Governance is the line item that unblocks the rest of your AI budget.

MetaMinds publishes a fixed price and a fixed duration for every assurance engagement on this page, from $2,500 to $8,900. A vendor AI assessment is $2,500 over 3 days; an EU AI Act readiness assessment is $4,900 over 1 week; an ISO/IEC 42001 gap assessment is $8,900 over 2 to 3 weeks. There is no scoping fee and no discovery retainer in front of any of them, and the deposit that reserves a named start week is stated on the card.

An ISO/IEC 42001 gap assessment at MetaMinds is $8,900 over 2 to 3 weeks and produces a control-by-control statement of where the AI management system stands against the standard, the evidence that already exists, the evidence that does not, and what has to be built before an accredited certification body would find it auditable. It does not produce a certificate and it cannot: certification against ISO/IEC 42001 requires an audit by an accredited certification body, which MetaMinds is not.

Take them in the order your buyer asks in. ISO/IEC 42001 is a certifiable management-system standard, so a $8,900 gap assessment is the right first step when a customer contract, a tender or a group policy names certification as the destination. NIST AI RMF is a voluntary framework with no certificate behind it, so a $7,500 alignment review is the right first step for a US organization that has been asked to show a risk process rather than a certificate. Doing NIST first and ISO later is cheaper than the reverse, because the risk work maps forward into the management system.

A hallucination and grounding audit is $5,900 over 2 weeks. It measures whether each answer is supported by the sources the system actually retrieved, rather than whether it sounds right, and it reports a rate with the test set attached so the number can be reproduced. MetaMinds runs the same mechanism on its own platform: CourtNetra has a weekly automated hallucination evaluation in CI that fails the build above 2% across a corpus of 18,863,754 judgments, which is the difference between a gate and a dashboard.

Yes. A vendor AI assessment is $2,500 over 3 days, and it is deliberately the smallest engagement MetaMinds sells, because the point is to assess a supplier before signing rather than after. It reads what the vendor claims, tests what can be tested from outside, and returns the questions their answers do not survive.

Yes, and the difference is where the input comes from. A conventional penetration test looks at the application's own attack surface. An AI security assessment at $6,500 over 2 weeks also covers the surface a language model adds: instructions arriving inside retrieved documents, tool and function calls the model can reach, what an agent is permitted to do without a human, and what leaves the boundary in a prompt. MetaMinds does both, from an offensive security background that includes vulnerability assessment across more than 50 government web assets, delivered under public sector engagement rules.

Certification against ISO/IEC 42001 is issued by an accredited certification body after an external audit, and a SOC 2 report by a licensed CPA firm after an observation window. You engage that body directly, and its fee sits outside this one. MetaMinds sells gap assessment, readiness, control design and evidence preparation for the auditor who issues them, which is the half that decides how the audit goes: the controls designed, the evidence assembled, and the gaps closed before anyone asks to see them.

As a division of labour. MetaMinds answers the engineering question, which is what evidence exists for each obligation and whether it would survive being asked for: the systems in scope, the classification reasoning recorded, the disclosure wording, and the evidence structure. Your counsel makes the legal determination, and the reports are written to be handed straight to them for exactly that reason.

The EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI; ISO/IEC 42001 as the certifiable AI management system standard; the NIST AI Risk Management Framework; and the AI-specific parts of a SOC 2 or ISO/IEC 27001 evidence pack where an existing certification has to absorb a new AI system. Where a client's obligation sits outside those, MetaMinds says so rather than stretching an engagement to cover it.

Between 3 days and 2 to 3 weeks, stated per engagement on the card rather than estimated afterwards. Every deliverable is written for two readers, engineers with enough detail to act on and a board with enough context to decide on, and every one ends with an explicit list of the things you do not need MetaMinds for, wherever that is true.