Search “AI policy consultant” and the first page is almost entirely service pages explaining why you should hire that firm. None publishes a price, and several describe a different job from the one you have. That is a bad starting position for a COO or chief of staff told to get an AI use policy in place, with no privacy office to hand it to and a provider to pick by Friday.
The useful move is not a shortlist. It is noticing that “help with our AI policy” is five separable deliverables, that no provider type is best at all five, and that their prices differ by more than ten times.
One phrase, two unrelated markets
“AI policy consultant” is two jobs sharing a job title.
The first advises governments and think tanks on how AI ought to be regulated; the OECD’s AI Policy Observatory recruits exactly this profile. Excellent work, and irrelevant to a 180-person company that needs rules for pasting client material into a chatbot.
The second is a corporate governance consultant who will write your internal policy, inventory your tools and build an approval path. That is what you want, and it shares the search term with the first — which is why your results also fill with salary pages for AI policy analysts.
One more complication: the ranked “top AI governance firms” lists beside those service pages are almost all published by firms competing in the market or monetizing referrals into it. If a comparison does not publish its methodology, it does not have one.
What survives is a smaller market than the search results suggest — four real options for a US company of 50 to 500 people, plus doing it yourself.
Split the job into five deliverables before you call anyone
Every provider will quote “AI policy” as one thing. It is five, and the right buy differs for each.
- A position on which rules apply to you. Not a summary of every AI law — a defensible answer to which ones bind your company given your customers, contracts, sector and locations.
- Drafted clauses that survive contact with your own paperwork. The policy has to agree with your employment handbook, your client NDAs, your data processing agreements and your insurance representations. A document that contradicts an existing contract is worse than no document.
- An inventory of what is in use and what data it touches, including the accounts nobody authorized. Fieldwork, not drafting.
- An approval path for the next tool. A named decision-maker, a standard, a record. Without it the policy is a snapshot that expires the moment someone signs up for something new.
- Staff capability to follow the thing. People who can recognize what must never be pasted into an assistant, which account to use, and how to check an output before it reaches a client.
Items one and two are legal work. Three and four are consulting or internal operations. Five is AI enablement, and the only one that changes what happens on a Tuesday afternoon — the same reason buying licenses is not the same as building capability. Buying all five from one provider usually means overpaying for some and underbuying the last.
What each kind of help can and cannot do
| Option | Buys you well | Will not get you | Best fit |
|---|---|---|---|
| Employment or technology lawyer | A defensible position on which rules apply; clauses that reconcile with your handbook, NDAs and DPAs; privilege | Tool inventory, approval mechanics, behavior change | Real contractual exposure, regulated clients, or an incident in progress |
| AI governance consultant | Framework-mapped program design, risk classification, documentation, ISO/IEC 42001 readiness | A legal position you can rely on; enforcement | A customer, insurer or regulator asking for evidence of controls |
| Fractional AI executive | An accountable owner a few days a month; sequencing; vendor decisions | A document on its own; privilege; bench capacity | Budget but no internal candidate to own the work |
| AI enablement partner | Staff who apply the rules under time pressure; a verification habit; reflexes about what never leaves the building | The legal position or the drafted clauses | A policy exists and nothing suggests anyone follows it |
| Do it in-house | Speed, context, ownership; cheapest by far | A second opinion where being wrong is expensive | AI use that is internal, low-stakes and well understood |
The distinction people miss is between the first two. A governance consultant maps your practice to a framework; a lawyer tells you what happens if you are wrong. Plenty of consultancies draft policies competently, but a framework mapping is not legal advice and carries no privilege. If the question is “could this clause be read against us in a dispute,” that is a lawyer, and the invoice difference is smaller than people assume.
To be plain about our own position: SFAI Labs is the fourth row. We run hands-on fluency sessions on a team’s own documents. We do not write your legal position or your clauses, and if that is what you need next, a lawyer is the better call.
What the options cost
Every figure below is a published market range read in October 2026. Professional-fee markets move, so verify before budgeting from them.
| What you are buying | Market range | Source basis |
|---|---|---|
| Lawyer, hourly, solo to small firm | ~$200–400/hr | Clio reports an average US lawyer rate near $349/hr, blended firm rate $311, January 2025 |
| Lawyer, hourly, large national firm | $600–1,000+/hr | Am Law 100 standard rates passed $1,000/hr in 2025 — Thomson Reuters Law Firm Rates Report 2026 |
| Flat-fee policy drafting package | $3,000–10,000 | Boutique practices publishing flat fees for a policy plus related documents |
| Independent governance consultant, hourly | $150–300/hr | Published guides for AI management system work |
| Advisory-firm governance consultant, hourly | $200–400+/hr | Same source basis |
| ISO/IEC 42001 readiness or gap assessment | $8,000–25,000 | Published certification cost guides |
| ISO/IEC 42001 implementation, smaller company | $15,000–50,000 | Same |
| Fractional AI executive retainer | $5,000–30,000/month | Published retainer ranges, scaling with days per month |
| Hands-on fluency sessions | $2,000–15,000 per engagement | Market range for facilitated workshop delivery |
| Full-time in-house governance hire | $205,000–221,000 median | IAPP Salary and Jobs Report 2025-26, August 3, 2025, technology-sector governance roles |
| NIST AI Risk Management Framework and Playbook | Free | nist.gov |
Three things that table makes obvious and no service page will tell you. The free federal framework is the backbone of most paid methodologies: working the Govern function of the NIST AI RMF produces an inventory and an approval standard, so paying before reading it buys a summary of it. The roughly ten-fold spread between flat-fee drafting and ISO readiness work is not a quality gradient — it is the difference between a document and an auditable management system, worth buying only when a customer, insurer or regulator has asked. And a retainer is a cadence, not a deliverable: ask what arrives in month one before agreeing to month six.
The half of the job companies skip
Littler’s 14th Annual Employer Survey, published May 6, 2026 from more than 300 US C-suite executives, in-house lawyers and HR professionals, found 68% of employers now have a formal AI policy, up from 38% a year earlier. One of the sharpest single-year jumps in any workplace benchmark.
Then the part that should reshape your purchase. Only 55% of the same respondents had a formal review or approval process for AI tools and 54% had restrictions on what can be entered into them, and fewer than half had third-party vendor vetting, tool-specific training, or a designated internal oversight owner. The document got bought; the machinery around it mostly did not.
The drafting market is crowded, priced and easy to buy. Items three through five lapse, because no seller’s core product covers them and nobody sends a renewal notice. The gap between a written policy and what staff actually do is where the money goes missing, and it opens quietly.
So before signing, ask what you will have at the end that is not a document. If the honest answer is nothing, you are buying item two — which may be right, as long as you do not book it as having solved three to five.
Where the law actually puts the burden
Most US companies at this size are deployers rather than providers of AI systems, which narrows the obligations considerably. Two reference points matter more than the rest.
The NIST AI Risk Management Framework is voluntary, free and the common language. US customers, insurers and auditors increasingly ask questions phrased in its terms, making it the cheapest alignment available.
Article 4 of the EU AI Act is the one obligation pointing at capability rather than paperwork. It binds providers and deployers to take measures supporting the development of AI literacy among staff and anyone operating AI systems on their behalf. The wording was amended by the Digital Omnibus, Regulation (EU) 2026/1744, in force since July 27, 2026, with national market surveillance authorities supervising it from August 2, 2026. The current text asks you to support the development of AI literacy rather than guarantee a level for anyone — a lower bar than the 2024 wording, but one that still expects measures you can evidence. No certificate, no AI officer, no employee testing.
It reaches a US company through EU staff, EU customers or contracts that flow the obligation down. Whether it binds you is worth an hour of a lawyer’s time rather than a week of your own reading, and a sector-specific regime may answer it differently again for a regulated team.
Who owns it after the invoice is paid
Outside help produces a document. Someone inside has to carry it.
The IAPP and Credo AI AI Governance Profession Report, published April 16, 2025 from more than 670 respondents across 45 countries, found primary ownership split almost evenly: privacy 22%, legal and compliance 22%, IT 17%, with data governance at 10% and security at 5%. Seventy-seven percent were working on AI governance at all, near 90% among organizations already using AI.
That survey skews toward organizations with privacy functions. At 50 to 500 people there is no privacy office, so the work lands on whoever signs for software. The pattern holds regardless of title: one named person, with hours in their week and authority over tool approvals. A committee without a named owner produces minutes. Leadership also needs enough hands-on exposure to read what it is approving — a separate purchase from a governance curriculum for directors.
Seven questions to ask before you sign
Send these to every provider on your list. They sort the field faster than any comparison page.
- Which of the five deliverables are you quoting? Anyone who cannot answer is quoting for whichever are easiest.
- Is any of this legal advice, and from whom? “We work with counsel” is not counsel.
- What will we have at the end that is not a document?
- How do you build the inventory — interviews, admin logs, or our own list? The last answer means you are doing the work.
- What happens when we adopt a tool you have never seen? This separates an approval path from a snapshot.
- What do you expect from us in hours? Usually 20 to 60 hours of internal time. Anyone claiming near zero plans to write something generic.
- What would you tell us not to buy? The best answer we have heard: “the certification, until you have an inventory.”
The order we would buy in
For a company of 50 to 500 people with licenses deployed and no policy worth the name:
- Read the NIST framework and build the inventory yourself. One or two weeks of internal time, and every later quote gets sharper once you know what is in use.
- Buy two to four hours of legal time, not a package. Bring the inventory and ask one question: which rules bind us, and where does our paperwork contradict what people are doing?
- Have clauses drafted or reviewed against that answer. A flat-fee package is reasonable here, because you now know what you are asking for.
- Train the people who have to follow it — hands-on, on your own documents, with the assistants you already pay for. This is the deliverable the data says gets skipped.
- Add a governance consultant or fractional owner only when something external demands it: an audit, a customer security review, an insurer’s questionnaire, a certification requirement.
Reverse that order and you pay a consultant to discover facts you could have gathered in a week.
Frequently asked questions
Do we need a lawyer to write our AI use policy?
Not to write it. You need one to say which rules bind you and where the draft conflicts with your handbook, NDAs or client contracts. At this size that is often two to four hours rather than a package — the highest-value legal spend in the sequence.
How much should an AI use policy cost us?
Published ranges put flat-fee drafting at $3,000 to $10,000, small-firm legal work at $200 to $400 an hour, and ISO readiness at $8,000 to $25,000. The rollout often costs more than the document and is budgeted less often.
What does an AI policy consultant actually deliver?
Typically an inventory, a risk classification, a gap analysis against the NIST AI RMF or ISO/IEC 42001, a drafted policy and a roadmap. Not a legal position you can rely on, and not a change in how staff behave.
Does the EU AI Act apply to a US company with no EU customers?
Usually not directly, though EU staff or contracts flowing the obligation down can pull you in. Even where it does not bind you, the Article 4 literacy expectation is a reasonable standard to design against.
Can we start with a template?
Yes, for structure. The failure mode is inheriting a template’s assumptions about your contracts and tools, both company-specific. A cheap start and an expensive final answer.
Is a certification a reason to pick one provider over another?
Only where the credential matches the work. An AIGP holder has studied governance implementation; an ISO lead implementer, management systems. Neither says whether they have run a rollout at your size.
Should legal or operations run the rollout?
Legal owns the position and the clauses; operations owns the inventory, the approval path and the capability work. Survey data splits primary ownership evenly between privacy, legal and IT, which mostly shows there is no settled answer. Pick a person, not a function.
Is AI governance training the same as policy consulting?
No. AI governance training teaches a small group the frameworks and approval mechanics. Policy consulting produces documents and a program. Staff-level AI security training is a third thing, and its cost is quoted per seat rather than per engagement.
What if we have a policy already and nothing has changed?
Then you bought item two and skipped three through five — the most common outcome in this market. Start with the inventory and the capability work, not a second document.
Key takeaways
- The search term covers two unrelated markets, and the rankings beside them are mostly published by market participants.
- “Help with our AI policy” is five separable deliverables: the legal position, the clauses, the inventory, the approval path, and staff capability. No provider type is best at all five.
- Ranges run $200 to $1,000+ an hour for legal time, $3,000 to $10,000 for flat-fee drafting, $8,000 to $25,000 for ISO readiness and $5,000 to $30,000 a month for a fractional owner. The NIST framework under most of it is free.
- Littler’s 2026 survey found 68% of employers have a formal AI policy, up from 38%, but only 55% have a tool approval process and fewer than half have vendor vetting or a named oversight owner.
- Article 4 of the EU AI Act, amended by Regulation (EU) 2026/1744 and supervised nationally since August 2, 2026, asks for measures supporting AI literacy — no certificate, no AI officer, no testing.
- Buy in order: inventory yourself, a few hours of legal time, drafted clauses, capability training, then a consultant only when something external demands one.
If you have a policy and no evidence anyone follows it, book a free AI readiness call. We will go through your inventory, who holds the approvals, and which of the five deliverables is missing.
Dirk Jan van Veen, PhD
