A monthly retainer for companies that have a governance framework and need to keep it alive. Quarterly reviews, vendor risk reviews, regulatory tracking, and an on-call governance partner for board, audit, and customer questions.
A governance framework that nobody updates is dead within twelve months. The retainer exists because the work that comes after the Build — keeping policies current, evaluating new vendors, answering board and audit questions, tracking regulatory shifts — is exactly the kind of recurring work most companies underestimate.
New vendors, new use cases, new model versions. Each one should be reviewed and routed through your vendor risk process — not just adopted.
EU AI Act enforcement, state-level laws, sector guidance. Someone needs to track changes and translate them into your specific framework.
A dedicated AI Governance Officer costs $200k+ all-in. A fractional one costs a fraction of that and brings the same expertise.
Diligence, security questionnaires, audit committees, M&A. You need someone who can speak to your AI posture credibly and on short notice.
Every retainer covers these four areas. The depth and cadence scales with your tier.
A structured review of your framework against the current state of your AI stack and the regulatory landscape.
We run any new AI vendor through your established risk process — so the process is actually used, not bypassed.
We track regulatory shifts in your jurisdictions and translate them into specific actions for your framework.
For board prep, customer security questionnaires, audit responses, or anytime you need a credible voice on your AI posture.
Pricing is tiered by AI stack complexity (number of vendors, regulatory exposure, sensitive data classes) — not by company size or revenue.
No. Most retainer clients come through the Build, but we'll also take on clients with an existing framework — we just spend the first 30 days getting up to speed before retainer work formally starts.
Month-to-month, cancel anytime with 30 days' notice. We don't use long lock-ins because retainers should earn their renewal, not enforce it.
You get incident-response support immediately at the Embedded tier. At Foundation and Operating, incidents are billed at a discounted hourly rate above the retainer — we don't want anyone hesitating to call us when it matters.
You do. Every memo, review, and report we produce is yours, fully transferable, and cleanly documented in your governance system — not held in our drives.
Yes. The most common pattern is starting at Operating after the Build, stepping up to Embedded when an audit or fundraise is in scope, then stepping back down. We'll never block a tier change.
Free 30-minute discovery call. Bring your current AI stack overview if you have one — we'll walk through what the right tier looks like for your specific picture and quote you a flat number on the call.
Already a client? Email williammccann@catalystoperationspartners.com directly.