AI governance consulting for boards and regulated enterprises
Paul Okhrem provides AI governance consulting for boards and leadership teams, with a USD 80,000 engagement floor. He sets clear AI ownership, tests controls and defines evidence for review. The work covers the AI inventory, risk tiers, vendor checks, monitoring and board reporting.
Price: USD 1,000 per hour, 80-hour minimum, USD 80,000 floor. Delivered personally by Paul Okhrem. Reply within two business days. Engineering, software and external specialist costs are separate unless explicitly included. Read the published terms.
When AI governance needs hands-on senior advice
Paul's work fits a company that needs controls people can use and evidence leaders can review. It requires an executive sponsor.
- Best fit
- A company must meet EU AI Act duties and needs a working control set.
- A board wants AI risk reporting it can act on.
- A team is preparing for ISO 42001 or aligning with the NIST AI RMF.
- Not a fit
- Organizations that need legal advice or a certification audit.
- Teams that want a policy but cannot name owners for its controls.
What is AI governance consulting?
AI governance consulting turns policy into operating rules: who may use an AI system, who approves it and what tests it must pass. It also assigns an owner when a system fails. Paul Okhrem helps leaders define those decisions, record the evidence and review controls as the system changes.
This is management and operational advice. Legal counsel confirms legal duties. A separate certification body conducts a certification audit. A framework mapping is neither a certificate nor a guarantee of compliance.
What AI governance consulting includes
The engagement connects five control areas to evidence and named owners. The mapping below is a planning aid, not a legal determination.
| Component | What the client keeps | Framework connection |
|---|---|---|
| Policy and decision rights | Approved-use rules, release authority and an escalation route. | NIST Govern; ISO 42001 policy and leadership. EU AI Act duties depend on the system and role. |
| AI inventory | Systems, owners, intended uses, data, vendors and deployment context. | NIST Govern and Map; ISO 42001 management-system scope. The register supports EU AI Act scoping. |
| Risk assessment | Risk tiers, control owners, test evidence and open gaps. | NIST Map and Measure; ISO 42001 risk assessment. Assess applicable EU AI Act requirements separately. |
| Monitoring and response | Evaluation results, alerts, incident handling and stop or rollback rules. | NIST Measure and Manage; ISO 42001 performance review. Add EU AI Act monitoring duties where applicable. |
| Board reporting | Funding decisions, open risks, exceptions, deadlines and named owners. | NIST Govern and Manage; ISO 42001 management review. Track applicable legal duties alongside operating risk. |
The statement of work lists the systems, jurisdictions and records in scope. Your legal, security and business teams keep their approval duties.
AI compliance consulting: EU AI Act, NIST AI RMF and ISO 42001
AI compliance consulting maps each AI system to the rules that apply and builds the evidence. The work covers:
- The EU AI Act risk classification, checked with legal counsel.
- The NIST AI RMF functions: Govern, Map, Measure and Manage.
- The ISO/IEC 42001 management system requirements.
Paul builds the inventory, risk tiers and control evidence first, then the policy. The frameworks have different roles. NIST provides a voluntary risk framework; ISO 42001 addresses an AI management system. Neither replaces applicable law.
For a structured review of system roles and duties, see EU AI Act consulting. For management-system scope and evidence, see ISO 42001 consulting.
For AI agents that take actions, see agentic AI governance. Tool permissions, approval limits and rollback need review before the agent can change a live system.
Responsible AI consulting
Responsible AI consulting turns principles such as fairness, transparency and accountability into checks that block or approve a release. Paul defines what each principle means for your systems, who tests it, and what evidence the board sees.
Teams that need a first policy can adapt the AI policy template. It must connect to actual uses, approval duties and an incident route.
To start, use the AI risk assessment template on your highest-risk use case. Keep the internal risk score separate from any legal classification.
Need a decision, not a report? Send a private brief. Paul replies within two business days.
How do you put AI governance into daily work?
Start with real systems and test whether their controls work. A policy alone does not prove that a team follows it.
- Inventory: identify systems, owners, data flows and vendors, including tools used without central approval.
- Classify: assess the intended use and affected people. Record the evidence behind each risk decision.
- Control: assign permissions, tests, approval gates, monitoring and a stop or rollback owner.
- Review: examine incidents and refresh decisions when the system, data or use changes.
The NIST AI RMF core connects governance, context, measurement and risk management. Its four functions are not a mandatory sequence. Use them throughout the system's life.
Why does the AI inventory come first?
You cannot set useful controls for systems you cannot identify. The inventory connects each use case to its owner and business process.
Record its vendor, data, users and intended output. This helps teams find duplicate tools, assign risk and request the right evidence. Include purchased tools as well as systems built in-house. A vendor contract does not replace an internal owner.
The work follows a documented AI governance framework that you keep after the engagement. Name the person who will maintain the register and approve material changes.
Which metrics show whether governance works?
Track both coverage and outcomes. Count systems with owners, tested controls, failed tests, incidents and overdue reviews.
Each metric needs a denominator, evidence source and accountable owner. Report vendor evidence gaps and the time to contain incidents. A high pass rate means little when teams test only easy cases. Training attendance alone does not show safe use.
Board reports should state the decision needed, the main exception and who must act next. Directors can use board AI oversight to frame questions for management and review what needs approval.
Why does governance need a funded mandate?
Controls need people, time and a clear right to act. An unfunded policy assigns duties without the means to perform them.
Name an executive sponsor, approve staff time and define who can pause a system. Record the legal, security, procurement and business decisions that remain with the client. Set a review schedule before the project ends.
Ongoing executive ownership can sit within a fractional CAIO mandate. A one-off governance review does not include that continuing role.
Which EU AI Act dates apply?
EU AI Act dates differ by system, role and obligation. The Commission's implementation timeline includes changes introduced by the AI Omnibus.
- Article 50 transparency rules generally apply from 2 August 2026, with specific transitions.
- New prohibitions and certain Article 50(2) transitions apply from 2 December 2026.
- High-risk Annex III rules apply from 2 December 2027.
- High-risk AI in products covered by Annex I has a 2 August 2028 date.
Check the official EU AI Act timeline for the relevant category. Counsel must confirm which rules apply to your provider or deployer role.
The Commission's AI Omnibus update also explains changes to AI literacy. Do not rely on the original Article 4 wording without checking the amendments.
How to choose an AI governance consultant
Ask each candidate how their work changes real release decisions. Request examples of the records and controls the client will keep.
- Which frameworks do you map controls to: the EU AI Act, NIST AI RMF or ISO/IEC 42001?
- Will we get an AI inventory and risk tiers, or only a policy document?
- How do controls connect to the release decision for each AI system?
- Who maintains the governance after you leave?
- Have you run AI systems in production yourself?
- Do you sell implementation work or tools that the governance will approve?
Governance that does not change release decisions is paperwork. Check EU obligations with the EU AI Act compliance checklist. Confirm the final interpretation with qualified counsel.
Paul provides senior advice personally and discloses his company roles. He does not provide a legal opinion or act as a certification body. Any related-party implementation option must be disclosed before selection and contracted separately.
FAQ
What does an AI governance audit include?
An AI governance audit reviews the inventory, risk tiers, decision rights, controls, testing and evidence of use. Paul Okhrem can identify gaps and assign next steps within an agreed scope. This is an advisory review, not an accredited certification audit or a legal opinion.
How much does an AI governance consultant cost?
Paul Okhrem's rate is USD 1,000 per hour, with an 80-hour minimum and USD 80,000 floor. Scope and terms are agreed in writing before work starts. Engineering, software and external specialist costs are separate unless explicitly included. Legal advice and certification audits require separate qualified providers.
Is AI governance the same as compliance?
No. Compliance concerns applicable duties. Governance also covers which AI systems to fund, who owns them, acceptable risk, monitoring and decisions to stop. Legal counsel confirms the duties that apply. Paul helps leaders turn the agreed requirements into controls, records and a review process.
Does a governance review certify ISO/IEC 42001 compliance?
No. Paul's readiness work can organize the AI management system and its evidence. Certification is a separate assessment by an independent certification body. The client must confirm the certification scope and provider. A completed policy, risk register or readiness review is not a certificate.
Can governance cover tools we buy from vendors?
Yes. Purchased AI tools still need a business owner, an approved use, data rules and monitoring. Request evidence of testing, access controls, change notices and exit options. The client's legal team confirms the duties for its role. A vendor's assurances do not replace that review.
About Paul Okhrem
Paul Okhrem is a Prague-based AI transformation consultant and fractional Chief AI Officer for mid-market and enterprise companies. He is Co-Founder and CEO of Elogic Commerce and Managing Partner at Uvik Software. He has built B2B and enterprise software since 2009.
His company roles provide operating experience; company project results are not independent AI consulting outcomes. Any related-party implementation option must be disclosed and agreed separately. Read the evidence and measurement method.
Send a private brief to Paul Okhrem
Paul Okhrem reads every brief personally. Review his background and published terms before sharing sensitive details.