Build vs Buy AI Governance: Spreadsheets, Consultants, or a Platform

Originally published at https://charz.ai/blog/build-vs-buy-ai-governance by Char-Z AI.

The Three Real Options

Build vs buy in AI governance usually gets framed as two choices. In practice buyers choose between three: run governance on spreadsheets and documents, hire consultants or a law firm to build and run it, or buy a platform your own team operates. Each has a different cost structure, a different time to usable evidence, and a different failure mode.

The question is not which is best in the abstract. It is which one produces the evidence you will actually be asked for — an inventory, a scored risk register, vendor due diligence, governance documentation, an audit trail — at a cost and cadence you can sustain.

Cost Comparison

• Spreadsheets and documents — typical annual cost: staff time only — basis: internal effort, no licence.
• Consulting engagement — $100k–$300k — custom advisory programs.
• Bespoke law firm program — $80k–$250k — legal-driven program design.
• Enterprise governance platform — $50k–$200k+ — enterprise GRC and compliance suites.
• Mid-market platform — $299–$1,499 per year — published self-serve pricing.

The figures for consulting, law firm programmes, and enterprise platforms reflect publicly available pricing and practitioner reports. What those engagements bundle is often what mid-market organizations do not need: dedicated account management, custom integrations, on-site training, and regulatory filing support.

Capability-by-capability, the comparison is starker, because the same work is priced very differently depending on how it is delivered:

• System inventory and risk scoring — a repeatable risk score per system — $50k+ bundled with an engagement.
• Vendor risk tracking — data access and posture per AI vendor — $20k+ per vendor assessment.
• Governance documentation — usage policies, data handling guidelines, incident playbooks — $40k+ in legal drafting.
• Framework mapping — risks related to EU AI Act, NIST AI RMF, or ISO/IEC 42001 as lenses — $30k+ per framework engagement.

How Fast Each Produces Evidence

Spreadsheets. Immediate and free. You can build an AI system inventory this afternoon. The limit is maintenance: scores drift, versions multiply, and nothing reminds anyone to review. Spreadsheets work well for a handful of systems and stop working when the register needs a query, a history, or a reviewer.

Consultants. Fast on substance, slow on handover. An engagement can produce a strong risk method and documentation, and the method is usually sound. What frequently does not transfer is the operating loop: after the report, nobody owns the cadence, and the inventory ages from the day the engagement ends.

Platform. Slower than a spreadsheet to start, faster than an engagement to a repeatable process. A platform encodes the register fields, the scoring rubric, the vendor records, and the review cadence so the process runs without a consultant in the loop. The evidence is generated as a by-product of using the tool rather than assembled retrospectively.

That last row is the important one. Whichever model you choose, evidence assembled retrospectively is distinguishable from evidence recorded at the time, and it is the weakest part of any governance program.

Where Each Option Breaks

• Spreadsheets — breaks when the inventory outgrows manual maintenance — warning sign: nobody can say how many AI systems are in use.
• Consultants — breaks when the engagement ends — warning sign: the register has not been updated since the final report.
• Platform — breaks when nobody is accountable for the cadence — warning sign: fields exist but reviews are not scheduled or recorded.
• Any option — breaks when evidence is reconstructed after the fact — warning sign: logs and approvals are created in preparation for a review.

That last row is the important one. Whichever model you choose, evidence assembled retrospectively is distinguishable from evidence recorded at the time, and it is the weakest part of any governance program.

A Practical Decision Rule

• Fewer than roughly five AI systems, no external pressure. Spreadsheets and a documented review cadence are proportionate. Do not buy a platform to solve a discipline problem.
• External pressure but no internal capacity. A consultant can bootstrap the method; the exit plan must include who runs it afterwards, in what tool, on what cadence.
• Ongoing obligations and more than a handful of systems. Buy, because the cost of maintaining the register, the vendor records, and the evidence manually exceeds the cost of a platform, and the licence price for mid-market tooling is one to two orders of magnitude below the enterprise and consulting alternatives.

The wrong answer in both directions is symmetrical: buying an enterprise suite to govern three systems, or running a regulatory program on a spreadsheet that no one owns.

Frequently Asked Questions

Is a spreadsheet enough for AI governance?

For a small number of systems and no external reporting pressure, yes — the value is the review loop, not the container. It stops being enough when the inventory needs history, access control, or evidence that a review happened.

Why do consulting programs leave gaps?

The deliverable is usually the method and documentation, not the operating cadence. Unless the handover explicitly assigns owners and a review schedule, the register starts aging the day the engagement closes.

What should a platform do that a document cannot?

Maintain the register as a queryable record with owners, scores, due dates, and history; generate vendor and risk views without manual assembly; and produce exportable evidence without a retrospective exercise.

How do I justify the cost of mid-market tooling?

Compare against the alternative lines in your own budget — a vendor assessment, a framework engagement, or legal drafting hours — rather than against doing nothing. The published platform price is a small fraction of a single consulting deliverable.

Sources

European Commission. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council. *Official Journal of the European Union*. https://eur-lex.europa.eu/eli/reg/2024/1689
NIST. (2023). *Artificial Intelligence Risk Management Framework (AI RMF 1.0)*. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
ISO. (2023). *ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system*. International Organization for Standardization.