Who should build your AI register and run your assessments
In-house, a consultant or software: what each route to an AI governance program is genuinely good at, what each costs and the structural difference between them.
Who should build your AI register and run your assessments?
An organisation that decides to govern its AI properly faces a build question before any framework question: who actually does the work? The register of systems, the risk and impact assessments, the controls, the policies, the records a board or auditor will one day ask for. There are three ways to get it done: your own people, a consultant or software. This page is a decision guide for choosing between them, written by a software vendor, which you should weigh as you read. Aicura is the software option here, and the other two are treated on their merits because for some organisations they are the right answer.
Option one: in-house
Your risk analyst or governance lead builds the register in a spreadsheet, writes the assessments from a template and keeps a controls tab beside it.
Where it wins: nobody knows your systems like your own people, the cost looks like zero and the work builds internal capability that outlasts any engagement. For an organisation with a handful of stable systems and a capable owner, in-house is genuinely fine.
Where it strains: the work is repetitive at exactly the points where attention matters, every assessment starts from a blank page carrying the quality of that analyst’s week, and the spreadsheet register decays quietly because updating it is nobody’s real job. The hidden cost is the analyst’s time, which is usually the scarcest senior attention in the risk function, spent on drafting and formatting rather than judgement. And when the organisation is asked to show its work, a folder of documents with inconsistent structure and no change history is what exists.
Option two: a consultant
A governance or risk consultancy scopes an engagement, interviews your people, builds the register, writes the assessments and hands over a framework with policies and templates.
Where it wins: deep expertise on tap, an outside eye that finds what insiders normalise, credibility in front of a board and speed to a professional first version. For a genuinely novel or contested question, a bespoke review by people who have seen fifty organisations is worth its fee.
Where it strains: the engagement ends. What it leaves is a set of documents true as at handover, and the first system change after the consultants leave begins the drift. Engagements of this shape commonly run from tens of thousands of dollars for a scoped review to well past a hundred thousand for a full program build, and the maintenance either becomes a retainer, becomes the in-house option above or does not happen. The economics only close if the work stops moving, and AI estates do not stop moving.
Option three: software
The register lives in a system built for it, and the assessments are generated from the register data rather than written from scratch.
Where it wins: the structural difference is tense. A register entry versions as the system changes, the assessment regenerates when the entry does, the controls carry owners and states, and the record accumulates as a by-product of the work rather than as a separate documentation effort. In Aicura the accountable owner refines and locks each generated assessment, the risks and controls flow to the Risk Register, and every locked record is sealed in the Evidence Vault so it can be proven unchanged later. The analyst’s hours move from drafting to judgement, which is the part that was worth their salary all along. A subscription costs a fraction of an engagement, and the pricing page has the current rates.
Where it strains: software cannot know what only your people know, so the refinement step is real work, and a system nobody feeds is a register in name only. Aicura drafts, structures and keeps the record, and it does not certify, audit or make the call, so an organisation wanting someone external to own the judgement is buying the consultant, not the tool.
The structural question underneath
All three options can produce a good register and a good assessment this quarter. The question that separates them is what exists two quarters later, after a vendor model update, a new system and a staff change. In-house survives if the analyst’s discipline does. The consultant’s work survives until it is out of date, which is a fact about engagements, not about consultants. Software survives because staying current is the product.
The hybrid is common, with software as the standing record, your people doing the refinement and the judgement, and a consultant brought in for the genuinely bespoke question when one arrives. Those engagements get sharper and cheaper when the consultant walks into a live register instead of a discovery phase.
A note on this page
Written by Aicura, which sells one of the three options above. The characterisations of the other two are offered straight, and where your situation genuinely calls for bespoke professional judgement, buy it. Nothing here is legal advice.
Related guides
Do this work in Aicura
Aicura is your AI Register, and Essentials runs the risk assessments, the risk register, the derived controls and the governance policies on top of it, with the privacy disclosure work included. It is guidance to help you do the work, not certification or legal advice.