Fractional Chief AI Officer (vCAIO) Advisory Retainer

A flat-fee monthly retainer that gives your organization a named senior IT Partner AI executive: an AI inventory and current-state summary, a living 12-to-24-month AI roadmap and AI budget, a licensing posture that decides seats versus credits versus Azure consumption per group of people, an acceptable-use policy and AI governance charter the advisor owns, vendor and tool evaluation, a standing watch on the EU AI Act, ISO/IEC 42001 and questionnaire AI sections, change-management guidance, a monthly strategy call, and a quarterly executive review with a board-ready deck. It costs $1,950 per month with no long-term commitment.

CEOs, COOs and CFOs of organizations of roughly 50 to 1,000 seats where AI is already in use but nobody is accountable for it — Copilot seats bought for a pilot, agents built by a department, third-party tools nobody reviewed, a board asking for the AI plan, and a customer or insurer asking for the AI policy. If leadership cannot say what AI costs, what it has delivered and what it exposes them to, this is the missing seat.

No, and the page says so plainly. The retainer is defined by cadence and artifacts rather than by days on site: the monthly strategy call (up to 60 minutes), the quarterly executive review (up to 90 minutes), the preparation behind both, the maintained inventory, roadmap, budget, policy set, tool register, decision log and action register, the continuous licensing and regulatory watch, and scoping conversations with our engineers. Questions between calls go through the intake. Fractional AI executives who embed in your office one to three days a week are a different shape at a different price; if that is what you need, we quote a higher tier in writing rather than stretching this one silently.

Same shape, different seat. The vCIO owns IT strategy: the IT roadmap, the IT budget, vendors and renewals across the whole estate, and the Microsoft 365 and Azure platform direction. The vCAIO owns AI: what to use it for, what to buy and in what shape, the policies that govern it, the tools you let in, the regulatory calendar, and the board's view of it. Many organizations have neither seat; some have a capable IT director and lack only the AI one. When you run both retainers, the AI roadmap becomes a chapter of the IT roadmap, the two advisors re-baseline together, and the IT budget stays with the vCIO.

The vCAIO owns the AI policy set — acceptable use, the governance charter, the approval path for tools and agents, human-oversight expectations — and the business case for every AI initiative. The vCISO owns the security program: security policies, the risk register, compliance coordination, incident readiness and the controls in Purview, Defender and Entra. They overlap where an AI policy needs a control behind it — sensitivity labels before Copilot, data-loss prevention for a third-party tool — and there the vCAIO carries the requirement and the security engagement owns the control. A vCAIO retainer is not a security program, and we will not let it be mistaken for one.

The readiness assessment is a scoped project: a formal gap assessment against ISO/IEC 42001, an Annex A control mapping, a drafted policy set, a Statement of Applicability starter and a certification-readiness roadmap. The retainer is the standing seat that comes before, after or instead of it: it maintains a baseline acceptable-use policy and governance charter, keeps the inventory current, and carries the assessment's roadmap forward month by month. If certification is the goal, start with the assessment and bring its roadmap into the retainer; if you need someone accountable for AI and are not yet sure certification matters, start here and the advisor will tell you when the assessment is worth buying.

No. Deciding whether, for whom and in what shape you should license Copilot is one of the first things the retainer does. Some groups justify a per-user seat; some are better served by pay-as-you-go Copilot Credits for agent use; some need Copilot Studio capacity or Azure consumption for a Foundry workload; some are best left on Copilot Chat that your Microsoft 365 subscription already includes; and some should be using a non-Microsoft tool. The licensing posture records the shape per group and revisits it against usage each quarter.

Per group of people, the recommended shape and what it will cost you from Microsoft or the vendor: Microsoft 365 Copilot seats, pay-as-you-go Copilot Credits, Copilot Studio capacity, Azure consumption for Foundry workloads, Agent 365 licensing where agents warrant it, or a third-party subscription — built from Microsoft's published prices and your actual usage, with idle seats and drifting consumption flagged each month and a recommendation ahead of every renewal. Two things it does not do: it does not change Microsoft's prices, and it does not absorb Microsoft's metered charges. Credits, capacity and Azure consumption are billed by Microsoft to you; the posture tells you what to buy, what to meter and what to stop paying for.

Possibly, and that is exactly the kind of question the watch exists to frame rather than guess at. The Act's scope clause reaches providers and deployers outside the EU where an AI system's output is used in the Union, and most mid-market organizations are deployers of other people's models rather than providers. At the time of writing the prohibited-practice and general-purpose-model obligations already apply, transparency obligations apply from 2 August 2026, and the Digital Omnibus on AI moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. The advisor keeps that calendar against your inventory and tells you which use cases would need a legal opinion; your counsel gives the opinion.

Yes, within the retainer's shape. Where nothing exists the advisor drafts a baseline acceptable-use policy for staff and an AI governance charter — decision rights, the approval path for new tools and agents, human-oversight expectations, an exception process — in the first cycles, aligned to whatever security and HR policies you already have. Leadership approves them, you publish them, and the advisor owns them from then on: reviews on a stated cycle, exceptions recorded, tool register kept current. A full policy program mapped to ISO/IEC 42001 or written to a certification standard is the readiness assessment, and the security controls behind a policy belong to the security engagement.

It goes in the inventory first, not in a disciplinary memo. The advisor asks the business owners what is actually being used and why, uses the discovery evidence your licensing already provides — Defender for Cloud Apps where you have it, sign-in and consent data in Entra, browser and expense signals — and records each tool with an owner, a purpose and what data reaches it. Then the governance charter gives people a sanctioned path: an approval route that answers in days, an approved-tools register, and a policy that says what may never go into an unapproved tool. Most shadow AI exists because there was no way to ask. Where the agent estate is large enough to need a registry, lifecycle rules and offboarding as a working system rather than a list the advisor maintains, that is the AI Agent Inventory and Lifecycle Governance Implementation, scoped as a project.

No. The advisor decides what should be done and reviews what was done; the doing is a scoped project, a managed service or your own team. That separation is deliberate — the person recommending a change should not be the person marking their own homework. The advisor also holds no standing admin rights: where evidence is needed we use IT Partner's free read-only assessments or request least-privilege, time-bound GDAP access that you approve for a specific purpose, against a published access policy you can compare any request with.

The advisor will tell you what to buy and scope the projects the roadmap calls for, with fixed-price quotes in writing — that is part of the value. What the advisor will not do is benefit from it: nobody at IT Partner earns a sales bonus or commission, so a recommendation to release seats, to meter a group on credits instead, to defer, or to pick a non-Microsoft tool costs them nothing. Where you buy Microsoft subscriptions through IT Partner they are at Microsoft's list price, never marked up into this fee. You are never obliged to give spun-off work to IT Partner, and when you do, you pay after you approve delivery.

Yes — the inventory, the tool register and the evaluation criteria cover your whole AI estate, not just Microsoft's. The criteria are written down (data handling, tenancy, identity integration, retention and training-use terms, model and hosting terms, exit), the recommendation is recorded in the decision log, and the advisor joins vendor calls on request. What the advisor does not do is negotiate as your agent or sign on your behalf; you hold the pen.

Onboarding: the advisor is introduced, interviews leadership, IT and the business owners already using AI, gathers licensing, usage, cost and contract data and existing policies, runs the free read-only assessments where they help, and delivers the AI inventory and current-state summary plus a first draft of the acceptable-use policy where none exists. The roadmap and AI budget are in first draft by the end of the second cycle, the monthly rhythm is in place from then on, and the first quarterly executive review falls at the end of the third.

The base retainer delivers a board-ready deck each quarter, written so the sponsor can present it unaided, and runs the quarterly review with your leadership team. Attending or presenting at the board itself, facilitating an executive workshop, or adding advisor hours beyond the cadence is a higher tier quoted in writing — we would rather price it plainly than promise availability the base fee cannot honour.

A flat $1,950 per month, invoiced monthly, with no long-term contract: stop any month, and all we ask is payment of previously approved invoices. The inventory, roadmap, budget, policy set, tool register, decision log and every deck are yours to keep — they were built to be read by your leadership, not to make you dependent on ours.