Costs and pricing

How the money moves

A company pays for governance in three places: people, tools and outside reviewers. Published tool prices, as of October 2026:

Per-call controls cost cents and the workflow tens or hundreds of thousands a year, so vendors earn on workflow and evidence, and per-use-case pricing grows the bill as you register the shadow AI you find.

How companies of different sizes use it

Nobody publishes AI governance spend by company size, so the bands and figures below are my rough estimates from list prices, buyer data and a few surveys of large companies. Headcount matters less here than what a company does with AI. A company that sells AI to other businesses meets governance through customers' questionnaires as soon as it sells to large companies, and one that makes decisions about people in a regulated sector meets it through examiners and state laws. So each paragraph says where selling AI changes the picture. Banks and insurers skip the early steps: they arrive with a model risk function already staffed and pay for the increment.

A startup (under 50 people) that only uses AI needs an acceptable-use policy, a list of approved tools and the controls in its lab's and cloud's plans. The cloud's guardrails cost cents, and startup credits pay for them, though not for governance software bought on a marketplace. A startup selling an AI product meets governance sooner. Its first enterprise customer sends a security review that asks whether it trains on customer data, which labs it uses, where a person reviews outputs and how much notice it gives of model changes. It answers with compliance automation such as Vanta or Drata, often on a startup discount, plus a trust center and a library of answers, and puts off ISO 42001 until a big customer asks. The CTO or a founder owns it, with outside counsel. My rough estimate is close to nothing in cash for a startup using AI and up to about $60,000 a year for one selling it. Being small exempts no one: Colorado's replacement law dropped the old exemption for small deployers. What pushes it to the next step is a hiring, lending or health use under a state law, or the first enterprise AI questionnaire.

A scale-up (about 50 to 500 people) that only uses AI keeps its first register in a spreadsheet or a form in a tool it already has, such as Jira or ServiceNow, owned part-time by a head of security or compliance. For a company selling AI, customer reviews become the bill. Picture an HR software company that sells an AI feature ranking job applicants to large employers. It answers a couple of hundred AI questionnaires a year, negotiates AI addenda, runs a trust center, pays a red team for the evidence pack and, once enough customers ask, gets an ISO 42001 certificate from an accredited body such as Schellman or BSI. A trust or GRC lead owns it, and most of the cost is people answering questions. Questionnaire effort grows with every deal while a certificate is a fixed cost that cuts the effort per deal, which is why certification spread among AI vendors faster than among their customers. My rough estimate is $20,000-150,000 a year for a scale-up using AI and $100,000-1.4 million for one selling it, with the HR software company near the top. A customer that requires a certificate, the first use that decides something about a person, or the first EU customers push it on.

A mid-market company (about 500 to 2,000 people) is where governance becomes a funded program: in Schellman's 2026 survey of companies this size and larger, nine in ten had funded it. Most of its dozens of AI use cases are features inside software it already bought, plus staff on personal accounts, so discovery from the web-security tool matters as much as the intake form. Privacy or legal usually runs the register while IT buys the tools. It buys a module in a GRC or privacy suite it already owns, such as OneTrust or AuditBoard, or Microsoft Purview's AI templates, and a standalone platform such as Credo AI or Holistic AI only where there's no system of record yet, plus bias audits for the few uses that decide things about people. A company selling AI carries the scale-up's questionnaire load at higher volume and usually holds a certificate by now. My rough estimate is $150,000-700,000 a year, mostly one or two governance staff. A regional bank or insurer this size already runs model risk management and buys validator time rather than a platform. A board question after a peer's incident, the first EU high-risk use or an acquisition that brings another AI stack pushes it on.

An enterprise (about 2,000 to 10,000 people) runs dozens of use cases, a handful of them top tier, with a head of AI governance in risk, privacy or legal and internal audit checking the program. The lender from the start of this guide is this size. It buys suite modules (ServiceNow's AI Control Tower, IBM's watsonx.governance, OneTrust), outside assurance from the Big Four or a specialist for the top-tier uses, and discovery from its security stack, often inside a bigger platform deal or against a cloud commitment. My rough estimate is about $1-4 million a year, mostly people, so a tool earns its place by how much an analyst gets through more than by its licence. The tier sets the bill: by a separate rough estimate, one top-tier generative AI use case costs about $200,000 to $1 million to govern in year one, model bill included, mostly independent testing, red teaming and a re-test or two after forced vendor changes, while a low-tier use case on self-serve intake costs a small fraction of that. A bank like the lender pays only the increment over its model risk function; a company without one builds from zero, and pays more in year one if consultants do the discovery and write the policies. A company selling AI at this size also becomes the EU provider of any high-risk system it sells, with conformity work from the end of 2027. Exam findings, more jurisdictions or a class action naming a vendor's tool push it on.

A Fortune 500 company (revenue above about $7.5 billion) runs hundreds of use cases across business units, often with several governance tools inherited through acquisitions and model risk functions in its financial arms. A chief AI officer or head of responsible AI chairs a committee, the board oversees through its audit or risk committee, and procurement and legal negotiate notice of model changes, audit rights and carve-outs from vendors' liability caps. It buys suites at enterprise scale (ServiceNow, IBM, OneTrust, Microsoft, SAP) and Big Four assurance, and the largest build registers of their own on top. Most of the largest US listed companies now name AI as a risk in their annual reports, so much of the job is making the controls match the disclosure. A company selling AI at this size gets sued directly, as Workday was. My rough estimate is $4-16 million a year, mostly staff. There's no next size up; the pressure comes from boards, plaintiffs and regulators in several jurisdictions at once.

What changes as a company grows (spend is my rough estimate):

Where the dollar goes

• Consultants and assurance firms take the biggest pool. IBM's generative AI book of business passed $12.5 billion through 2025, and about four-fifths of it was consulting.
• GRC and compliance automation is the best-funded part of the market: Vanta at $4.15 billion, AuditBoard at more than $3 billion.
• Security and data platforms paid roughly $130-700 million each for AI security startups in 2025, and Veeam $1.725 billion for Securiti AI.
• Independent governance specialists come last. Gartner sizes the whole category of dedicated platforms, suites included, at under half a billion dollars in 2026.