AI Governance Cost Estimator: Four Ways In, by Entity Size · Triodian

Who it’s for · Cost estimator

What does AI governance cost at your size?

Four ways to the same position: the board’s appetite, a register of AI arrangements, and evidence from your providers.

Pick your jurisdiction and sector, then move the slider to your size. The estimator compares running the open-source app suite with your own teams and an external law firm against a consultancy-led programme, a law firm-led engagement and an enterprise AI governance platform, with the same scope for all four: the AI arrangements behind your critical operations first, the rest triaged. Every figure is an indicative estimate in Australian dollars, built from stated assumptions, not a quote.

Not legal advice. Triodian records positions and states what documents show. Whether anything meets a legal obligation, and what your duties require, are questions for your counsel.

Jurisdiction

Australia is the only jurisdiction the estimator covers today. Others follow as their sector packs ship; see regulated entities for the jurisdictions the suite serves.

Currency

{{ currencyNote }}

Entity type

{{ sectorNote }}

Who runs the suite in option A

{{ runNote }}

{{ sizeLabel }}
{{ scopeLabel }}

Defaults to the arrangements usually behind critical operations at this size. Move it if you already know your count.

Option A

The app suite, your teams with external counsel

Open source under Apache 2.0, run inside your organisation, with a law firm on the legal determinations.

{{ a.year1 }}

year one

{{ a.ongoing }} a year after that {{ a.weeks }} to a board-approved position

Option B

Consultancy-led programme

A large consultancy designs the framework, implements tooling and reviews the result.

{{ b.year1 }}

year one

{{ b.ongoing }} a year after that {{ b.weeks }} to a board-approved position

Option C

Law firm-led engagement

A law firm runs the gap analysis, drafts the framework and remediates provider contracts.

{{ c.year1 }}

year one

{{ c.ongoing }} a year after that {{ c.weeks }} to a board-approved position

Option D

Enterprise AI governance platform

The highest-scoring enterprise platform in our November 2026 public evidence review, with counsel on what it does not cover.

{{ d.year1 }}

year one

{{ d.ongoing }} a year after that {{ d.weeks }} to a board-approved position

{{ headline }}

Primary delivery and the secondary layer

What sits on top of whoever does the work.

The secondary layer is external lawyers who are not part of delivery, and an independent review of the result. Every path carries one. In option A the law firm working the engagement is part of delivery, so the layer is the separate legal and technical validation of the suite before you rely on it.

Primary delivery, option A Primary delivery, options B, C and D Secondary layer: external lawyers and independent review
Option A · The app suite{{ a.primary }} primary + {{ a.secondary }} secondary

{{ a.secondaryNote }}

Option B · Consultancy-led{{ b.primary }} primary + {{ b.secondary }} secondary

{{ b.secondaryNote }}

Option C · Law firm-led{{ c.primary }} primary + {{ c.secondary }} secondary

{{ c.secondaryNote }}

Option D · Enterprise platform{{ d.primary }} primary + {{ d.secondary }} secondary

{{ d.secondaryNote }}

Year one, line by line

Where the money goes in each path.

Lines scale with your sector, your size and the number of arrangements in scope. Highlighted lines are the secondary layer.

Option A · The app suite

LineYear one
{{ row.label }}{{ row.amount }}
Year one{{ a.year1 }}

Option B · Consultancy-led

LineYear one
{{ row.label }}{{ row.amount }}
Year one{{ b.year1 }}

Option C · Law firm-led

LineYear one
{{ row.label }}{{ row.amount }}
Year one{{ c.year1 }}

Option D · Enterprise platform

LineYear one
{{ row.label }}{{ row.amount }}
Year one{{ d.year1 }}

Time to a board-approved position

Weeks from the start of the engagement.

Option A runs the legal and technical validation of the suite in parallel with the assessment itself, so validation adds cost but not calendar time. The consultancy and law-firm paths run in sequence: scope, assess, design, implement or remediate, then review and sign off. The platform path starts with procurement and contracting, which the other three do not need, then configures the module and brings counsel in for what the platform does not cover.

{{ p.name }}{{ p.done }}
{{ r.label }}

Three-year cost of ownership

Year one plus two years of running cost.

Hosting, annual re-validation, counsel on matter briefs, platform licences, and the annual legal or assurance review.

{{ t.name }}
{{ t.amount }}

{{ threeYearNote }}

What each path delivers

The same position, with different strengths.

OutcomeABCD
Board-set appetite with defined triggersStrongPartialPartialPartial
Register of AI arrangements with an evidence rung eachStrongStrongPartialStrong
Legal privilege over findingsStrongLimitedStrongLimited
Independent assurance signal to a supervisorPartialStrongPartialPartial
Agent controls, code security, staff trainingNot coveredPartialNot coveredStrong
Repeatable in-house after the engagementYes, ownedWith toolingRe-engageWith licence
Run in production at a regulated entityNot yetYesYesYes

{{ obligationsNote }} What option A does not cover is filled by tools you most likely already license and your own learning team; what option D does not cover is the counsel top-up in its estimate.

Validating the suite before you rely on it

{{ validationHeading }}

Option A is only cheaper if the suite stands up to your counsel and your technology risk function. The estimate carries that cost in full, as four pieces of work that run in the first six to eight weeks.

Legal · {{ v1 }}

Counsel reviews the framework wording, the appetite decisions, the authority and consequence scales and the sector pack against the obligations on your jurisdiction page.

Legal · {{ v2 }}

Atlas obligation records checked against the instruments in force; privilege and document-marking position settled; Apache 2.0 and trademark terms confirmed.

Technical · {{ v3 }}

Source and architecture review of the repositories and installer; penetration test of the hosted apps; dependency and secret scanning confirmed.

Technical · {{ v4 }}

{{ v4text }}

Assumptions

How the numbers are built.

All figures are indicative estimates in Australian dollars excluding GST, for planning only. No quotes have been obtained from any consultancy, law firm or platform vendor, and none is named. Ranges of plus or minus 40 per cent are realistic for options B and C, which vary widely with scope.

Scope. The AI arrangements behind critical operations first, the rest triaged. The default count rises with entity size; the slider overrides it. Internal effort and provider-contract remediation scale with the count.

Size and sector. Consultancy and law-firm fees scale with the entity size band, and with how much the sector’s supervisor asks for. General entities with no prudential supervisor carry a lighter legal load and no provider assessment of the suite as a material service provider.

Option A. The suite is self-hosted under Apache 2.0 with free community support. Your teams run it; an external law firm makes the legal determinations in the five-day turnaround model. When Triodian runs it with you, the published fees on the engagement pages are added and the internal effort falls. Legal and technical validation of the suite are counted in full.

Rates. External legal effort is priced from published Australian market surveys of top-tier firm rates; consultancy effort from typical partner-led team blends for large regulated entities; internal effort at a loaded cost per person-day. The rates themselves are not published here.

Option D. The platform is the highest-scoring proprietary tool in Triodian’s November 2026 public evidence review of AI governance products, described here generically; it is not named and its licence is not published. The estimate carries procurement (market evaluation, requirements, tender and selection), contracting and vendor due diligence (agreement negotiation, security and data assessment, and for regulated entities onboarding as a service provider), a module licence that scales with seats, implementation by a platform partner, your own effort, and a counsel engagement for what the review found the platform does not cover: a board-set appetite with triggers, provider evidence to the fourth party, and Australian sector content. Scores in that review compare coverage and do not establish supervisory compliance.

Status. The super trustee, ADI and insurer packs, the register import and the supervisor evidence index are in the development plan; see how we grade claims. The suite does not yet run in production at a regulated entity, and the estimate says so in the comparison table.