise.
That is the design. Every artefact is built to become part of the full framework rather than to be replaced by it, and the extension plan is costed.
Because it is smaller, not because it is lighter. Fixed scope, two weeks, no discovery. If you need discovery, this is the wrong service and we will say so in the scoping call.
21 / Next move
If AI Governance Starter is what you need, the next step is a conversation about scope.
45 minutes, with the executive who would lead it: what your scope actually looks like, and whether this is the right service for you at all.