Compliance Audit Quote Pricing: How to Price GDPR Audits and AI Act Consulting

BOTrento Team26 October 20269 min read

Why compliance work is hard to price

Compliance and regulatory advice looks like a product, but it behaves like a project with unknown inputs. The client says they need a GDPR audit, and that can mean a quick review of a privacy notice or a full look at every system that touches personal data.

Three things make pricing tricky:

• Unknown starting point. You don't know how good the client's records, contracts and processes are until you open them.
• Dependence on other people. Interviews, access to systems and sign-offs depend on the client's staff and often on their suppliers.
• Blurry finish line. Being compliant is not a deliverable. A report, a register, a set of policies and a training session are.

So price deliverables, not outcomes. Never promise that a client will be compliant or will avoid regulatory action; promise a defined piece of work.

Choose the pricing model that matches the uncertainty

There is no single right model. Match it to how well the scope is known.

Fixed fee for a diagnostic or defined audit

Use it when the scope can be listed: a set of systems, teams and document types, agreed upfront. Fixed fees are easy for clients to approve, but only if your assumptions are written down.

Day rate or time-and-materials with a cap

Use it when the scope depends on what you find, for example remediation support or ongoing regulatory advice. Add a cap or a review point so the client isn't signing a blank cheque.

Monthly retainer

Use it for continuing work such as answering questions, reviewing new suppliers or keeping a record of processing up to date. Define what is included (hours, response times, topics) and what is billed separately.

Phased pricing

For most GDPR and AI Act work this is the safest default: a paid discovery phase first, then a fixed fee for the next phase once you know the real shape of the job. Clients tend to accept it because they see value early and you stop guessing.

What to ask before you quote

Most bad compliance quotes come from skipped questions. Before you price, get answers to these, ideally in writing:

1. Entities and locations. Which legal entities, countries and teams are in scope?
2. Systems and tools. Which systems hold personal data or use AI: CRM (HubSpot, Pipedrive), email (Gmail, Outlook), accounting (Xero, QuickBooks), marketing tools, custom software?
3. AI use. Which AI tools do staff use today, officially or not, and what do they put into them? For AI Act work, is the client building, buying or just using AI?
4. Existing documentation. Is there a record of processing, a privacy notice, supplier contracts, a previous audit?
5. Access and people. Who will you interview, and who approves findings?
6. Deliverable and audience. Is the report for management, a customer questionnaire, a tender or a regulator-facing file?
7. Timeline pressure. Is there a deadline driven by a customer or contract?

If the answers are vague, that is your signal to quote a discovery phase rather than a full audit. Our GDPR and AI checklist for sales enquiries shows the sort of questions clients themselves should be able to answer.

Build the scope: in, out and assumed

A compliance quote holds up when it has three lists.

In scope

Name the deliverables. For a GDPR audit, for example: a review of listed processing activities, a gap report with priorities, and a findings call. For AI Act readiness: an inventory of AI systems in use, a first classification of each, and a gap summary with suggested next steps.

Out of scope

State plainly what is not included: implementing fixes, drafting every policy, negotiating supplier contracts, representing the client before an authority, legal opinions on specific disputes. For anything that needs a lawyer, say so and recommend the client takes specific legal advice.

Assumptions

This is where you protect yourself. Typical ones:

• The client provides access and documents within an agreed time.
• Scope covers the listed systems and entities only.
• A set number of review rounds is included.
• Rules and guidance are assessed as they stand when the work is delivered.
• If assumptions prove wrong, the change is quoted separately before work continues.

Price the risk, not just the hours

Regulatory advice carries risk that plain hours don't capture: reliance on your work, professional liability, and the chance that the client's data turns out worse than described.

• Add a contingency for discovery risk on fixed fees, or split the project so the unknown part is time-based.
• Check your insurance and contract terms for liability limits, and keep your wording to what you actually deliver.
• Charge for urgency. Rush work for a customer deadline should cost more than planned work.
• Don't discount by cutting scope silently. If the client wants a lower price, remove a deliverable from the list and say which one.

For more on why it pays to be explicit, see our article on questions to ask a vendor before you sign. Your clients are asking similar questions about you.

A quote email template for a phased audit

Adapt this and send it with your formal proposal. Keep placeholders in square brackets until you have the facts.

Subject: Proposal: [GDPR audit / AI Act readiness] for [Company]

Hi [Name],

Thanks for the call. Based on what you shared, I suggest we work in two phases, so the fee matches what we actually find.

Phase 1: Discovery (fixed fee, €[x] excl. VAT). We review [listed systems and documents], interview [roles] and agree the scope of the audit. You receive a short summary and a fixed quote for Phase 2.

Phase 2: Audit / readiness review (fixed fee, confirmed after Phase 1). Deliverables: [gap report, register of AI systems, priority list]. Includes [number] review round(s).

Not included: implementing fixes, legal opinions on specific disputes, contact with authorities. We can quote these separately.

Assumptions: access to documents and people within [timeframe]; scope limited to [entities/systems]; changes to scope are agreed in writing before work starts.

This quote is valid until [date]. If it looks right, reply to confirm and I'll send the engagement letter.

Best,
[Your name]

Keep quotes and follow-ups under control

Advisory quotes get stuck because they sit in someone's inbox, wait for client input and are followed up late or not at all. A promise like 'I'll send the revised scope by Friday' is easy to lose when you're deep in client work.

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-ups. It watches enquiries and quotes in your mailbox and in the data you upload, shows a Today overview each working morning, prepares draft replies, quotes and follow-ups in four languages, and picks up promises such as 'I'll get back to you by Friday' and reminds you of them. Nothing is sent without a person's approval, and BOTrento sends nothing by itself.

Some limits to know: it doesn't replace your CRM or accounting, and it works from the text of emails, not from attachments, so key scoping details should be in the email body or your notes. You can see the flow in the process demo, and our answer on how to stop forgetting quote follow-ups covers the basics. If you work in advisory, the B2B services page shows where it fits.

On data: it is stored on servers in Germany (EU), and the text needed for a task is processed by a commercial language-model provider through an API. That isn't a closed computation, so check it against your own client confidentiality obligations. Our article on where your data is when you use AI explains the difference.

You can try it for 14 days free on your own data, with no card and no API key of your own. The 14 days start with your first successful data upload, and someone from our team contacts you within 24 hours on working days to help connect your mailbox. AI is included in the plan, within a monthly usage limit. See the pricing page for plans.