Founder Cohort 1 · 10 of 25 seats · price moves Aug 31, 2026

The vCISO model, rebuilt for AI governance.

vCAIR productises the Virtual Chief AI Risk Officer service — a credentialed practice you can sell into your existing consulting book after a four-week cohort. Three credentials (ISO 42001 Lead Auditor + AI Red Teaming Professional + vCAIR Certified Partner), a 5-project audit-experience portfolio counter-signed by an IAF-MLA Lead Auditor, 12 months of platform access with five client-tenant slots, and the 2-qualified-leads guarantee.

$5,000 in. First Readiness Bundle close at $24,000 = 4.8× ROI minimum. Additional closes are upside.

ISO 42001 Lead Auditor • AI Governance + AI Security • 14-day cohort kickoff • 60-day audit-pass guarantee
$5,000 $9,500 after 25 partners or Aug 31, 2026

10 of 25 founder seats remaining. $5,000 today bundles $1,298 of credentials (AI Red Teaming Professional AIRTP+ $1,199 via Learn Prompting · Mastermind ISO 42001 Lead Auditor $99) with 12-month Certified Partner status, GTM playbooks for AI Governance + AI Security markets, and our 2-qualified-leads guarantee (a floor we aim to beat). Price moves to $9,500 on Aug 31, 2026 — Cohort 2 partners face a $4,500 spread for the same value bundle. Capacity is gated by Lead Auditor hours, not arbitrary scarcity.

Your $5,000 Founder fee converts to a credit of up to $5,000 toward the Readiness Bundle ($24,000) when purchased within 6 months of cohort completion. Codified in Partner Agreement §2.4 so it survives any future pricing changes.
Talk to Guillaume about Cohort 1 Or pay in 2 — $2,500 today + $2,500 in 30 days
60-day audit-pass refund · if your firm hasn’t signed its first vCAIR engagement, we refund the services portion of your fee.
Book a 20-min discovery call See the unit economics — 4.8× on first close
Anchored by
Mastermind Lead Auditor ISO/IEC 42001:2023 SSRN n=185 · p<0.01
Guillaume Kaldjob, founder of Cognita GRC
90s Why I built vCAIR — in plain English, from Guillaume
Built on accredited rails
Accredited by
M
Mastermind AssuranceFirst CB accredited for ISO 42001
CERT 2697gssmkw
Aligned with
42
ISO/IECInformation technology · AIMS
42001:2023
N
NIST AI RMFUS federal guidance
1.0
EU
EU AI ActRegulation 2024/1689
Art. 6
SR
Fed Reserve SR 11-7Model risk management
GenAI ext.
Distributed by
C
Channel PartnersMSP / MSSP distribution network
Channel
T
Training PartnersCredential & enablement network
Credentials
The trust system

Three pillars you point at when a $10M client asks "who's behind this?"

Brand and trust are not decorative in this category. A consultant buying vCAIR is staking their reputation on the platform and the credential they re-sell. Every pillar below is engineered to make that re-sale defensible.

Pillar 01 · Credential

Mastermind Lead Auditor — the first CB accredited for ISO/IEC 42001:2023.

Founder credential Cert 2697gssmkw, issued May 2026. A credential held by fewer than 200 practitioners worldwide today. Every audit-grade deliverable a partner produces is counter-signed by a Cognita Lead Auditor.
Pillar 02 · Platform

Cognita — the only AI Management System built clause-by-clause for ISO 42001.

Real telemetry integrations (W&B, MLflow, Arize). Cryptographic Merkle-anchored audit ledger, scoped auditor portal, branded export bundles. Live evidence is your defence against regulator scrutiny.
Pillar 03 · Research

Operational Certainty — peer-reviewed empirical backbone, n=185, p<0.01.

SSRN-published study by the founder covering 185 PE transactions. The empirical backbone of Cognita's governance-as-evidence thesis. Partners cite it in PE, credit and regulated-finance pitches.
The category bet

vCISO had a fifteen-year head start. vCAIR is unclaimed.

Three windows close in 2026. Whoever names the category, certifies the practitioners, and operationalises the standard wins the cohort that defines the next decade of AI governance services.

Why now

Mid-market AI risk is a $2M/year practice line sitting on every MSSP's existing book.

A full-time Chief AI Risk Officer costs $250K+ in the US. Mid-market firms (100–2,000 FTE) cannot afford one, but their boards, regulators, and customers are already demanding ISO 42001 evidence. They will pay $4,500/month for a credentialed fractional officer — delivered by you, on Cognita.

01
SEO and mindshare
Term "vCAIR" currently unindexed on Google, LinkedIn, IAPP — own the keyword before anyone else
Open
02
Brand halo from Mastermind
First Certification Body accredited for ISO 42001 — co-marketing edge narrows as peers accredit through 2027
Closing
03
Talent supply gap
4,000 qualified vs. 35,000 needed by 2027 in the US
Peak
Who buys this

If you serve three or more clients on a security or compliance retainer, vCAIR pays for itself.

The Founder cohort is sized for the four buyer profiles below. The first ten seats prioritise MSSP owners and boutique GRC consultancies — bigger book, faster placements.

Persona 01
MSSP Owner
Profile 50–500 enterprise clients · $5M–$50M revenue firm Logic AI governance attaches to existing managed-security retainers
Year-1 revenue from vCAIR
$120K – $480K
Persona 02
Boutique GRC Consultancy
Profile 3–50 consultants · ISO 27001 + SOC 2 specialist Logic Extends your existing ISMS practice into AI governance
Year-1 revenue from vCAIR
$72K – $240K
Persona 03
Fractional CISO Practitioner
Profile Solo or 2–3 person firm · 5–15 vCISO retainer clients Logic Adds AI Risk Officer to every existing vCISO engagement
Year-1 revenue from vCAIR
$60K – $144K
Persona 04
IT / Security MSP
Profile MSP-501 firm in fintech, healthcare, gov verticals Logic Closes the AI gap regulated clients are now asking about
Year-1 revenue from vCAIR
$96K – $300K
The curriculum

Five days. Operationally specific. Authored by a Lead Auditor.

This is the credibility anchor. Day 1 is the live cohort workshop. Days 2–5 are self-paced and complete within the 4-week credentialing window. Pass the exam at 75% to earn the vCAIR Certified Partner badge.

Day1
● Live cohort
Foundations
ISO 42001, NIST AI RMF, EU AI Act, SR 11-7 — the regulatory stack and how the standards relate.
Day2
Async
28 activities · 16 documents
Walk the ISO 42001 audit map clause by clause. Cognita compendium as your textbook.
Day3
Async
AIIA · risk · SoA
Run an AI Impact Assessment in Cognita. Build a risk register. Author a Statement of Applicability.
Day4
Async
The platform
Deploy clients. Model registry, evidence collection, auditor portal, branded export bundles.
Day5
Async + exam
Service model + exam
Pricing. Engagement structure. 90-day deployment. 40-question proctored exam — two free re-attempts.
Guillaume Emmanuel Kaldjob — Founder & Lead Auditor, Cognita GRC
KALDJOB Guillaume Emmanuel
Founder, Cognita GRC · Montréal, Canada
May 2026
ISO/IEC 42001 Lead Auditor CISSP CISA 11 yrs · GRC architecture
The founder

I am the Lead Auditor who counter-signs your first ten engagements.

I built vCAIR because I watched the same scene play out in fifty boardrooms. The CEO asks "what's our AI governance posture?" and a generic consultant produces a policy PDF, three months late, that nobody can defend in front of a regulator.

The standard exists. The platform exists. The credential exists. What was missing was the operator who could hand all three to a consulting firm in a single Stripe payment. That is what Founder Edition is. It is also why every customer deliverable a partner produces in the first cohort goes across my desk first.

"Evidence over assertion. The math closes the partner; the cert keeps them in market." — Guillaume Kaldjob, May 2026
Cohort 1 · $5,000

What's actually included in the cohort.

Two markets. Three credentials. One cohort. Twelve months of partner status. Honest value math — what you pay equals what you get.

vCAIR Certified Partners deliver in two high-demand markets: AI Governance (ISO 42001 readiness, EU AI Act compliance, AIIA + SoA) and AI Security (LLM red-teaming, prompt injection defense, agent security). The AI security market is the differentiator — most GRC competitors (Vanta, Drata, Secureframe) stop at governance frameworks. Cohort 1 partners deliver both, certified.

Included Tonight — what your $5,000 buys today
  • ✓ Learn Prompting AIRTP+ certification — AI Red Teaming Professional, retail $1,199, self-paced on-demand (via our partnership with Learn Prompting). AI Security credential — the differentiator most GRC partners don't have.
  • ✓ Mastermind ISO 42001 Lead Auditor certification — $99 bundled. Week-1 self-paced course + exam. AI Governance credential — table stakes for the market.
  • ✓ 5-project audit-experience portfolio — synthetic case studies spanning the full ISO 42001 audit lifecycle: AIIA → Statement of Applicability → Risk Register → Audit Plan → Mock Audit Report. Each capstone counter-signed by IAF-MLA Lead Auditor. PECB Lead Auditor equivalent practical capability — without the $3,000 instructor-led cost.
  • ✓ vCAIR Certified Implementation Partner status — 12 months. Pilot-equivalent platform access, 5 client-tenant slots, perpetual /partners directory listing, co-marketing kit, sales playbooks for both markets.
  • ✓ Lead Auditor counter-signature on your first paying engagement — same IAF-MLA signature that backs your cohort capstones.
  • ✓ 2-qualified-leads guarantee on AI Governance engagements — see full terms below*.
BUNDLED CREDENTIALS $1,298
AI Red Teaming Professional (AIRTP+) · self-paced on-demand · via Learn Prompting$1,199
Mastermind ISO 42001 Lead Auditor$99
COHORT + 12-MONTH PARTNER STATUS $3,702
5 days of content (1 live workshop + 4 self-paced) across the 4-week credentialing window + exam
5-project audit-experience portfolio
(PECB Lead Auditor equivalent practical capability · synthetic cases spanning AIIA → SoA → Risk Register → Audit Plan → Mock Audit Report · counter-signed by IAF-MLA Lead Auditor)
vCAIR Certified Implementation Partner status · 12 months
Pilot-equivalent platform access · 12 months · 5 client-tenant slots
Co-branded marketing kit + perpetual /partners directory listing + GTM playbooks (AI Governance + AI Security)
Lead Auditor counter-signature on first paying engagement
2-qualified-leads guarantee on AI Governance engagements
TOTAL VALUE AT COHORT 1 PRICE $5,000

Real-world comparison: PECB ISO 42001 Lead Implementer instructor-led runs $3,000. With Mastermind + 5-project portfolio, vCAIR partners reach equivalent practical capability at $99 + cohort cost.

Next-Step Credentials — partners self-pursue, vCAIR routes
  • ○ IAPP AIGP · $900–$3,500 · months 4–6 · AI Governance breadth
  • ○ OffSec OSAI · $2,500–$5,000 · months 9–12 · AI Security depth
  • ○ SANS SEC598 + GIAC · $8,000–$9,000 · year 2+ · Gold-standard AI security operations credential
vCISO vs vCAIR

Same operating model. Different scope. Most partners run both.

vCISO covers the cybersecurity function. vCAIR covers the AI risk function — its own discipline under SR 11-7 and ISO/IEC 42001. You can sell both, or just vCAIR. You keep the client relationships either way.

vCISO vCAIR Both, combined
Regulatory anchor NIST CSF · SOC 2 · ISO 27001 ISO/IEC 42001 · EU AI Act · NIST AI RMF · SR 11-7 Both layers — cyber + AI
Credential CISSP · CISM · ISO 27001 LA ISO/IEC 42001 Lead Auditor · AI Red Teaming Professional (AIRTP+) Stack both — same operator
Platform Drata · Vanta · ad-hoc spreadsheets Cognita GRC (AI-native ledger, model registry) One client account, both modules
Fractional model 5-15 hrs/wk · 6-12 month engagements 5-15 hrs/wk · 6-12 month engagements Same operator across both functions
Pricing band $3,500-$8,000 / mo $4,000-$9,000 / mo (AI premium) $6,500-$14,000 / mo combined
Who delivers You (the consultant) You — credentialed via Founder Cohort 1 You — adds AI risk to your existing book

Most Founder partners run both — vCAIR attaches to every existing vCISO engagement, lifting average MRR 30–45% without acquiring new clients.

Your vCAIR timeline

Three clocks, named. $5,000 in. First $24,000 close by month 12.

The funnel would otherwise scatter ten different time spans. Here are the three that matter — and which clock measures what.

Clock 1 · weeks 1–4 Credentialing — the cohort itself

Three credentials + 5-project portfolio. Lead Auditor Ready by week 4.

  • Week 1: Mastermind ISO 42001 Lead Auditor — self-paced, $99 bundled (we provision the seat)
  • Weeks 1–4: AI Red Teaming Professional (AIRTP+) — self-paced on-demand, retail $1,199, included in Cohort 1 (via our partnership with Learn Prompting)
  • Weeks 1–4: vCAIR core curriculum — 5 days of content (1 live workshop + 4 self-paced) across the 4-week window
  • Weeks 1–4: 5-project audit-experience portfolio (AIIA → SoA → Risk Register → Audit Plan → Mock Audit Report) — each capstone counter-signed by IAF-MLA Lead Auditor
  • Week 4: vCAIR certification exam (75% pass mark · 2 retakes)

Outcome: Three credentials + 5-project portfolio · Lead Auditor Ready · ready to sell into both AI Governance + AI Security markets in week 5.

Clock 2 · weeks 5–12 Go to market · first qualified conversation

Go to market in week 5. Triage by week 8 if leads aren't landing.

  • Co-marketing kit deployment + listing on /partners directory
  • Two-market sales playbooks (Governance + Security)
  • Pricing playbook for Readiness Bundle ($24K)
  • Portfolio strategy: build 3 reference projects on top of your 5 cohort cases
  • Weekly office hours with Guillaume + cohort peers

Outcome: First qualified client conversation by week 8 minimum. Lead-delivery accountability begins week 5 — if no qualified conversation by week 8, we triage in office hours rather than at month 12 when it's too late.

Clock 2 · weeks 13–52 Deliver & grow · portfolio extension

First $24,000 close. 4.8× ROI minimum.

Extend your 5-project cohort portfolio with real client engagements across both markets:

  • 1 · AI Governance engagement (ISO 42001 / EU AI Act / NIST AI RMF)
  • 2 · AI Security engagement (LLM red-team / prompt injection audit)
  • 3 · Combined engagement (Governance + Security bundle)

Outcome: By month 12, your portfolio is 5 cohort cases + 3 real engagements = 8 referenceable projects. At least 1 Readiness Bundle close at $24,000 (4.8× ROI minimum). 2-qualified-leads guarantee* engages if no close by month 12 despite vCAIR delivering the guaranteed floor of 2 qualified leads and partner meeting commitments.

Clock 3 · commercial windows Read separately — unrelated to the training timeline
  • Cohort 1 scarcity: 10 of 25 seats remaining (gated by Lead Auditor counter-signing capacity, not arbitrary)
  • Price moves to $9,500: Aug 31, 2026 — Cohort 2 partners face a $4,500 spread for the same value bundle
  • 12 months: vCAIR Certified Partner status + Pilot-equivalent platform access
  • 90 days: per-seat client deployment window (post-cohort · independent of cohort timing)
The 2-qualified-leads guarantee

A floor we aim to beat. What we commit to. What you commit to.

2 is the floor, not the target. We guarantee 2 qualified leads against capacity we control — Compass routing + founder warm intros. Our aim is to deliver more. The guarantee replaces vague "1 close minimum" promises with specific commitments on both sides.

vCAIR commits

We guarantee 2 qualified leads for your business within the 12-month Cohort 1 partner term — and our aim is to beat it. 2 is the floor, not the target. A qualified lead is defined as:

  • ✓Decision-maker contact (CISO, CRO, CIO, or owner-operator) with verified budget authority at $24K+ ACV
  • ✓Stated AI governance or AI security need with active timeline (procurement window within 6 months)
  • ✓Direct introduction via vCAIR partner-routing service (compass.cognitagrc.io routing or Guillaume-warm referral)
  • ✓Geographic + industry match to your stated specialization

You commit

  • ✓Respond to qualified lead introductions within 4 hours during business hours (Mon–Fri 9am–6pm partner local time)
  • ✓Conduct first discovery call within 7 days of introduction
  • ✓Use the vCAIR sales playbook (provided in cohort) for first engagement pitches
  • ✓Counter-sign Lead Auditor work product via the vCAIR platform
  • ✓Report lead status weekly via the partner dashboard

What happens if no $24K close by month 12

If vCAIR has delivered at least 2 qualified leads (the guaranteed floor) as defined above, AND you've met your partner commitments above, AND no Readiness Bundle ($24K) has closed by month 12 — vCAIR's responsibility is considered fulfilled.

This is honest about what we can and cannot control. We control lead generation. You control sales execution. Both matter; neither alone produces a close.

Partners who close zero engagements after 2+ qualified leads typically have a fixable issue: pricing posture, response speed, or sales process. We surface this in week 8 office hours and triage together — not at month 12 when it's too late.

What the guarantee does NOT cover

  • ✗Closes you generate from your own outbound (yours to keep — Lead Auditor counter-signature still included)
  • ✗Closes below $24K ACV (vCAIR Compass $497 customers don't count toward the threshold)
  • ✗Leads you reject for valid reasons (out of geography, industry mismatch, scope misalignment)

This guarantee replaces vague "1 close minimum" promises with specific commitments on both sides. It's the structure we'd want if we were buying this cohort.

Common questions

Six we hear on every discovery call.

If yours isn't here, raise it on the 20-minute call. We answer plainly.

01 How is vCAIR different from a vCISO program?

Same operating model, different scope. vCISO covers the cybersecurity function. vCAIR covers the AI risk function, which is its own discipline under SR 11-7 and ISO 42001. You can sell both, or just vCAIR. You keep the client relationships either way.

See the side-by-side breakdown in the vCISO vs vCAIR comparison section above — regulatory anchors, credentials, pricing bands, and who delivers what.

02 $5,000 feels expensive for a training program. What am I actually buying?
It is not a training program. It is three credentials (ISO 42001 Lead Auditor + AI Red Teaming Professional + vCAIR Certified Partner), a 5-project audit-experience portfolio counter-signed by an IAF-MLA Lead Auditor, 12 months of Pilot-equivalent platform access with 5 client-tenant slots, a co-branded marketing kit, and the 2-qualified-leads guarantee. The credentials and curriculum are included; the product is a business in a box. See the canonical "What's included" list with full value math.
03 What's the realistic timeline to my first paying client?

Weeks 5–12 of the cohort are dedicated to GTM enablement across both markets — AI Governance (ISO 42001, EU AI Act) and AI Security (LLM red-teaming, prompt injection defense). You go to market in week 5 with three credentials and a 5-project portfolio in hand.

vCAIR's 2-qualified-leads guarantee engages at month 12 if no $24K close has happened despite at least 2 valid qualified leads delivered (the guaranteed floor — we aim to beat it). "Qualified lead" is defined specifically in the guarantee section above — decision-maker contact at $24K+ ACV with verified budget authority, active timeline, direct intro from us, geo + industry match.

The floor expectation is at least 1 close in 12 months. Partners who follow the playbook and respond to leads within the 4-hour SLA typically close 2–3 in year 1. If you haven't had a qualified client conversation by week 8, that's a flag and we triage together in office hours — not at month 12 when it's too late.

The guarantee structure is symmetric: vCAIR commits to lead generation, you commit to sales execution. Both have to work for the 4.8× ROI minimum (single $24K close) to materialize. Additional closes are upside you keep.

04 Why does AI Security matter for vCAIR partners?

The AI security market is growing faster than the AI governance market in 2026. Most GRC competitors (Vanta, Drata, Secureframe) stop at governance frameworks. vCAIR Certified Partners deliver both:

  • Governance work: ISO 42001 readiness, EU AI Act compliance, AIIA + SoA, Lead Auditor counter-signature
  • Security work: LLM red-teaming, prompt injection audit, agent security review, OWASP LLM Top 10 conformance

The AIRTP+ certification (developed by Learn Prompting, co-instructed with practitioners from OpenAI, Scale AI, and Hugging Face) gives Cohort 1 partners credible AI red-team capability that pure-governance competitors don't have. We're partnering with Learn Prompting to include AIRTP+ in Cohort 1 — pending final partnership confirmation. This is your defensible market differentiation: a portfolio across both markets is what most enterprise buyers actually need.

If you want to focus purely on governance, the cohort works for that too. The credential includes both; you choose which markets to sell into based on your existing client base.

05 What happens to the seats after the 90-day client-deployment window?
Each of your 5 client-tenant seats has a 90-day deployment window post-cohort (one of the three commercial windows in Clock 3). Once a seat is placed at a client, it renews at $158/month. You re-bill the client at whatever rate you set — typical mid-market rate is $4,500/month — with a 35% partner margin baked into the licence. Most partners are net-positive on Cognita licensing alone by month four.
06 What is the next step if we want in?
Book a 20-minute discovery call with Guillaume. Three questions, three minutes each. If we are a fit, you can sign the agreement and pay via Stripe live on the call. Time from "yes" to "in the cohort" is under ten minutes. Welcome email and Slack invite go out within five minutes of payment.
Founding partner spotlight Announcing this week
MSSP Owner · Northeast US Founding partner #1 · signing this week
Boutique GRC Consultancy · Calgary Founding partner #2 · LOI signed
Fractional CISO · Pacific Northwest Founding partner #3 · in discussion
IT-Security MSP · Texas Founding partner #4 · in discussion
Identities held until each partner consents to public mention. The first three signatures convert these placeholders into real logos, real names, and real LinkedIn links.
Get started

The first ten US partners name the category.

Book a 20-minute call. Three qualifying questions, the math walkthrough, and — if it is a fit — Stripe checkout while we are still on the line.

60-day audit-pass refund Stripe + DocuSign Lead-Auditor counter-sign on all deliverables
vCAIR Founder Edition $5,000 · one-time
Guillaume is online Montréal · last active just now · responds in 24h
●No card now·●2-page MSA·●Founder responds within 24h