MSP guide
You did the AI policy project for one client — as a favor, or because they asked and you didn't want to say no. It went fine. Now the question is whether that was a one-time bespoke job or the start of something you can sell across your roster. The difference is whether you productize it before you do it a second time.
The trap
A first AI governance engagement isn't a service line yet — it's a favor with an invoice attached.
The acceptable-use policy, the tool review notes, the employee FAQ — drafted fresh, in that client's voice. Nothing from the first engagement is directly reusable on the second, because nothing was built to be reused.
The hours that move the engagement forward — discovery, tool decisions, stakeholder alignment — are a small fraction of the total. The rest is a senior person staring at a blank page, writing policy language they've effectively written before.
Without a fixed deliverable set, there's nothing to put on a service menu. The next prospect gets a custom quote and timeline, same as the first one. A few engagements in, you have a pattern of favors, not a service.
A service line needs a fixed thing to sell. If every engagement starts from a blank page, you don't have one yet — you have a skill.
Productizing
Not a slogan — four specific, checkable things.
The test: can someone other than your most senior person deliver the second and third engagement, starting from the first one's output? If not, that's still a bespoke practice, not a service.
The recurring anchor
The temptation with any new service line is to bolt on a retainer because retainers are good business. That's backwards here — the recurring work is already built into the method if the first engagement was scoped correctly.
Three things make this genuinely recurring rather than manufactured:
New tools show up, existing tools ship new features and data-handling terms, and vendors change their AI opt-in defaults. A register accurate in Q1 is stale by Q3 without anyone doing anything wrong.
Shadow AI adoption doesn't stop after the initial discovery pass. Staff try new tools continuously. Each new request is a small, real piece of work — not hypothetical follow-on.
If you did the Decide phase correctly — Conditional-first, not jumping straight to standing Approved — every tool already has a review point attached. The review isn't an add-on; it's the second half of a decision you already made.
You're not inventing a reason to bill quarterly. You already told the client, in the deliverable itself, that Conditional verdicts get revisited. Selling the review is following through on what you scoped — not a new pitch.
Cadence
A fixed agenda is what makes this deliverable by someone other than your most senior person after the first cycle.
None of this requires re-running full discovery each quarter. It's a bounded update to a document that already exists, which is why it can be batched efficiently once several clients are on the cadence.
Packaging
There isn't one right way to sell the recurring piece. Which one fits depends on what you already bill this client for.
| Option | Best fit | Upside | Trade-off |
|---|---|---|---|
| Line item on an existing retainer | Clients already on a security or vCIO retainer | Lowest friction to sell; feels like an extension of trust, not a new commitment | Easy to under-scope; "we'll fold it in" can quietly become unpaid time |
| Standalone lightweight quarterly | No existing retainer, or AI governance as the only ongoing engagement | Clean, separately priced, easy for the client to understand as its own thing | Needs its own sales conversation and its own line on the client's budget |
| Annual review bundled with rollout | New clients buying the initial Discover → Decide → Operate project | Recurring commitment agreed before the project ends, not renegotiated cold | Locks in a year of cadence and pricing before you know how much the landscape will shift |
Illustrative structures only — not pricing guidance. Fit depends on your existing service lines and each client's relationship with your practice.
Delivering at scale
The economics come from the parts that don't have to be reinvented per client, not from cutting corners on any single review.
The register, policy structure, and leadership report use the same layout for every client — no relearning a document per cycle.
Same columns, status vocabulary, and risk categories across the book of clients, so a junior reviewer can update client B's register after having done client A's.
New requests, Conditional promotions/retirements, vendor-term checks, register refresh, leadership summary — the same sequence regardless of client.
Grouping clients into review windows — all Q1-anchored clients in the same two-week stretch — lets one person move through several registers in sequence.
The QBR
The AI register is a genuinely useful thing to put in front of a client's leadership — concrete, specific to their organization, and showing movement (a tool decided, a Conditional promoted, a vendor term flagged) rather than a generic security slide nobody reads closely.
That specificity tends to surface follow-on conversations on its own: a department asking about a tool not yet on the register, or a request to extend the review to a newly acquired subsidiary. Where that goes next is the client's decision, not yours — your role in the QBR is to present what changed, not to steer them toward a tool or vendor.
Honest limits
Nothing about this cadence certifies a client against SOC 2, HIPAA, ISO, GDPR, the NIST AI RMF, the EU AI Act, or any other framework. Don't describe it that way, and don't let a client describe it that way either.
The templates and review process are operational: who decided what, and what a tool is allowed to be used for. They do not replace the client's own legal review or HR's judgment.
A quarterly review reduces the chance a stale decision sits unnoticed for a year. It does not eliminate risk and should never be sold that way. Approved does not mean unrestricted; Low-risk does not mean automatic approval.
Scope discipline
FAQ
No. The license permits using the kit's templates and playbooks across your own client engagements — drafting client-specific documents as part of the service you deliver. It does not permit reselling or redistributing the kit itself as a standalone product.
That's a question for your own counsel and existing service agreements. The kit provides the operational structure — register format and review agenda — not contract language.
That's a legitimate choice for them. Being upfront that Conditional verdicts are meant to be revisited, and what happens if they aren't, lets the client decide with that trade-off in view.
Be careful with that label — this is an operational review-and-decision cadence, not a compliance certification, and the label risks implying assurance it doesn't provide.
Where a kit fits
Everything above is still work you do: running the review, making the calls with the client, and keeping the register current. The AI Guardrails Kit's Business Pack ($79) covers the AI guardrails program for one organization — acceptable-use policy, approval workflow, employee guidance, tool playbooks, and trackers, plus 16 completed sample artifacts built around a fictional company, ExampleCo.
The MSP / Consultant Pack ($299) adds the client pitch, discovery agenda, scope language, a QBR slide outline, a handoff checklist, and a follow-on opportunity map, plus the practitioner license described above. See how it's positioned across a book of clients on the for MSPs page.
The kit is available now on the product page. For a sense of the format first, start with the free AI tool checklist, or email hello@railstead.com.
Operational templates only — not legal, compliance, privacy, security, HR, or professional advice. Seller: CurioHausCo LLC.