Governance your principal signs. Evidence an examiner can read.

Everything a full-time CAIO would, at a fraction of the seat cost. A fractional CAIO owns the AI strategy and roadmap. They govern vendor selection and contracts, make architecture decisions, and set acceptable-use and data-handling policy. They support AI-related hiring and report progress in business terms leadership can act on. For most professional firms (a 10-partner law firm, a 6-physician concierge practice), the AI agenda needs senior ownership a few days a month, not a $300K+ full-time executive.

Take the free AI Executive Readiness Assessment. It is a self-scored diagnostic across six pillars: strategy, governance, data, security, team, and adoption. It produces a 0 to 100 score, a readiness band, and your lowest-scoring pillar. It takes about ten minutes. You can attach the results directly to a strategy-session request, so the first conversation starts from evidence instead of generalities.

Yes. Enablement is a standard governance deliverable. That includes leadership briefings, role-specific training on approved tools, acceptable-use policy rollout, and change management. If you're planning a rollout, the $4.97 AI-Ready Change Management Playbook covers the sequencing we use: readiness, pilot selection, policy, training, and measurement. It is the first paid rung of the CAIO ladder and comes with a 40-prompt companion pack.

Two retainer tiers. The CAIO Signature retainer starts at $4,000 per month and covers AI strategy and quarterly roadmap ownership, vendor governance, architecture decisions, and board-level reporting in business terms. The CAIO Estate retainer starts at $8,000 per month and adds active build management, team training, and custom-project execution within the retainer. On the build side, a Custom AI build starts with a proof-of-concept pilot from $15,000, and the full production build is scoped from what the pilot proves, depending on data complexity and compliance requirements. Every path starts with the free AI Executive Readiness Assessment so the first conversation is grounded in evidence.

Three levels, in this order. The baseline is the NIST AI Risk Management Framework: US-native, voluntary, and legible to a board, so we can align to it without creating obligations you did not choose. The binding level is whatever actually examines you: Florida Bar Rules 4-7.11 through 4-7.22 and 4-5.3 for law firms, HIPAA 45 CFR Part 164 for medical practices, SEC Marketing Rule 206(4)-1 and FINRA 2210 for wealth managers, and fair-housing constraints in real estate. The optional overlay is the EU AI Act or ISO/IEC 42001, priced separately and only relevant if you have European exposure or a client demanding certification-shaped assurance. Most governance material leads with the EU AI Act because it is the most written-about regime, not because it is the one that will examine a Coral Gables firm. We lead with the rules you actually live under.

Possibly, and the trap is that they follow the person, not your address. California's amended CCPA regulations took effect in January 2026, with obligations for automated decision-making technology used in significant decisions beginning April 2027. Colorado replaced its 2024 AI Act with a new automated-decision-making law in May 2026, effective January 2027, shifting from broad risk-management duties toward disclosure and consumer rights. A Florida firm processing a California or Colorado resident's data can be in scope. The scope is narrower than "AI," though. California's rules attach to significant decisions such as lending, housing, education, employment, and healthcare, and advertising was expressly removed from the final regulations. Colorado covers technology that materially influences a consequential decision and excludes incidental and clerical uses. In practice: real estate and lending applications are squarely in scope, healthcare is in scope where the system gates access to care, and most law-firm intake is not. Our Governance Install includes a written applicability screen, so your counsel rules on a specific flagged question rather than a general worry. This is scoping, not legal advice, and state AI legislation is the fastest-moving area in this field, so we re-verify before every engagement and date-stamp what we relied on. Descriptions here are current as of July 2026; confirm current requirements with counsel in your jurisdiction.

On the Charter and the governance work: that it is complete, accurate to your firm as it exists, and defensible as a description of how you operate. On the technical controls, when they ship: we warrant that the controls operate as specified, so access scoping enforces the permission matrix, retrieval stays inside your registry, the egress guard runs on every path, and the log is complete and immutable. That carries a defect window. We do not warrant a model's output. Nothing we install makes an AI factually correct, and your supervision obligations do not move: Florida Bar 4-5.3 already makes the attorney responsible for supervised work product regardless of what produced it. We also will not claim detection is perfect. Detection of protected material is probabilistic, and any vendor quoting an accuracy percentage is quoting a number they cannot stand behind. What we commit to is that the detector runs on every path, every decision is logged including ones later found wrong, and on uncertainty the system blocks. We would rather over-block and review than under-block and explain.

Four phases, each with a next step. Phase 1 is Exposed: tools in use, no sanctioned stack, no policy, no visibility. Start with the 90-Day CAIO Bootstrap. Phase 2 is Uneven: a policy exists and is unevenly followed, some structure, no enforcement. Start with the Governance Install. Phase 3 is Governed: charter ratified, decision rights assigned, risk classified, a named owner. Hold it there with quarterly oversight, and you are first in line for the Evidence Layer. Phase 4 is Native: AI is core to operations, measured at board level, and the firm is building proprietary systems on a governed foundation. That is the CAIO Estate retainer and custom builds. The free AI Executive Readiness Assessment tells you which phase you are in and what the next step is. Most firms are in Phase 1 and believe they are in Phase 2.

An AI use policy is a firm-branded document that defines which tools are sanctioned, what data may flow through them, what outputs require human review before use, and what happens when the policy is violated. Without one, firms face three concrete risks: shadow AI (staff using consumer tools like ChatGPT with client-confidential data), documentation gaps during regulatory examinations (bar audits, HIPAA audits, SEC examinations expect evidence of governance), and liability when AI-generated content carries the firm's name but nobody reviewed it. The $497 AI Use Policy Kit delivers a ratifiable draft in 5 to 10 days, written for the firm's specific regulatory posture.