SERVICES
Most organisations enter at a readiness assessment and progress into implementation. Some arrive already certified and need assurance or upkeep. Every stage is delivered by the same senior practitioner.
DIAGNOSE
A scoped diagnostic before a scoped programme. Fixed price, fixed deliverable, no obligation to proceed.
ISO 42001 gap analysis, AI system inventory, EU AI Act risk classification, and a board-ready report with remediation roadmap.
From £2,500 + VAT
Learn moreISMS gap analysis against ISO 27001:2022 Annex A, scope and Statement of Applicability outline, and a prioritised remediation roadmap.
From £1,950 + VAT
Learn moreDefence Cyber Certification level confirmation against your contracts, Cyber Essentials currency check, Def Stan 05-138 gap analysis, and a costed route to assessment.
From £1,750 + VAT
Learn moreBoth assessments credit in full against a subsequent Sprint engagement.
IMPLEMENT
Fixed-scope senior practitioner programmes. Delivered on your GRC platform of choice, or ours.
AI GOVERNANCE
ISO 42001 AI Management System implementation across the four AIMS lifecycle phases. Fixed scope, timeline agreed at scoping.
Typically 20 to 250 people, and often smaller.
Fixed scope, confirmed at scoping
Explore the ISO 42001 SprintINFORMATION SECURITY, GUIDED
Goldline builds the management system and directs delivery. Your team executes it.
Single legal entity, under approximately 50 people.
£7,000 + VAT
Explore ISO 27001 GuidedINFORMATION SECURITY
Full information security management system implementation, Statement of Applicability, and certification body coordination. Fixed scope, timeline agreed at scoping.
Typically 20 to 250 people, and often smaller.
Fixed scope, confirmed at scoping
Explore the ISO 27001 SprintASSURE
Independent assurance before the certification body sees it, and practitioner support when it does. Audits are conducted by a practitioner holding Lead Auditor credentials (PECB) for both ISO 27001 and ISO 42001.
A mock audit against the certification body's Stage 1 and Stage 2 criteria, with findings, severity ratings, and a remediation plan before submission.
From £3,500 + VAT
Learn moreSenior practitioner attendance at certification audit, evidence presentation, auditor liaison, and management of findings through to closure.
Scoped on the free 45 minute diagnostic
Learn moreIndependent internal audit of your ISMS against ISO 27001:2022, delivered to certification body evidence standard, with audit report and nonconformity tracking.
Scoped on the free 45 minute diagnostic
Learn moreIndependent internal audit of your AI Management System against ISO 42001, covering AIMS controls, AI risk treatment, and lifecycle governance.
Scoped on the call.
Learn moreBuyer-side assessment of a supplier's AI governance posture against ISO 42001 and EU AI Act expectations, with a procurement-ready findings report.
From £4,500 + VAT
Learn moreBoth management systems audited in one engagement. Shared Annex SL clauses examined once, each Annex A control set tested separately, one report structured for both certification bodies.
Scoped on the free 45 minute diagnostic
Learn moreINDEPENDENCE
Goldline does not conduct internal audits of management systems it implemented. An internal audit that reports on the implementer's own work is not an audit, and a certification body reviewing your clause 9.2 evidence will see that immediately. Our internal audit clients are organisations we did not implement for.
Preparation is a different question. A Pre-Certification Readiness Audit is a rehearsal, not an assurance opinion, so we run those for our own implementation clients as a matter of course. The distinction is the one your certification body draws: preparing for an audit is support, forming an independent opinion on the system is assurance, and the same party should not do both.
Internal audit independence is maintained. Where Goldline has implemented the management system, internal audit scope is agreed at engagement to preserve the separation your certification body expects.
SUSTAIN
For certified organisations without an internal compliance hire.
Certification renewals and surveillance audit support, governance upkeep, risk register and policy review cycles, and enterprise security questionnaire responses.
From £1,450 per month
Learn moreMinimum twelve-month term. Scope calibrated to your certification portfolio and questionnaire volume.
LEAD
Where the requirement is not a project but a named accountable person, delivered at the fraction of time the role actually takes.
The accountable owner of an AI Management System. AI inventory, risk classification, impact assessment, human oversight design, and governance reporting to the board.
From £4,250 per month
Learn moreSee how fractional leadership works, including the tiers, the operating cadence, and what a full-time hire costs by comparison.
The same senior practitioner delivers every stage.
Certification body audit fees are billed separately and pass through at cost. GRC platform subscriptions are billed separately; where Goldline supplies the platform as a partner, the price is confirmed in writing before purchase and you are free to buy direct instead.
What a buyer asks for differs by sector. These pages set out what the requirement usually looks like and which programme answers it.
A free 45 minute diagnostic establishes which layer fits your current position. No sales pitch. If we are not the right fit, we will tell you and recommend the alternative.
We use cookies and similar technologies to measure how this site is used, to see which organisations visit, and to measure our advertising. If you accept, we load Plausible, Google Analytics and Google Ads, Microsoft Clarity, which records session replays, and Apollo. Nothing loads until you accept. Read our Cookies policy.