The service inventories at the largest firms are public, consistent, and mostly reproducible at any size.
Start a conversation with the AI Adoption Concierge, already scoped to AI governance advisory. Pick a starting point, or describe your situation directly.
The clearest new revenue line is advisory work created by AI regulation, and it is unusually legible because large firms publish their service inventories. Reading several of them side by side produces a near-identical list: governance programme design, internal AI policies and codes of conduct, risk assessments, vendor contract review and negotiation, regulatory tracking, training for legal and business teams, oversight models for AI-supported decisions, and incident-response plans with tabletop exercises. That list is a product catalogue. The reason it travels down-market is that the underlying work is the same at every size — an inventory of what AI a client uses, a risk classification against whatever regimes reach them, a policy, and a review of the vendor paper. A fifty-person business needs all four and has nobody to do them.
Ordered by how easily a small firm can start selling it.
Fixed fee, sellable to every business client. Six decisions: approved tools, permitted inputs, meeting recording, restricted uses, verification, and ownership of output.
Fixed fee scaled by system count. Almost always reveals AI features silently enabled in software the client already licenses.
Per-agreement rate. The most repeatable engagement in the list — training rights, retention, indemnity carve-outs, model-change notice, audit rights.
Quarterly, and largely produced by the tracking the firm should be doing anyway.
Monthly retainer, capped hours, defined scope. Dominated by small firms and solos, which is the point.
Plans and tabletops for agent misfires, hallucinated output relied on externally, vendor data leaks and executive impersonation. The least mature of the six.
How to stand this up.
Because the people who need this have been told to comply and have not been offered help.
A US federal magistrate held in 2026 that certain AI bias-testing material prepared at counsel's direction may be shielded by privilege, while the underlying factual performance data remains discoverable. That distinction is the clearest commercial argument for buying an AI assessment from a law firm rather than a consultancy — and it should be stated to clients with the caveat attached, not without it.
A short document that resolves the decisions a business actually faces: which tools are approved and for what, what information may never be entered into them, how meeting-recording and note-taking tools are handled, which uses are restricted, when human verification is required, and who owns and may reuse AI-generated material. The meeting-recorder question is the one clients have most often not considered — a tool that creates a detailed record of a negotiation or a call involving legal advice that the business never intended to make or keep. Scope it as a policy plus a short briefing session, and price it accordingly.
Fixed fee for the defined deliverables, retainer for the ongoing ones. The buyer is frequently a business owner or an operations lead rather than a lawyer, and cannot evaluate an hourly estimate in an area they do not understand — which makes an open-ended engagement hard to sell and easy to resent. Scale the inventory and register by system count, the vendor review per agreement, and the retainer by capped hours. Anything specific about fee structures in your jurisdiction is a question for your own counsel.
Less than you would expect, and the gap is smaller than the marketing suggests. The work is inventory, classification against regimes, drafting and contract review — recognisably legal skills applied to unfamiliar subject matter. What you do need is enough fluency to ask a client's vendor the right questions: whether inputs train a model, what retention applies, who can access the data, and what happens when the model changes. That vocabulary is learnable in a week and is most of the technical requirement.
Not inherently, and the reverse is closer to true — a firm that has been through its own inventory, policy and vendor diligence is better positioned to advise, and clients respond well to being shown the firm's own artefacts. The genuine risk is the reverse posture: selling AI governance while having none of your own, which is an obvious credibility problem the first time a client asks. Separately, if the firm also recommends or resells specific tools, the interest should be disclosed — that is a straightforward professional-responsibility point that firms occasionally get wrong through inattention rather than intent.
Describe your client base. The Institute will help you scope something sellable.