ETHORITY®
ETHORITY · ADVISORY SERVICE · FROM €19,500 · 4–8 WEEKS
Governance running in 8 weeks, before 2 Dec 2027.
Bring AI under control: roles, decision rights, an approval workflow, a maintained register and policies, mapped to the AI Act, ISO/IEC 42001 and NIST AI RMF.
- €19,500
- Essential, one legal entity, 4 weeksETHORITY price list, 16 Oct 2026
- €39,000
- Complete, group or several units, 8 weeksETHORITY price list, 16 Oct 2026
- 2
- real AI cases run through the new workflowETHORITY product sheet, 16 Oct 2026
- 2 Dec 2027
- Annex III high-risk obligations of the AI Act applyReg. (EU) 2026/1744 · White & Case, Aug 2026 · whitecase.com ↗
Eight deliverables, from operating model to board report.
Each is built in ETHORITY templates and adapted to your size, not copied from a bank.
ETHORITY product sheet, 16 Oct 2026
Three frameworks mapped in one table.
AI Act obligations, ISO/IEC 42001 controls and NIST AI RMF functions sit side by side.
ETHORITY product sheet, 16 Oct 2026
Two real AI cases tested before go-live.
In the Complete package the workflow is proven on live cases, then adjusted.
ETHORITY product sheet, 16 Oct 2026
Who it is for
Companies with more than about ten AI uses or with possible high-risk AI; groups with several business units; companies preparing for ISO/IEC 42001 or customer audits; CIOs, CDOs and Heads of AI who need a clear mandate.
The prerequisite is an AI inventory. If none exists, an AI Act Readiness Sprint runs first and its register is reused.
The question it answers
Who may introduce AI here, who approves it, who monitors it and who answers for it?
What you receive
Select a result to see it in a scenario.
Scenario: a group with three business units and 28 registered AI uses (Complete package).
- 1
Operating model: AI board or committee, an AI owner per system, roles (RACI) and decision rights.
Operating model
Read as text
AI Governance Setup · Operating model · Scenario
Scenario: a group with three business units and 28 registered AI uses (Complete package).
AI board: CIO · CFO · Legal · Data protection · Works council
Business unit A, Business unit B, Business unit C
AI owners: 28 systems · one owner each
Decision | Decides | Accountable | Consulted | Informed
Approve a new high-risk use | AI board | Unit head | Legal, data protection | Works council
Approve a minimal-risk tool | AI owner | Unit head | IT security | AI board
Stop a system | AI owner | AI board | Legal | Users
- 2
Approval workflow from idea to production, with risk triage, checks per risk class, sign-offs and records.
Approval workflow
Read as text
AI Governance Setup · Approval workflow · Scenario
Scenario: a group with three business units and 28 registered AI uses (Complete package).
Idea (Anyone submits a use) → Intake (Purpose, data, vendor) → Triage (Risk class in 2 days) → Checks (Matched to the class) → Sign-off (By the right body) → Production (Registered, monitored)
- Minimal: 3 checks · AI owner signs · about 5 days
- Article 50: + disclosure text · about 10 days
- High-risk: + impact assessment, oversight, logs · AI board signs · about 6 weeks
Every step leaves a record in the register
- 33
AI register with a maintenance process.
- 44
Policy set in ETHORITY templates, adapted to you.
- 5
Framework mapping: AI Act obligations, ISO/IEC 42001 controls, NIST AI RMF functions.
Framework mapping
Read as text
AI Governance Setup · Framework mapping · excerpt · Scenario
Scenario: a group with three business units and 28 registered AI uses (Complete package).
Topic | EU AI Act | ISO/IEC 42001 | NIST AI RMF
AI literacy | Article 4 | Clause 7.2 · competence | GOVERN
Risk management | Article 9 | Clause 6.1 | MAP · MANAGE
Data and data quality | Article 10 | Annex A.7 | MAP · MEASURE
Impact assessment | Article 27 | Clause 6.1.4 · Annex A.5 | MAP
Third parties and vendors | Article 25 | Annex A.10 | GOVERN 6
Gap plan: 9 controls to add, 4 to adapt
Framework references: EU AI Act: Reg. (EU) 2024/1689 · ISO/IEC 42001:2023 · NIST AI RMF 1.0
- 66
Trust Chain evidence model: how claims about each system are recorded as vendor claim, measured or verified by a third party.
- 7
KPIs and reporting: a quarterly board report template.
Quarterly board report
Read as text
AI Governance Setup · Board report · Q1 2027 · Scenario
Scenario: a group with three business units and 28 registered AI uses (Complete package).
- AI uses registered: 28
- high-risk: 3
- new cases reviewed: 6
- pilots on real cases: 2
Decisions due:
- Approve the CV-screening oversight design
- Stop the unused translation tool
- Fund the logging upgrade
- Policies acknowledged: 92%
- Owners named: 28 of 28
- 88
Final presentation and a summary signed by Sten Franke.
1 / 4 · Operating model
AI board, an owner per system, roles and decision rights.
Scenario: a group with three business units and 28 registered AI uses (Complete package).
Read as text
AI Governance Setup · Operating model · Scenario
Scenario: a group with three business units and 28 registered AI uses (Complete package).
AI board: CIO · CFO · Legal · Data protection · Works council
Business unit A, Business unit B, Business unit C
AI owners: 28 systems · one owner each
Decision | Decides | Accountable | Consulted | Informed
Approve a new high-risk use | AI board | Unit head | Legal, data protection | Works council
Approve a minimal-risk tool | AI owner | Unit head | IT security | AI board
Stop a system | AI owner | AI board | Legal | Users
How it works
- Week 1
Mobilise: kick-off, review of the register and existing processes (IT, data protection, procurement, ISMS).
- Weeks 2–3
Design workshop on principles and risk appetite; operating model with committees, roles and links to ISMS and data protection.
- Weeks 3–5
Approval workflow (intake, triage, checks, sign-offs) and the policy set; second design workshop approves both.
- Weeks 6–7
Framework mapping and gap plan; pilot with two real AI cases; register maintenance, board report and KPI set.
- Week 8
Handover: two-hour training for AI owners, final presentation and signed summary. Essential compresses weeks 1–5 into four weeks without the pilot.
Packages and price
Essential
€19,500 one-time · net
One legal entity, 4 weeks: operating model, workflow, AI and usage policy, ISO 42001 readiness map, register handover or set-up.
Scope and delivery by agreement
See what this package includes →Request this package →Complete
€39,000 one-time · net
Group or several units, 8 weeks: unit variants, tool configuration support, full policy set, ISO 42001 gap plan, register KPIs, two-case pilot.
Scope and delivery by agreement
See what this package includes →Request this package →Terms
Net prices. Work starts after confirmed payment and complete agreed inputs. Your time: a sponsor for about one hour a week, a working group of three to five people for about two hours a week, and decision-makers for two workshops.
Boundary
A technical and organisational design that prepares you for ISO/IEC 42001. Your accredited certification body certifies, and your counsel signs off the legal questions.
Who is accountable for the result
Sten Franke
Founder & CEO
Sten Franke designs and builds AI systems, from model testing and cloud setup to the interfaces people use. He connects business decisions, software architecture and practical implementation.
AI architecture · Model testing · Cloud engineering · UX
His work spans programming, LLM evaluation, Google Cloud and AWS environments, and web applications built with Next.js and React. He connects business requirements, software architecture and practical implementation. Creator of the Good AI Prism, he brings market intelligence into AI decisions. Earlier, he created the Social Media Prisma, led a BVDW Social Media working group and contributed to its Social Media Kompass. His entrepreneurial work includes ethority, Gridpatrol and mediatime, following a practical foundation in electronics and industrial robotics.
sten@ethority.aiReal offerings we compare against
Vendors increasingly publish their own ISO/IEC 42001 status, and your workflow should record it as a provider fact. Three profiles show how: Agentforce in customer service, Rossum for document work and Tricentis Tosca AI agents.
Agentforce
Salesforce · Platform
Salesforce’s platform to build and run AI agents inside Salesforce, priced by consumption, by conversation or per user.
- Published price
- How it is billed
- Does it train AI on your data?
- Certificates and audit reports
Rossum
Rossum · Product
Rossum captures data from invoices, purchase orders and bills of lading using its in-house transactional LLM Aurora, holding fields below confidence thresholds for human validation before export to SAP or Coupa.
- Published price
- How it is billed
- Where data is stored
- Certificates and audit reports
Tricentis Tosca AI agents
Tricentis · Product
According to Tricentis: “AI agents built for the Tosca environment generate complete, end-to-end tests from plain-language descriptions.”
- How it is billed
- Where data is stored
- Does it train AI on your data?
- Certificates and audit reports
Read before you decide
Three insights behind the design, including governing the outcome, not only risk.
AI rules move from documents into daily operation.
Why AI agents, tools and constant change move AI governance – the rules and responsibilities for AI – into the systems that run your AI every day.
See the map on one page →
Govern the outcome, not only the risk.
Connect your AI rules to the business result, the full cost and the value you observe, and let them say stop.
See the map on one page →
A list of AI agents does not control them.
What controls AI agents in daily operation: clear rights, a record of how well each fact is supported, checks matched to the risk, data limits and alerts when something changes.
See the map on one page →Test your numbers first
The matching calculator is the EU AI Act Navigator: its duties by role feed your approval workflow. All tools sit in the ETHORITY AI calculator suite.
EU AI Act Navigator
Seven questions give an indicative risk class, your duties, the dates and the missing evidence, ready to take to your lawyer.
Pilot version · Scenario calculator
Open the calculator →AI Journey Planner
A plan from the first idea to scaling up, with milestones, owners, checkpoints and the EU AI Act dates in that period.
Pilot version · Scenario calculator
Open the calculator →Compare three offerings
Puts two to four offerings side by side in the same units, each fact with its source and the date it was checked.
Questions buyers ask
Do we need an inventory first?
Yes. If none exists, the sprint runs first and its register is handed into governance.
How does this prepare us for ISO 42001?
It maps your controls to ISO/IEC 42001 and, in Complete, delivers the gap analysis and plan your accredited certification body audits against.
Which tools do you configure?
In Complete, we support configuration in SharePoint, Jira, ServiceNow or similar tools you already run.
How do we keep it running?
Most clients continue with the AI Governance Retainer for register updates and quarterly board reports.
What if the workflow slows projects down?
That is what the two-case pilot is for: it tests speed as well as control, and the workflow is adjusted before go-live.
Next step
Book a 30-minute call to choose the package. For a group-wide view of tools, costs and vendors before governance, start with the AI Estate Audit & Mapping.
ETHORITY · LONG READ
Policies do not govern AI. Decisions do.
Many companies now hold an AI policy. Far fewer can name who approved the last AI tool, on what evidence, and when it will be reviewed again.
AI no longer enters a company through one project. It arrives with software updates, new vendor terms and teams that solve their own problems. A policy written once a year cannot keep up with that. What keeps up is an operating model: named owners, bounded authority, current evidence and a defined response to change.
The AI Governance Setup builds that model in four to eight weeks. It starts with the register, because governance needs a list of what it governs. It then settles three questions in two design workshops. Who decides, at which level of risk? What does a new AI case have to show before it is approved? And how does the board learn what changed?
The answers become working parts. An intake form and risk triage route each new case. Checks scale with the risk class, so a writing assistant does not wait as long as an AI step in credit decisions. Sign-offs are recorded. Each claim about a system carries a Trust Chain label, so everyone can see whether a statement is a vendor claim, a measurement or a third-party verification.
The framework mapping places AI Act obligations, ISO/IEC 42001 controls and NIST AI RMF functions in one table. That lets a company prepare for certification without building three parallel systems. The Annex III date of 2 December 2027, set by the AI Act Omnibus, gives the timetable.
In the Complete package, two real AI cases run through the new workflow before go-live. The test is practical: did the process produce a decision, how long did it take, and what would the team change? The answer adjusts the design. The wider argument for governance that runs in daily work is that control is only real when it shows up in decisions people actually make.
Sources and further reading
YOUR NEXT STEP
Discuss your question with Sten Franke.
Bring your business question or the figures you already know. ETHORITY investigates within the agreed scope; together with Sten Franke you agree the next piece of work.