13 questions to ask an AI governance consultant before you hire one.

"What will exist when you're done that doesn't exist now?"

Why it matters: the deliverable question. Accept: a named artifact — an AI-use inventory, a policy set, a documentation package for renewal or procurement. Be wary of: "alignment," "readiness," or maturity language without an operational artifact attached. Expect a deflection: "every engagement is custom." Counter: "then describe the exact artifacts you delivered for your last client."

"Where does your operational expertise end — and when will you tell us to take the work to a lawyer, a broker, or a third-party assessor?"

Why it matters: the boundary question, and the fastest filter in the guide. AI governance work borders three regulated professions, but the border is a relay, not a wall: a good consultant drafts the inventories, data maps, and technical policy language that counsel's legal review, the broker's placement work, and an assessor's review are built on — and knows exactly where their part of the race ends. A consultant who gives legal interpretations, promises coverage outcomes, or implies they can issue a binding assessment is claiming chairs they don't hold. The strong answer names the handoff points unprompted.

"What does your credential actually test — and what doesn't it?"

Why it matters: credentials in this field are new; some are substantial, some are a webinar with a certificate. Don't vet the acronym; vet what the holder had to demonstrate — and notice whether they volunteer the limits ("it covered X; it didn't touch insurance documentation at all"). Anyone waving a credential as authority to practice is answering a question nobody asked: there is no chair this field requires you to hold, which is exactly why the vetting burden sits with you.

"Which frameworks do you work from — and which specific controls would you exclude for a business our size?"

Why it matters: NIST AI RMF and ISO/IEC 42001 are the common scaffolding. The question isn't whether they cite one — everyone does — and "we tailor it to your risk appetite" is rehearsed patter that says nothing. Make them go into the weeds: which named controls don't apply to you, and why. A framework applied without specific, named exclusions is a template with a markup.

"How does the governance documentation you build integrate with what we already run — privacy workflows, data-subject requests, incident response, existing control sets?"

Why it matters: the integration question. AI governance doesn't live on an island: an AI failure lands in your existing incident process; AI data handling lands in your existing privacy obligations. A consultant who proposes a standalone AI committee and a standalone policy but can't map either to the compliance machinery you already operate is selling a redundant silo. The strong answer starts with what you have.

"Will the person pitching this engagement be the one writing the deliverables and running the interviews?"

Why it matters: the bait-and-switch question. The principal wows the sales call; the drafting lands with a junior associate — or a generative-AI prompt. Neither is disqualifying if disclosed and priced accordingly: the question locks in whose work you're buying, who reviews it, and what happens to the rate when the answer changes.

"Do you resell, refer, or take fees from any tool, platform, insurer, or law firm you might recommend?"

Why it matters: the independence question. Referral economics aren't disqualifying — undisclosed ones are. The strong answer is a complete list, volunteered in writing. (Standard we hold ourselves to: every commercial relationship on Certian's pages is disclosed on the page where it appears — including the founder's own practice, to which this guide's standard applies identically.)

"Who owns the work product — and can our lawyer, broker, or assessor use it without you in the room?"

Why it matters: deliverables that only function with the consultant attached are a subscription wearing a deliverable's clothes. Inventories, data maps, and documentation should be yours, editable, and legible to the third parties they exist to feed.

"What does this cost, structured how — and what's the milestone that proves value?"

Why it matters: fixed-scope engagements with named deliverables beat open retainers for a first hire — but scope honestly: a sprawling environment with no existing data mapping may genuinely need a phased baseline, and a consultant who says so with a defined phase-one milestone is scoping, not padding. What the milestone is, when it lands, and how you'd know it landed — that's the answer to buy. An engagement with no milestone at all is a forecast about their revenue, not your risk.

"The rules moved three times this year. How do you stay current — and what did you change your advice about?"

Why it matters: the freshness question. Anyone tracking this field honestly has reversed something in 2026 — deadlines moved; a state act was repealed and rewritten. "Nothing's changed our approach" is the wrong answer even when delivered confidently — especially then.

For the record's dated changes: certian.com/changelog

"Walk us through an engagement that didn't go well. What happened?"

Why it matters: standard vetting, extra force in a field this young: nobody has ten years of AI-governance references. Honest war stories from adjacent work (privacy, security, compliance) are a fine answer; a flawless record in a two-year-old discipline is not.

"Do you carry professional liability insurance — and does your policy cover the AI advisory work you're proposing?"

Why it matters: the mirror question from our vendor guide, applied to advisors: carriers have been adding AI language at renewal since January 2026, and coverage that predates the practice may not map to it. A consultant who has checked their own policy against the work they're selling has taken the subject matter personally — the ones who haven't are recommending documentation hygiene they don't practice.

Public carrier filings — see the record at certian.com