Tier 1
AIMS Gap Assessment
Where do we stand against ISO 42001, and what should we fix first?
£1,500
Standard £1,750
Founding rate · first 3 clients
2–3 weeks
Payment: 100% upfront
Best for: teams that need a clear starting point
ISO/IEC 42001 for UK SaaS companies
Your enterprise customers are asking how you govern AI. Have a clear answer ready.
Fixed-scope ISO/IEC 42001 services that map your AI systems, risks and vendors into a governance framework you can show to buyers and auditors. Delivered by a software engineer who reads your architecture, not just your policies.
- PECB Certified ISO/IEC 42001 Provisional Implementer
- Software engineer + lawyer
- Fixed scope, fixed price
- Client workspace included
- NDA before any documents
Founding client rate
Tier 1
AIMS Gap Assessment
2–3 weeks · 100% upfront
Tier 2
AI Governance Readiness
4–6 weeks · 100% upfront
Tier 3
End-to-End AIMS Implementation
4–6 months · Deposit + monthly instalments
Scope, deliverables, responsibilities and start date are confirmed in writing before any payment is made.
The problem
Five questions every enterprise buyer will ask.
AI features ship fast, but ownership, risk decisions and evidence are scattered across product, engineering and vendor documents.
ISO/IEC 42001 gives you one structured way to govern AI and prove it.
—Which AI systems do you use and who owns them?
—How do you assess AI risk?
—How do you assess impact on users?
—How do you manage AI vendors like LLM providers?
—Who reviews AI outputs and how?
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for an AI Management System (AIMS). Published in December 2023, it sets out how an organisation should govern the AI systems it builds, provides or uses: who owns them, how risks and impacts are assessed, which controls apply, and how it all gets reviewed and improved. It follows the same management-system structure as ISO 27001, so if you already have an ISMS, much of the groundwork exists.
Why SaaS companies are adopting it
- Enterprise buyers ask harder AI questions in security reviews and procurement.
- One framework instead of ad-hoc answers to every questionnaire.
- Selling into Europe? It helps organise the governance work the EU AI Act expects.
- Voluntary but certifiable: you can align with it now and decide on certification later.
Services
Choose the starting point your team needs.
Tier 2
Most popularAI Governance Readiness
Assess our real AI risks and give us the core governance foundation.
£3,950
Standard £4,500
Founding rate · first 3 clients
4–6 weeks
Payment: 100% upfront
Best for: answering enterprise AI questions with evidence
Tier 3
End-to-End AIMS Implementation
Build our full AI management system and get us ready for certification.
£10,000
Standard from £12,500
Founding rate · first client only
4–6 months
Payment: Deposit + monthly instalments
Best for: companies heading for ISO 42001 certification
Each tier includes everything in the one before it. Not sure where to start? Begin with Tier 1 — the full fee is credited if you upgrade to Tier 2 within 30 days.
How it works
Four clear steps.
Discovery call
We confirm fit, your AI systems and your goals.
Agree scope
Written scope, responsibilities, timeline and payment before work begins.
Assess and build
Interviews, technical walkthroughs, assessments and documentation.
Review and hand over
Walkthrough of deliverables and next steps.
Client Governance Workspace included
Your client governance dashboard, included with every service
A private workspace for progress, AI systems, findings, actions and deliverables. Tier 1 shows gap results; Tiers 2 and 3 add risk, impact and implementation tracking.
Progress tracker
AI systems and gap findings
Risks and recommended actions
Evidence and document references
Deliverable downloads
Risk, impact and implementation tracking
Tiers 2 and 3
Illustrative workspace preview using fictional data. Kestrova is a fictional UK HR SaaS company used to show how an engagement works across all three tiers.
Bhaviyo · Client Governance Workspace
Sample dataAssessment Overview
Kestrova Ltd (fictional) · Sample records
AI systems found
7
Red gap areas
8 of 15
Key findings
6
Roadmap actions
19
Recent items
| Item | Status |
|---|---|
| AI System Inventory | Delivered |
| Gap Assessment Report | Delivered |
| Training-data rights (F-02) | Referred to General Counsel |
Sample records only—not client results and not package limits.
Workspace access is included during delivery and for 90 calendar days after final handover. Reports and editable registers can be downloaded. Ongoing updates and monitoring require a separate agreement.
Pricing & payment
Fixed scope. Clear payment plans.
| Service | Founding rate | Standard rate | Payment |
|---|---|---|---|
| Tier 1 · AIMS Gap Assessment | £1,500 (first 3 clients) | £1,750 | 100% upfront |
| Tier 2 · AI Governance Readiness | £3,950 (first 3 clients) | £4,500 | 100% upfront |
| Tier 3 · End-to-End AIMS Implementation | £10,000 (first client only) | from £12,500 | Deposit + monthly |
Add-ons and upgrade credits
- Extra AI system in Tier 2: £950.
- Extra AI system in Tier 3: £1,500.
- Organisations with 75–250 staff quoted after Tier 1.
- Tier 2 → Tier 3 upgrade within 60 days: £1,500 credited.
How payment works
- Tiers 1 and 2: paid in full before kickoff.
- Tier 3: a deposit before kickoff, then monthly instalments.
- Nothing is charged until scope, deliverables and start date are agreed in writing.
Prices in GBP. Taxes, if any, are confirmed in your written quote.
Your information
How we handle your information
You may share vendor agreements, internal documentation and details of how your AI systems work. Here is how that information is handled.
Where it's stored
Engagement documents are kept in Google Workspace (Google Drive, Docs and Sheets). The Client Governance Workspace is built and hosted on Lovable. Access to both is limited to the founder and the people you authorise. Bhaviyo's founder works from India, so information is accessed from India under appropriate data-transfer safeguards.
Who can access it
Only the founder and the users you authorise can access your Workspace.
AI tools
Your documents are not put into AI tools unless you agree in writing. If you agree, we confirm which tools will be used and how before any document is processed.
Retention
Workspace access continues for 90 calendar days after final handover. After that, engagement data is deleted within 45 days unless we agree otherwise in writing.
Confidentiality
We are happy to sign your NDA, or provide ours, before you share any documents.
Why Bhaviyo
Founder-led. Clearly scoped. Practical to hand over.
ISO 42001 implementation by someone who understands how AI systems are actually built.
Nidhi Bharti
Nidhi Bharti — software engineer and Lawyer. Founder-led delivery: the person you speak to does the work.
Through Novessa Digital, Nidhi also designs and builds AI automation for regulated professional services, so governance advice is grounded in how AI systems are actually deployed.
PECB Certified ISO/IEC 42001 Provisional Implementer
Built by an engineer
Reads your AI architecture, data flows and LLM integrations.
Evidence-based
Every finding tied to the standard and your documents.
Practical handover
Documents your team can actually maintain.
Software engineering
Lawyer
PECB Certified ISO/IEC 42001 Provisional Implementer
Who we work with
Is Bhaviyo a fit for your team?
Best fit
UK SaaS companies (about 20–250 staff) using AI in their product or operations, especially those selling to enterprise, regulated or EU customers, or already holding ISO 27001.
Not a fit
- —Companies not using AI
- —Formal legal opinions
- —Certification audits
- —Penetration or model testing
- —Internal audits of an AIMS we implemented
Scope boundaries
What's not included.
- —Certification body audit fees (paid directly by the client).
- —Any guarantee of certification.
- —Legal advice or legal opinions.
- —Penetration, bias or model testing.
- —Performing the internal audit of an AIMS we implemented (must be independent).
Questions
Frequently asked.
No. Certification is issued by an accredited certification body. We help you build and prepare the AIMS the auditors will review.
I'm based in India and work with UK clients remotely. Calls and workshops are scheduled between 9am and 2pm UK time, and I reply to emails within one business day. Prices and invoices are in GBP, and you can pay by UK bank transfer to a GBP account, with no international transfer needed.
No. If you have it, we build on your existing management system instead of creating a parallel one.
No, it's voluntary. Many SaaS companies adopt it because enterprise customers ask for evidence of AI governance.
If unsure, start with Tier 1. The full fee is credited if you upgrade to Tier 2 within 30 days.
Remotely, through video workshops, interviews and your client governance workspace. Sessions are scheduled between 9am and 2pm UK time.
A project owner, a technical contact who can explain your AI systems, and leadership time for approvals. We confirm this at kickoff.
A reduced price for our first clients in exchange for a case study and testimonial.
Book a Discovery Call
Not sure where you stand on ISO 42001? Let's find out.
Tell us briefly how you use AI and any customer deadline. We reply within 1 business day to book a 30-minute discovery call.
Book a Discovery Call
AIMS Gap Assessment
AI Governance Readiness
End-to-End AIMS Implementation
Any legally applicable taxes will be confirmed in the written quote before payment.
Form not loading? Open it in a new tab.
Open the booking formBy submitting, you agree that Bhaviyo may contact you about your enquiry. Your information will be handled according to the Bhaviyo Privacy Notice.