The $7,500 Service Menu SMBs Do Not Know They Need
Your SMB clients are using AI. They are not managing it. That is the gap between today's market and tomorrow's opportunity.
ConsultKit research shows 73% of SMBs with 10 to 100 employees operate without formal AI governance structures. No Chief Risk Officer. No compliance department. No incident response protocol. These companies have no systematic way to track shadow AI usage, vet vendor models, or document decision-making when something goes wrong.
Enterprise firms spend $2.1M or more annually on governance, hiring dedicated teams, building frameworks. SMBs, the fastest-growing segment of AI adoption, are barely being served. Most consultants build implementations without governance guardrails. That is leaving money on the table and risk on the floor.
The consultant who sells governance alongside implementation will own the SMB market for the next three years.
Why SMBs Need This Now
Shadow AI is real in mid-sized firms. Departments buy ChatGPT Plus. Teams use Claude for customer analysis. Sales plugs data into third-party tools. No one documents it. No one asks if it is secure.
During my time at Hartford Steam Boiler, we ran risk assessments for mid-market manufacturers. One firm had three separate generative AI tools running in parallel, each trained on unlabeled proprietary data. The company had no data policy, no vendor agreements, no oversight mechanism. The risk officer, one person working part-time, did not even know it was happening. When we surfaced it, the client realized they were exposed on IP, compliance, and liability fronts.
That discovery, an AI readiness assessment, became the foundation for a $40K governance engagement.
That is the play. The readiness assessment uncovers what clients did not know they had.
The Math: $7,500 at 80%+ Margins
A standalone governance package priced at $3,000 to $7,500 carries 80%+ profit margins after the first delivery. Why? Because your deliverables are reusable templates.
Your service includes:
- AI inventory and risk audit (2 to 3 days onsite or remote)
- Data policy framework (adapted from your template library)
- Vendor assessment checklist (reusable across clients)
- Incident response protocol (your standard, tailored to their size)
- Governance handbook (template with light customization)
After your first $7,500 engagement, deliveries 2 through 10 scale to 15 to 20 hours per project. You are not rebuilding. You are applying the system. That margin floor sits at 75 to 85%.
Compare that to implementation work. A $50K AI integration project might run 200 or more hours and carry 40 to 50% margins after tooling, infrastructure, and testing. Governance is tighter.
The Three-Tier Service Menu
Build your menu around depth and commitment. This structure gives clients optionality and creates natural upgrades.
Tier 1: Diagnostic ($2,000 to $5,000)
- AI readiness assessment (1 to 2 days)
- Risk surface map (where is AI being used, by whom, with what data?)
- Gap analysis against a baseline governance model
- Deliverable: a simple risk matrix and 3 to 5 priority actions
This is your on-ramp. It costs you 10 to 15 hours to deliver with your template. Clients see the gaps. Many upgrade.
Tier 2: Pilot ($5,000 to $15,000)
- Everything from Tier 1, plus structured implementation of priority actions
- Draft data policy, vendor assessment framework, incident response skeleton
- 30-day monitoring and adjustment period
- Deliverable: governance handbook, policy templates, vendor scorecard
This tier assumes you own the workflows. The approach Webvise recommends, naming the workflow owner, establishing the baseline, setting a 30-day pilot target, works because it creates accountability.
Tier 3: Implementation + Ongoing ($15,000 to $50,000+)
- Everything from Tier 2, embedded into client operations
- Quarterly governance reviews as their AI footprint expands
- Monthly advisory retainer (8 to 12 hours) for new tool evaluations and policy adjustments
- Training for internal teams
- Deliverable: full governance operating system plus standing advisory relationship
This is where you lock in recurring revenue. Retainer-based advisory at $2,000 to $3,000 per month is standard. Over 12 months, that is $24K to $36K in nearly pure profit once the system is live.
How the Readiness Assessment Drives the Sale
An AI readiness assessment is not a consulting report. It is a diagnostic tool designed to surface client blindspots.
The standard questions:
- What AI tools are live in your organization today? (Most SMBs cannot name all of them.)
- Who owns each tool's usage and updates?
- What data feeds into each system?
- Where are you storing outputs?
- Do you have vendor agreements or terms of service documentation?
- What happens if a model fails or produces a harmful output?
Clients often cannot answer these. The gaps are where your value lives.
Document the gaps in a simple risk matrix. Put controls on one axis and likelihood on the other. Color-code it red, yellow, green. Share it in a 30-minute debrief.
You have just shown them a $200K or more exposure they did not know they had. Now they are ready to buy governance.
Positioning Against Implementation
Most AI implementation consultants treat governance as a line item, a compliance add-on worth 15 to 25% of the total implementation fee. Wrong approach.
When you pitch governance first, you are saying: "Before we touch your workflows, we need to know what is already in motion and what risks we are inheriting."
When you pitch governance alongside implementation, you are saying: "Your implementation will be faster, cheaper, and safer because we mapped the terrain first."
When you offer governance as a standalone service, you are saying: "Your AI risk is the business. We solve it. Implementations come later, if you want them."
The third position is the most defensible. It is also the most profitable.
The Governance Owner Model
One of your core deliverables is naming a governance owner inside the client organization. That person does not need a C-suite title. They need authority and access.
In one mid-market engagement, we identified a 28-year-old operations analyst as the governance owner. She had zero formal compliance background. She did have credibility with the CEO and visibility across departments. Over six months, she became the bottleneck for new tool adoption, in a productive way. Every new AI request came through her. She logged it, assessed it, approved or flagged it.
That single structural change turned a chaotic AI environment into a managed one.
Name the owner. Clarify their role. Give them a decision framework. Document it. That is the backbone of governance at SMB scale.
Compliance vs. Governance
SMBs often confuse the two. Compliance is about rules: meeting regulations, passing audits, checking boxes. Governance is about systems: deciding who can use what tools, when, and why.
Compliance is reactive. Governance is proactive.
You are selling governance. Position it as risk management for a growing technology footprint, not as a legal obligation. That framing opens the conversation with finance and operations, not just legal.
> Doctrine Connection: Competence beats credentials. An SMB does not need a Chief Risk Officer with 20 years of financial services background. They need someone, internal or external, who can name the tools, map the data, and set the guardrails. You are selling competence. Build your repeatable system, apply it consistently, and let results speak louder than certifications.
FAQ
Q: How do I position governance to a client who just wants implementation?
Lead with discovery. An AI readiness assessment costs $2K to $5K and takes 2 to 3 days. Offer it as a prerequisite to any implementation. You will surface risks. Once they see the gaps, governance becomes non-negotiable.
Q: Can I sell governance without doing implementation work?
Yes. Some of the highest-margin consulting firms are pure governance shops. They audit AI systems, design controls, and hand off execution to implementation partners.
Q: What if a client says governance is too expensive for a 25-person company?
Reframe the cost. A $5K governance engagement that prevents one data breach or compliance violation pays for itself in insurance deductibles alone. Offer Tier 1 diagnostic at $2.5K as the entry point.
Q: How long until governance becomes table stakes?
For SMBs, we are at the adoption inflection point now. By 2027, any credible AI vendor will bundle governance as a baseline service. Build it now before it commoditizes.
*Jeff Barnes, MBA has no personal position in any company, fund, or platform named in this article. demg.ai has no current commercial relationship with any party mentioned. demg.ai provides marketing education and systems consulting, not investment advice. Past performance does not guarantee future results.*