ISO 42001 vCISO Services
- Under ISO 42001 the fractional role owns the management system: policy, risk, impact assessments, the annual cycle and the audit relationship.
- Retainers commonly run £3,000 to £15,000 a month, with most mid-market arrangements between £4,000 and £9,000.
- The certificate creates permanent obligations, which is the strongest argument for an ongoing arrangement.
- Ask whether the internal audit is inside the retainer. If the same person built the system, it should not be.
- The role needs authority as well as expertise, because management review requires decisions to actually get made.
What the role covers
A virtual CISO, fractional CISO or fractional AI governance officer is senior governance leadership engaged part time. Under ISO 42001 that role is broader than information security, because the management system reaches into model lifecycle, data provenance and the assessment of impact on people rather than only into infrastructure and access.
In practice the person owns the AI management system: the policy, the risk and impact assessment processes, the Statement of Applicability, the annual internal audit and management review cycle, and the relationship with the certification body.
| Area | What the person owns |
|---|---|
| Scope and policy | What the management system covers and the AI policy that governs it |
| Risk and impact assessment | The processes, and making sure assessments actually happen when systems change |
| Statement of Applicability | Keeping inclusions and exclusions justified as the organisation changes |
| Annual cycle | Internal audit scheduling, management review preparation, corrective actions |
| Certification relationship | Surveillance audit preparation, evidence coordination, findings |
| Third-party oversight | Controls over bought AI systems and suppliers |
| Buyer questionnaires | Answering enterprise AI questions from the same evidence base |
| Board reporting | Explaining the AI governance position to leadership and customers |
Why the certificate argues for an ongoing arrangement
ISO 42001 does not finish at Stage 2. Surveillance audits happen in years two and three, recertification at year three, and Clause 9.2 requires an internal audit every year.
Between those, the management system has to actually run. Impact assessments for new or materially changed systems. Risk reviews. Supplier reviews. Records of decisions. Surveillance auditors sample the year, and a system that stopped operating in month three shows up in month fourteen as a nonconformity.
A project engagement produces a certificate. Something has to hold the system afterwards, and that is the case for a retainer rather than a marketing argument for one.
What it costs
| Model | Typical range |
|---|---|
| Monthly retainer, small organisation, narrow scope | £3,000 to £5,000 |
| Monthly retainer, mid-market | £4,000 to £9,000 |
| Monthly retainer, complex or multi-framework | £9,000 to £15,000 |
| Day rate | £700 to £1,600 |
| Fixed-fee project, implementation to certificate | £15,000 to £50,000 |
For comparison, a full-time head of AI governance in the UK generally costs £120,000 to £220,000 fully loaded. A retainer at £6,000 a month is £72,000 a year. The comparison is not exact, but for organisations below a few hundred people the fractional model usually matches the actual need.
The internal audit question
Ask specifically whether the internal audit is inside the retainer, and if so who performs it.
Clause 9.2 requires objectivity and impartiality. A fractional officer who built and runs your management system is not independent of it, so if they also perform the internal audit, that audit is worth little to a surveillance auditor.
Well-run firms handle this by using a separate practitioner for the audit, or by leaving it to a third party. Either is fine. What is not fine is an arrangement where the same person builds, operates and audits, and nobody says so. This is covered in ISO 42001 - Internal Audit Consultants.
What sits outside the retainer
Certification body fees, always. £4,000 to £20,000 for the initial cycle, then surveillance.
The initial implementation, where the management system does not yet exist. A retainer is for holding a system, not building one from nothing.
Internal audit, in most honest arrangements, for the independence reason above.
Engineering work to build logging, data lineage or controls into products.
Ask for exclusions in writing, along with hour caps and overage rates. A capped retainer becomes expensive in the month a surveillance audit lands.
Authority matters
Clause 9.3 management review requires leadership to consider the system's performance and make decisions: on resources, on risks accepted, on improvements. A fractional officer can prepare the review, but somebody with authority has to make the calls and be recorded doing so.
Agree at the start what the person decides alone, what they escalate, and to whom. A management review that rubber-stamps a report is itself a common audit finding.
Fractional, project, or a hire?
| Best suited to | |
|---|---|
| Fractional retainer | A certificate held, systems changing, buyer questionnaires arriving, no internal owner with capacity |
| Project consultant | Getting to first certification, with someone internal taking the annual cycle on afterwards |
| Full-time hire | A large AI estate, a regulated firm, or a business where AI governance is central to the product |
Many organisations get the best result from a fixed-fee implementation followed by a smaller ongoing arrangement. That is how our implementation and continuous governance and assurance services fit together.
What to do next
Decide whether you are buying a certificate or a standing governance function. Organisations that buy a retainer when they needed a project overspend; those that buy a project when they needed a retainer lose the certificate at surveillance.
Our free readiness diagnostic gives a first view, and the ISO/IEC 42001 service page sets out how we work.
References
FAQ
What does a vCISO do for ISO 42001?
Owns the management system: policy, scope, risk and impact assessments, the Statement of Applicability, the annual internal audit and management review cycle, and the certification relationship.
How much does a fractional AI governance officer cost?
Commonly £3,000 to £15,000 a month, with most mid-market arrangements between £4,000 and £9,000.
Can the vCISO do our internal audit?
Not if they built and run the system, because Clause 9.2 requires objectivity and impartiality. Ask who performs it and how independence is preserved.
Is the certification fee included?
No. Certification body fees are always separate, at £4,000 to £20,000 for the initial cycle plus surveillance.
Do we need one after certification?
Only if nobody internal will run the annual cycle. Systems that stop operating after the certificate arrives are found at the surveillance audit.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. We take companies through ISO/IEC 42001 to certificate and maintain the position afterwards through our continuous assurance service, using a separate practitioner for internal audit where we built the system. We are not a certification body and we take no commission from certification bodies. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on FCA authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.