AI governance built into the systems you actually run.
We inventory the AI you build and buy, classify the risk, write the policies, and then build the controls the policies promise: human review, evaluations, logging, vendor checks and an incident runbook. Engineers who build production AI, so every control is something your team can run.
What AI governance consulting should leave behind.
AI governance is the set of decisions, controls and records that tell you which AI systems you run, what each one is allowed to do, who checks it, and what happens when it goes wrong. Most companies already have AI in production through vendors, copilots and agents their teams built, and nobody holds the full list. Gigabit starts there: an inventory of every AI system, a risk tier for each one, and a gap list against the frameworks your customers and regulators cite.
Three frameworks cover most of what buyers ask about. The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary and organises the work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001:2023 is the management-system standard for AI, the one an accredited body can certify you against. The EU AI Act, Regulation (EU) 2024/1689, is law: it reaches companies outside the EU when their AI system's output is used in the EU, its prohibitions have applied since 2 February 2025, and after the July 2026 amendment its high-risk rules apply from 2 December 2027 for Annex III uses (dates checked on 23 October 2026). Gigabit is an engineering firm. We build and document the controls; your counsel decides how the law classifies each system, and a certification body audits ISO 42001.
What a governance build includes.
Policies are the short part. The work is making each one true in the systems that run every day.
AI system inventory
Every model, agent, copilot and AI vendor feature in use: owner, purpose, data touched, users affected and the decisions it influences.
Risk classification
Each system tiered by impact and mapped to the EU AI Act categories, the NIST AI RMF functions and the ISO/IEC 42001 controls you choose to adopt.
Policies and ownership
An AI use policy, acceptable-use rules, approval steps for new systems and a named owner per system, short enough that people read them.
Human oversight design
Where a person must approve, review a sample or be able to stop the system, built into the workflow with the authority and context to do it.
Evaluation and monitoring
Eval sets with pass thresholds that gate releases, drift checks after model or prompt changes, and alerts that reach the system owner.
Logging, vendors and incidents
Audit trails of inputs, tools called and outputs; reviews of model providers and their data terms; and an AI incident runbook with severity levels.
From inventory to controls that run.
Inventory
Interviews and a scan of tools, contracts and code find the AI systems in use, including the ones bought by teams on a card.
Classify
Each system gets a risk tier, an owner and a gap list against NIST AI RMF, ISO/IEC 42001 and, where your counsel says it applies, the EU AI Act.
Build controls
Human review steps, eval gates, logging, access limits and vendor checks are built into the systems, starting with the highest tier.
Run
Monitoring, quarterly reviews and an incident runbook keep the records current as models, prompts and vendors change.
Published prices, mapped to the job.
Every price here is the same one on the pricing page. Work with no published price gets a fixed price in writing before it starts.
Figures in the notes are what past clients paid, from the published case studies; they show the range, not a rate card. Work with no natural end, such as ongoing development, is priced per engineer per month with no lock-in.
When to hire us for this, and when not to.
- Teams have shipped or bought AI faster than anyone has written down who owns it.
- A customer's security questionnaire, an auditor or a board member is asking how you govern AI.
- You run AI agents that take actions, not only answer questions.
- You sell into the EU or into regulated buyers in healthcare, finance or the public sector.
- You need a legal opinion on how the EU AI Act classifies a system. Ask a lawyer; we work alongside them.
- You want an ISO 42001 certificate from us. Certification comes from an accredited certification body; we help you get ready for its audit.
- You use one or two off-the-shelf AI tools with no customer data. A short acceptable-use policy is enough.
AI in production with the controls built in.
Access control by practice area for a consulting firm's knowledge base, HIPAA controls on a telehealth platform, and clinical guardrails with human handoff on a patient assistant.
A phased AI transformation recovered 1,200 consultant-hours per quarter and $480K/year for a 140-person consulting firm — 129% Year 1 ROI.
HIPAA-compliant telehealth platform with 3 EHR integrations enrolled 1,200 patients in 90 days and backed a $4.5M Series A.
A RAG patient assistant with clinical guardrails cut repetitive front-desk inquiries 62% and time-to-answer 68% in 8 weeks.
These are past engagements at the prices those clients paid. For build price, monthly cost and payback side by side, see what ten client projects cost.
AI governance, answered
What does AI governance consulting cost?
The diagnostic is the AI Transformation Sprint: $25,000 fixed over 2 weeks, covering the inventory, risk tiers, the gap list and a pilot of the first control. The governance build that follows is a fixed price in writing after scoping. Engineers who build controls across several teams cost $3,000–$7,500 per engineer per month, and ongoing monitoring runs on Managed AI Operations at $3,000–$20,000 a month. If you need adversarial testing of an agent or LLM feature, the AI Security Assessment starts at $12,000 fixed.
What is an AI governance framework?
It is the structure you use to decide which AI systems you run and how you control them: roles and ownership, a risk classification method, policies, required controls per risk tier, and the records that prove the controls ran. Most companies build theirs on the NIST AI Risk Management Framework, whose four functions are Govern, Map, Measure and Manage, and on ISO/IEC 42001 if they want a certifiable management system. NIST also publishes a Generative AI Profile (NIST AI 600-1, July 2024) that applies the framework to generative models.
How is AI agent governance different?
An agent acts: it calls tools, writes to systems and sends messages. Governance for agents adds controls a chatbot does not need: least-privilege credentials per tool, an allowlist of actions, a human approval step before consequential actions, spend and rate limits, and a log of every tool call with its inputs and outputs, so you can replay what the agent did and why.
Do we have to comply with the EU AI Act if we are not in the EU?
Possibly. Article 2 applies the Act to providers placing AI systems on the EU market wherever they are based, and to providers and deployers outside the EU when the system's output is used in the EU. Prohibited practices have applied since 2 February 2025, and the July 2026 amendment moved the Annex III high-risk rules to 2 December 2027 and the Annex I rules to 2 August 2028 (checked on 23 October 2026). Whether a specific system is in scope, and in which category, is a question for your counsel. We build the inventory, logs and oversight they will ask for.
Can you help us get ISO 42001 certified?
We help you get ready. ISO/IEC 42001:2023 specifies the requirements for an AI management system, and certification is issued by an accredited certification body after its own audit. Gigabit builds the parts the auditor will look for in practice: the AI inventory, risk and impact assessments, documented policies and owners, and evidence that controls such as evaluations, monitoring and incident handling actually run. We do not issue certificates or audit you ourselves.
Often scoped alongside.
AI Security Assessment
Red-teaming for agents, LLMs and RAG, fixed price from $12,000.
AI Security AssessmentManaged AI Operations
Monitoring, eval regressions and drift management for production AI.
Managed AI OperationsAI agent security framework
The controls an agent needs before it touches production systems.
AI agent security frameworkFrom the field notes
Not sure what AI is running in your company?
Tell us which AI systems you know about and who is asking the questions. We reply with how we would inventory and tier them, and what it costs.