How much does the Governance Baseline cost?

It is a fixed-scope engagement with a fixed fee, quoted after a short scoping call, because the effort depends on the number of business units, systems and stakeholders involved.

Does the Baseline give us a compliance opinion?

No. It tells you, with evidence labels, where you stand against the VERITRAIL controls and indicative framework mappings, what the gaps are and how to close them. Compliance and certification are determinations for legal advisers, authorities and accredited bodies.

What do we need to provide?

An executive sponsor, a day-to-day lead, access to owners of in-scope AI systems for short interviews, and existing documentation such as policies, inventories, assessments, test results and logs.

Do we have to buy the VERITRAIL platform afterwards?

No. The deliverables are yours. Many organizations use them to run their programme with existing tools; others continue with VERITRAIL modules.

Book an VERITRAIL Governance Baseline — 4–6 week AI governance engagement

Validate your AI governance position with evidence — and leave with a plan.

The VERITRAIL Governance Baseline is a fixed-scope, 4–6 week engagement. It turns a self-reported picture of AI governance into an evidenced one: what AI you run, how risky it is, which controls are working, which are not, and what to do in the next 90 days.

What is included

Workstream	Scope
AI inventory	Inventory of up to 25 AI systems — models, LLM applications, agents and vendor AI — with owners, purpose, data sensitivity, autonomy and a human-confirmed risk tier
Maturity assessment validation	Your 24-question self-assessment reviewed against evidence; each answer relabelled Verified, User-asserted, Inferred, Missing evidence or Critical gap
Five use-case deep-dives	Full use-case risk and control assessment for five priority systems using the relevant assessment modules
Two agent reviews	Tool manifests, least privilege, approval points, injection exposure, containment and logging for two agents
Gap register	Every finding with VERITRAIL control citation, evidence status, severity, owner and SLA (30/60/90/180 days)
Remediation roadmap	Sequenced plan across the five pillars, with dependencies and owners
Runtime policy drafts	Draft VERITRAIL Shield policies for the reviewed agents, ready for Observe mode
Executive report	Board-ready summary of position, critical gaps, indicative framework readiness and recommended decisions
90-day plan	First 30, 60 and 90 days of actions, with named owners

VERITRAIL controls cited

EI-01 Enterprise AI inventory (system of record)Enterprise AI Inventory · priority: criticalNIST AI RMF: GOVERN 1.6ISO/IEC 42001: A.4.2, 7.5EU AI Act: Art. 26, Art. 49
EI-02 AI risk classification and tieringEnterprise AI Inventory · priority: criticalNIST AI RMF: MAP 1.1, MAP 1.5, GOVERN 1.3ISO/IEC 42001: 6.1.2, A.5.2EU AI Act: Art. 6
GL-02 Pre-deployment risk and impact assessmentGovernance & Lifecycle Control · priority: criticalNIST AI RMF: MAP 1.1, MAP 3.1, MAP 5.1, MEASURE 1.1ISO/IEC 42001: 6.1.4, 8.4, A.5.2, A.5.3, A.5.4EU AI Act: Art. 9, Art. 27
IS-11 Least-privilege tool accessIntegrity, Safety & Security · priority: criticalNIST AI RMF: MEASURE 2.7, MANAGE 2.2ISO/IEC 42001: A.6.2.6, A.4.4EU AI Act: Art. 15, Art. 14
IS-13 Human approval for high-impact actionsIntegrity, Safety & Security · priority: criticalNIST AI RMF: GOVERN 3.2, MANAGE 2.2ISO/IEC 42001: A.9.2, A.6.2.6EU AI Act: Art. 14
SE-05 Audit-ready evidence packsStewardship, Evidence & Assurance · priority: highNIST AI RMF: GOVERN 1.4, MEASURE 2.9ISO/IEC 42001: 7.5, 9.2EU AI Act: Art. 11, Art. 18

Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.

How it runs

Week	Activities
1	Kick-off with sponsor; scope confirmation; self-assessment completed by key stakeholders; evidence request issued
2–3	Inventory workshops and discovery; owner interviews; evidence review; risk tiering with your risk lead
3–4	Five use-case deep-dives; two agent reviews; runtime policy drafting
4–5	Gap register and severity review with control owners; roadmap and 90-day plan
5–6	Executive report; readout to sponsor and governance forum; handover

Duration depends mainly on how quickly evidence and stakeholders are available.

Who it is for

Organizations starting or resetting an AI governance programme.
Regulated enterprises that need an evidence-based view before an audit, a supervisory conversation or a board review.
Companies deploying agents that want runtime controls designed before scaling.

What we need from you

An executive sponsor and a day-to-day lead.
Time from owners of in-scope systems — typically short interviews.
Access to existing policies, inventories, assessments, test results and logs.

Important

The Baseline produces readiness findings and evidence, not a compliance opinion or certification. Recommendations that touch legal obligations include a recommendation for legal review.

Request a Baseline

Use the form on this page. We will schedule a 30-minute scoping call to confirm scope, timing and a fixed fee. Prefer to start on your own? Take the maturity self-assessment first — we will use your results as the starting point.

Book an VERITRAIL Governance Baseline