Sell AI Governance to Your Clients

Lead with the pressure the client is already under rather than with AI governance as a topic. If they think in dollars, run the shadow AI risk calculator on their headcount. If an audit or a new state law applies to them, send that specific regulation. If a cyber-insurance renewal is close, show them the AI questions carriers now ask. If they believe AI risk is hypothetical, send one sourced incident from their industry.

In five steps. Start the conversation with the pressure the client already feels: cost, regulation, a cyber-insurance renewal, or a real incident in their industry. Prove their exposure with a free read-only AI risk assessment run through your own RMM, with no agent deployment. Sell one recurring Managed AI Governance service rather than a menu. Put the rules in a written AI acceptable-use policy backed by enforcement on the endpoint and in the browser. Then get a decision: clients who say yes move to onboarding, and clients who say not yet sign a risk acceptance form that records the decision and a review date.

An AI risk assessment inventories the AI tools actually in use across a client's endpoints: installed AI applications, AI browser extensions in Chrome, Edge, Brave and Firefox, AI-site browsing history, AI developer tools and MCP server configurations, and whether the browsers' built-in AI is restricted by enterprise policy. ShadowLock's runs read-only through the MSP's existing RMM, with no agent deployment and no involvement from the client's staff, and leaves nothing installed. It produces a risk-tiered AI Exposure report the MSP presents to the client.

No. That is the point of it. The assessment runs through the RMM you already use, across the client’s Windows endpoints, without deploying the ShadowLock agent and without involving anybody at the client. The agent comes later, as part of Managed AI Governance, once the client has seen the findings and decided to buy. Find the problem before you ask them to buy the solution.

By assessing, not arguing. A lightweight read-only assessment, pushed through the MSP’s own RMM, inventories the AI applications, browser extensions and AI browsing already present across the client’s Windows endpoints, and the results come back as a risk-tiered AI Exposure report naming the client’s own tools and endpoints. A vendor statistic invites a debate; an inventory of their own environment moves the conversation to what to do about it.

Nothing. The assessment runs unattended through your RMM, so there is no scheduling, no coordination and no employee-by-employee setup. It is read-only, installs nothing, and leaves nothing behind.

It collects the AI footprint of each endpoint: installed AI applications, AI browser extensions, visits to AI domains, AI developer tools, and whether the browsers’ built-in AI is restricted by enterprise policy. It does not collect passwords, cookies, tokens, form data, page content, full browsing URLs or user names, and non-AI browsing never leaves the machine. This is usually the first question a client’s IT lead asks, so it is worth being able to answer it flatly.

Yes, two, though the RMM run is the one to reach for. You can share a download link with whoever is doing the work, which covers as many machines as you like, or you can email invitations to up to ten people who each run it themselves. Email is the narrowest of the three and is not a way to cover a fleet. All three feed the same assessment, and each machine is counted once however it arrived.

Yes, and we recommend you offer it free. It is read-only, runs through your own RMM, installs nothing and leaves nothing behind, so it costs you a few minutes rather than a project. The assessment is how you acquire the client rather than how you earn from them: you hand over the AI Exposure report whether or not they buy the governance service, and Managed AI Governance is where the recurring revenue is. Some MSPs charge for the assessment. That is your call, but a free one converts more conversations.

A one-time onboarding covering the AI acceptable-use policy, an exposure baseline, policy configuration and deployment; then a recurring service covering AI usage monitoring, sensitive-data controls, oversight of AI sites, desktop apps and extensions, Microsoft 365 AI OAuth visibility, client-ready reporting, and a quarterly AI Risk Review. Keep it to one service. An MSP that has to design a practice from six options never launches one.

Price it per device per month on top of a one-time onboarding fee, and bill it like any other managed line. A workable client-facing range is roughly $3 to $5 per device per month, with $4 a reasonable anchor, plus onboarding scoped to the size of the estate. That is resale guidance for your own rate card, not a price ShadowLock sets. Your margin is the gap between that and your per-device platform cost.

Document the decision and set a date to revisit it. The AI Risk Acceptance Form records the identified exposure, the control you recommended, the person who decided, their rationale, and a review date. It is a record of a business decision, not a waiver, and it does not remove your obligations. It keeps the conversation open and gives you a specific reason to reopen it next quarter.

Enable Continuous Governance on the completed assessment and it becomes a managed client organization, either a new one created from the company name or an existing one, and takes you to the deployment page. Assessed machines are not devices and are not billed; a device exists only once you deploy the agent to it.

Four assets: a co-brandable education deck (PPTX) that sets up the problem, a step-by-step assessment runbook for your team, a client leave-behind that explains the findings in plain English, and an MSP close kit with objection handling and the recommended package. The deck and leave-behind carry your branding; the runbook and close kit are for your team.

Yes. The education deck and the leave-behind are built for you to co-brand: the deck has logo, company-name and contact placeholders, and ShadowLock appears only as a small credit. The AI Exposure report supports white-label partner logos too. To the client it reads as your service.

First conversation to a signed agreement is typically one to three weeks. The assessment itself is a job you queue in your RMM and a report you collect afterwards, not a project: you set how long collection stays open, from a few hours to a couple of weeks. The findings review is a single thirty-minute meeting, and the proposal follows from what the assessment found.

You need a partner account to create assessments and generate the AI Exposure report, which the free trial covers. You do not need to have deployed anything to a client. The kit itself is free and yours to keep either way.