EU AI Act and ISO/IEC 42001 readiness · Large organisation (250 staff or more) · Health and care
EU AI Act and ISO/IEC 42001 readiness for a large health technology company
A readiness programme for a large health technology company: which of its AI systems fall under the EU AI Act and in which risk class, the gaps against ISO/IEC 42001, and a costed plan to close them. Medical device rules and the AI Act overlap for some products.
Illustrative cost
£27,000 to £70,000 ex VAT
- Typical
- £44,000
- Duration
- About 12 weeks
- Effort
- 51 to 96 days
Illustrative estimate, not a quote. Real prices vary.
Worked out from UK freelance contractor day rates in job adverts, with no consultancy or agency margin added. Consultancies and agencies usually charge more.
Source: IT Jobs Watch. Rates read on ; costs computed on .
What is included
- Inventory and classification of AI systems
- Gap analysis against the EU AI Act obligations that apply and ISO/IEC 42001
- A remediation plan with owners
- Core documentation for an AI management system
Deliverables
- AI system inventory and classification
- Gap analysis
- Remediation plan
- AI management system document set
Assumptions
- Up to ten AI systems in scope
- Client legal counsel reviews the classification
- Certification audit fees are separate
Not included
- Legal advice or a legal opinion
- Certification audit
- Technical remediation work
Project plan
Phases run one after another, about 12 weeks in all.
| Phase | Weeks | Main tasks |
|---|---|---|
| Scoping and inventory | 3 | Find AI systems; Classify by risk |
| Gap analysis | 3 | Assess against obligations; Assess against ISO/IEC 42001 controls; Security review |
| Remediation plan | 3 | Prioritise gaps; Plan with owners and budgets |
| Documentation | 3 | Policies and procedures; Records and templates |
Who does the work
Person-days per role in each phase, low and high effort.
| Phase | Role | Days (low to high) |
|---|---|---|
| Scoping and inventory | AI governance consultant | 9 to 15 days |
| Scoping and inventory | Business analyst | 6 to 9 days |
| Gap analysis | AI governance consultant | 12 to 21 days |
| Gap analysis | Cyber security consultant | 3 to 9 days |
| Remediation plan | AI governance consultant | 9 to 15 days |
| Remediation plan | Project manager | 3 to 9 days |
| Documentation | AI governance consultant | 9 to 18 days |
How the cost adds up
| Role | Low (days × 25th percentile) | Typical (days × median) | High (days × 90th percentile) |
|---|---|---|---|
| AI governance consultant | 39 × £563 = £21,957 | 54 × £625 = £33,751 | 69 × £743 = £51,267 |
| Business analyst | 6 × £425 = £2,550 | 7.5 × £500 = £3,750 | 9 × £662 = £5,958 |
| Cyber security consultant | 3 × £520 = £1,560 | 6 × £581 = £3,486 | 9 × £675 = £6,075 |
| Project manager | 3 × £451 = £1,353 | 6 × £540 = £3,240 | 9 × £714 = £6,426 |
| Total, rounded | £27,000 | £44,000 | £70,000 |
How these estimates are worked out
Effort: for each phase we estimate how many days each role works, as a low and a high case. These are our estimates for a typical project of this kind, not measured data.
Rates: each role's daily rate comes from UK contract job adverts over the last six months, as published by IT Jobs Watch. These are freelance contractor rates as advertised, not what was paid, and not what a consultancy or agency charges.
Low end: the low-effort days at each role's 25th-percentile rate. We use the 25th percentile, not the 10th, because the lowest effort at the cheapest rates gives a floor few buyers would ever meet.
Typical: the mid-point between low and high effort, at each role's median rate.
High end: the high-effort days at each role's 90th-percentile rate.
Totals are rounded to the nearest £500 below £10,000 and the nearest £1,000 above, and exclude VAT. Phases run one after another.
Not included:
- Software licences, model and hosting fees
- Travel and expenses
- Your own staff's time
- A consultancy's or agency's margin, overheads and risk
Real prices vary with the supplier, the state of your data and systems, how much of the work your own team does, where the work happens and how much risk the supplier carries. Consultancies and agencies usually charge more than these contractor rates, and a fixed price usually costs more than time and materials because the supplier takes the risk.
Sources
Source: IT Jobs Watch: UK contract job adverts quoting a daily rate, 6 months to 15 November 2026. Each role's page was read on . Published under CC BY-NC-SA 4.0.
| Role | IT Jobs Watch page | Rates quoted | 25th percentile | Median | 90th percentile |
|---|---|---|---|---|---|
| AI governance consultantIT Jobs Watch has no "AI Governance" contract title with daily rates; mapped to the closest title, Data Governance Consultant. Small sample (14 rates): treat as indicative. | Data Governance Consultant | 14 | £563 | £625 | £743 |
| Business analyst | Business Analyst | 1,394 | £425 | £500 | £662 |
| Cyber security consultant | Cybersecurity Consultant | 86 | £520 | £581 | £675 |
| Project manager | Project Manager | 1,226 | £451 | £540 | £714 |