Build an AI governance practice on a platform that is already certified.

Your clients have a fixed regulatory date, a 12-to-18-month implementation ahead of it, and no internal capability to run it. Modulos supplies the platform and the proof. You supply the practice.

01 The window, and how long it stays open

Full high-risk obligations for Annex III systems under the EU AI Act apply on 2 December 2027. The Digital Omnibus fixed that date when it entered into force on 27 July 2026, and it cannot move again without a new legislative procedure. The "they'll delay it again" objection your clients have been using is now dead.

Enterprise AI governance takes 12 to 18 months to implement, with three to six months of procurement in front of it. Any client who has not signed by the end of 2026 is not making the date. That compresses an entire market's buying decision into the next four quarters — and almost none of those clients have the internal capability to run the programme themselves. Independently of the Act, ISO/IEC 42001 procurement gates are already live at major enterprise buyers, with no legislative deadline attached at all.

Why join the ecosystem

• Sell a certified product, not a promise. Modulos holds product conformity certification for ISO/IEC 42001, assessed by Swiss auditor CertX. You are not asking a client to trust a roadmap.
• Named in the inaugural Gartner® Magic Quadrant™ for AI Governance Platforms, June 2026. The shortlist conversation is already won before you walk in.
• Deploy anywhere your clients need. SaaS, Swiss sovereign cloud, private cloud, on-premises or fully air-gapped — so regulated and public-sector work stays in play.

02 What you are actually selling

Three capabilities carry the sale, and each one is a services hook for a partner.

The Governance Graph — Frameworks mapped at control level, not stored side by side. Run separately, the shipped estate needs 1,748 control implementations. On the Graph, 858. Your second framework engagement costs a fraction of the first and prices close to it.

Monetary risk quantification — Every AI system carries an expected-loss figure, not a red-amber-green tile. This is what gets you in front of the CFO rather than a compliance manager with no budget.

Scout — Discovers the AI actually running — sanctioned systems, unsanctioned assistants and agents — and routes it into assessment. The discovery engagement that opens the account and sizes the programme behind it.

Proof · ISO/IEC 42001 — Xayn: four weeks from decision to certificate Xayn, builders of Noxtua and the first German company to hold ISO/IEC 42001, certified on Modulos and audited by SGS in June 2025. Three to six months is typical even with a mature AIMS. A delivery timeline you can put in a proposal.

Proof · EU AI Act, Annex III — JobCloud: Annex III high-risk AI, inventoried and auditable JobCloud AG runs jobs.ch, jobup.ch and JobScout24.ch for more than 49,000 companies. Candidate ranking, application filtering and job matching sit squarely in Annex III, obligations from 2 December 2027. Modulos replaced a patchwork of spreadsheets and point tools with one auditable system: every AI system inventoried and risk-classified, with technical documentation, bias monitoring and human oversight.

03 Partner motions and where the money is

Partners do not segment by industry, they segment by what they are willing to deliver. Four motions, and you can run more than one.

Motion	What you sell	Where the revenue is
Referral<br>Advisory firms, law firms, boutique consultancies, individual operators with a network	You originate and introduce. Modulos runs the cycle and delivers. You stay close to the client relationship without carrying delivery risk or hiring against it.	A percentage of first-year licence value on the initial term, where you originated the lead. Lowest effort to first revenue, and no certification required.
Implementation and delivery<br>Systems integrators, Big Four and mid-tier consultancies, AI and data consultancies	You run the 12-to-18-month programme: current-state assessment, control mapping, policy and evidence build, AIMS design, audit readiness. Modulos is the platform underneath it.	Services engagement is the primary line, licence resale or referral margin is the secondary. Framework expansion generates repeat engagements off the same evidence base.
Managed service<br>MSSPs, managed compliance providers, virtual CISO practices	You operate governance as an ongoing service across a client book: continuous monitoring, evidence upkeep, shadow-AI discovery via Scout, and reporting into the client's risk committee.	Recurring monthly service revenue on top of licence, across multiple clients on a single operating model. Highest lifetime value of the four motions.
Audit and certification<br>Accredited certification bodies, ISO/IEC 42001 auditors, assurance practices	You audit against ISO/IEC 42001 and adjacent standards. Clients arrive with evidence already structured to the standard rather than in a shared drive, so audit cycles shorten.	Audit fees, plus referral on clients you send to the platform. Independence boundaries apply — this motion does not combine with implementation on the same client.

The compounding effect that makes this different from reselling a compliance tool. Because roughly half of all controls are shared across frameworks on the Governance Graph, the marginal cost of your second, third and fourth framework engagement at the same client falls sharply — while the price does not fall proportionally.

A partner who lands an ISO/IEC 42001 programme has already built most of the evidence base for that client's EU AI Act work, NIST AI RMF work, and their next customer security questionnaire. Your first engagement buys the account; the Graph is what makes the next three profitable.

04 What each side brings

Modulos brings

• Deal registration and protection on opportunities you originate, so you are not competing with the vendor you introduced.
• Technical and sales enablement for your consultants, including platform training, control-mapping methodology and audit-readiness practice.
• Pre-sales support on live deals — solution architecture, security review responses, and the Gartner and ISO/IEC 42001 credibility that shortens the shortlist conversation.
• Joint go-to-market: co-branded material, joint webinars and events, and named reference access where the client permits it.
• A platform you can deploy anywhere, including fully air-gapped, so defence, public sector and regulated financial work is not disqualified on architecture.

We ask for

• Genuine lead origination. Commission attaches to opportunities you bring, not to accounts already in cycle. Registration is how that gets settled cleanly.
• Certified people, for delivery motions. A minimum of two trained consultants before you take implementation work independently.
• A named alliance owner on your side. Partnerships that are nobody's job produce nothing, and we would both rather find that out in month one.
• Honest scoping. A 12-to-18-month programme sold as a three-month one damages your client relationship first and ours second.

05 Who to take this to

The demand is uneven. These are the profiles that convert, and the signals that say a client is ready now rather than next year.

Where the demand sits

• Organisations deploying AI in Annex III use cases — recruitment and HR, credit scoring, insurance pricing, education, essential services, biometrics and critical infrastructure. These carry the December 2027 date directly.
• Regulated financial services and insurance. Existing model-risk governance means the concepts land immediately and the buying committee already exists.
• Energy, utilities and industrials. Frequently group subsidiaries, where a parent's certification creates internal pressure with no external deadline attached.
• Manufacturers with AI inside regulated products, governed by Annex I from August 2028 — longer runway, larger programme.
• Public sector and defence, where sovereign or air-gapped deployment disqualifies most of the market before the conversation starts.

Signals a client is ready

• They are hiring. An open role for AI governance, responsible AI or AI risk is the single strongest buying signal in this market.
• They already hold ISO 27001 or SOC 2. They understand management systems, so you are scoping rather than educating, and the cycle is materially shorter.
• Their parent or group has certified to ISO/IEC 42001, or a competitor has announced it. Internal pressure moves faster than regulation.
• Customer security questionnaires have started asking AI questions. Revenue is now blocked on an answer they do not have.
• They have just published an internal AI usage policy, or handled a shadow-AI incident. The problem is named and unowned.

Where not to spend time: pure AI product vendors with no enterprise deployment of their own, organisations under roughly 200 employees, and anyone without an existing compliance or risk function to hand the programme to.

06 Technical fit

Modulos runs on Microsoft Azure in Switzerland, on a fully sovereign Swiss cloud provider, in your client's private cloud, on-premises, or fully air-gapped. The platform is SOC 2 Type 2 audited. Deployment model is a client decision rather than a pricing tier, which matters when your book includes public sector, defence or regulated financial services.

The platform ships with more than 20 frameworks resolved into a single control set, with further frameworks in active development. Client-specific frameworks and internal policy sets can be added to the Graph and inherit the same deduplication, so bespoke customer questionnaires stop being standalone projects. Scout performs discovery across the estate and routes findings into assessment automatically, which is what keeps a managed-service motion viable at more than one client.

07 The questions partners actually ask

"Why not just build on OneTrust or Vanta?" Both are credible and both have deeper channel machinery than we do today — that is the honest position. What neither offers is monetary risk quantification, which is what changes the buyer from a compliance manager to a CFO, and neither was built AI-first. If your practice competes on being the firm that turns AI risk into a number the board can act on, that differentiation has to come from the platform. Being early in a channel that is still forming is also the point: the partners who take positions now are not competing with two hundred others for the same registrations.

"Is this big enough to build a practice on?" Gartner projects 67.5% compound annual growth for the category from a 2024 base and published its first Magic Quadrant in June 2026 — categories get a Magic Quadrant when buyers start running formal shortlists. The constraint on this market is not demand, it is that almost no consultancy currently has delivery capacity in AI governance. That gap is the practice.

"What happens when the deadline passes?" Governance is an operating obligation, not a project with an end date. Annex III systems require ongoing monitoring, incident reporting and re-assessment after substantial modification, and Article 6(3) requires registration even for systems self-assessed as not high-risk. Add ISO/IEC 42001 surveillance audits and continuous framework expansion, and the recurring line is larger than the implementation line by year three.

08 How onboarding runs

Four steps, and the first two cost you nothing but calendar time.

Step	What happens	Typical elapsed
Fit and motion	We agree which motion or motions you are running, which client segments you are taking, and where the overlap risk sits with our direct team.	One or two conversations
Agreement	Referral or partner agreement executed, including deal registration terms and commission schedule for your motion.	TBC with each partner
Enablement	Platform and methodology training for your consultants and sellers. Delivery motions certify a minimum of two consultants.	TBC with each partner
First joint pursuit	You register an opportunity and we work it together, with Modulos pre-sales in support, so the first cycle is a shared one rather than a cold handover.	Immediately after enablement

About Modulos

Modulos AG is an AI governance platform and a spin-off of ETH Zurich, based in Zurich. The platform turns AI governance into a steering wheel rather than a brake: a single control set behind 20+ frameworks, monetary quantification of AI risk, and autonomous discovery of the AI running across an organisation. Modulos is named in the inaugural Gartner® Magic Quadrant™ for AI Governance Platforms and holds product conformity certification for ISO/IEC 42001, independently assessed by the Swiss auditor CertX — completed before most national accreditation bodies had accredited certification bodies for the standard, so the platform was evaluated on the standard's own merits rather than against established audit precedent.

Modulos works with clients and reference organisations including PwC, JobCloud, Noxtua and Beyond Gravity, and partners across agent security, assurance and certification.

ISO/IEC 42001 PRODUCT CONFORMITY SOC 2 TYPE 2 GARTNER® MAGIC QUADRANT™ SPIN-OFF ETH ZÜRICH

---

Start with one client you already have.

The fastest way to test this is not a partnership discussion, it is a live account. Bring one client with an AI governance obligation and a framework list, and we will run a joint mapping session against their estate. You will see the control collapse on their own frameworks, and you will know inside a fortnight whether there is a practice here.

Talk to the Modulos AI Ecosystem team → modulos.ai Modulos AG · Zurich, Switzerland

---

Commission, margin and licence terms are set out in the executed partner or referral agreement and prevail over anything described here. Nothing in this document constitutes an offer. Control figures are measured on the shipped framework estate. Procurement and implementation timings are typical enterprise planning assumptions, not guarantees. Regulatory summaries are provided for commercial context and are not legal advice.

*Gartner, Magic Quadrant for AI Governance Platforms, Lauren Kornutick, Sumit Agarwal, Priya Sundararaman, Nader Henein, Brandon Medford, 16 June 2026. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.