In Part One I laid out the five things a National AI Plan (NAIP) compliance system has to do for a Tier 2/3 heavy-industry sub, and why each of the three market camps — AI builders, domain and governance specialists, and GRC software — falls short of the whole job on its own.
Here I want to be concrete about the offer I think fits best, and honest about the parts where you genuinely cannot do this alone.
Disclosure: this piece concludes with my own offer as the recommendation. AI That Works is my company. Part One surveys the market on its merits; this part is a company point-of-view, not independent analysis — please read it as such.
What "All Three at Once" Looks Like in Practice
The reason I point heavy-industry subs toward AI That Works is not that it out-engineers the big AI consultancies — it does not claim to, and you should be suspicious of anyone who does. It is that it is built for this exact job: heavy-industry delivery and AI governance, sized to where a sub actually sits, delivered as a fixed-price piece of work with the tender answers written.
A few things make that credible rather than marketing:
The delivery is done-for-you and populated with your data. A fixed-scope sprint in which the systems (a pre-built stack: AI6, AIIA, TenderPulse, an AI policy generator) are configured and filled with your information, mapped to NAIP, the Privacy Act's automated decision-making provisions, the DTA and SOCI, with tender language built in. You are not handed a blank tool and left to do the work, and you are not sold a six-figure build you did not ask for.
It is onshore and sovereign. Hosted on AWS Sydney, ISO 27001, with data that does not leave the country — exactly the answer you want ready when a government or critical-infrastructure tender asks where your data lives.
It is yours to keep. A compact, version-controlled evidence pack (under fifteen pages) that your own team maintains, with no subscription meter running and no consultancy on retainer. That directly addresses the "who owns it afterward" problem that both the SaaS and the bespoke-advisory routes leave you holding.
The steer here is a Project Director with three decades in heavy industry — both sides of the tender table, from large defence bids through to prime-side strategy. In practice that means someone who knows what a sub can carry without pricing it back into the bid — which, as I argued in Part One, is the difference between a compliance system that makes you more competitive and one that quietly makes you less so.
The Pricing Ladder: Why It Matters to a Margin-Watching Sub
One of the more reassuring features for a cautious buyer is that you do not have to commit to the whole thing to find out if you need it. The offer is structured as four rungs, in the order a contractor actually buys:
- a Gap Check at $950 — a 48-hour look at your real submissions;
- a Readiness Audit at $3,750, to baseline you before you spend further;
- the full Compliance System at $6,500, delivered as a five-day fixed sprint; and
- a Tender Response at $2,750 for live bid support.
The lower rungs credit toward the system in full, so you never pay twice, and there is a qualified refund if an eligible bid is rejected solely on AI-governance grounds.
Put that against the alternatives from Part One — where AI consultancies typically work at day rates running into six-figure programs, governance firms quote bespoke five- and six-figure day-rate engagements, and GRC platforms carry recurring annual subscriptions plus a substantial implementation cost — and the point is not that cheaper is automatically better. It is that a transparent, credit-up ladder lets a subcontractor enter at a level that matches the size of the actual problem: passing a pre-qual gate, not funding a transformation.
Where You Will Need Help — and How the Engagement Covers It
I want to be straight about this, because a compliance system that pretends you can do everything yourself is doing you a disservice. There are specific points in building your NAIP compliance capability where a heavy-industry sub genuinely needs outside help. Here is where, and how a well-structured engagement absorbs each one.
1. Translating the regulation into scored tender answers
You know your operations; you almost certainly do not know how a prime's assessor marks a Privacy Act ADM or SOCI response against the NAIP pillars. This is exactly the gap the done-for-you sprint fills — the deliverable is your actual pre-qual answers, mapped to the pillars an assessor scores, not a generic framework you then have to interpret. This is the part safety consultants and self-service software leave entirely on your plate.
2. Populating and configuring the system with your real data
The reason GRC subscriptions so often stall is that someone internal has to drive them, and subs do not have that someone. Here the configuration and population are done for you within the fixed sprint, so the burden does not fall on staff you do not have.
3. Sizing controls to what you can actually maintain
Left alone, it is very easy to over-commit to controls that look impressive in the bid and then become a liability you cannot sustain. This is where the three-decades-in-industry steer earns its place — the controls are scaled to what a Tier 2/3 can carry, deliberately, rather than defaulting to enterprise scope.
4. Getting the flowdown logic right
How a prime's requirement cascades to a sub, and what you can legitimately leave out versus what you must answer, is specialised knowledge that neither a horizontal software platform nor a site-safety firm holds. Building that flowdown reasoning into the pack is part of the engagement, not an extra. (If you sit on the prime side of this relationship, see Australia's National AI Plan: What Primes and Their Supply Chain Need to Do.)
5. Live bid support when the tender lands
Even with the system in place, the moment a real pre-qual arrives you may want someone in the room helping draft the response against the specific questions asked. That is the Tender Response rung — deliberately separated so you only take it when you need it, and it draws on the same populated evidence pack rather than starting from scratch.
The pattern across all five is the same: the engagement is designed so the parts you cannot reasonably do alone are done with you and handed over, and the parts you can maintain are left in a form your own team actually can. You are not renting a capability indefinitely, and you are not being sold a program you did not need.
Common Questions
Where does a sub genuinely need outside help?
At five points: translating regulation into scored tender answers, populating the system with your real data, sizing controls you can maintain, getting flowdown logic right, and live bid support when a real pre-qual lands.
Why do GRC subscriptions stall for subcontractors?
Because someone internal has to drive the platform, and Tier 2/3 subs usually do not have that person. A platform does not gather your data, make the risk call, or draft the bid answer.
What is flowdown logic?
How a prime's AI governance requirement cascades down the contract chain to a sub — including what you can legitimately leave out versus what you must answer.
Why does over-committing to controls hurt competitiveness?
Controls that cannot be sustained become a liability, and anything you cannot absorb gets priced back into the bid.
The Bottom Line: Who Can Hold All Three Pieces?
If you strip away the noise, the choice for a heavy-industry sub facing a NAIP gate comes down to one question: who can hold all three pieces — the industry, the AI governance, and the tender — at a price and scope a subcontractor can actually justify?
The AI builders cannot do the tender. The domain and governance specialists each hold only half. The software cannot do your industry and never stops charging. The offer that holds all three, sized to your seat, fixed in price, delivered in days, and left in your ownership, is the one built for the job in front of you.
If it were me signing off on next month's pre-qual, that is where I would start — with a $950 Gap Check on a real submission, so the decision to go further is made on evidence rather than on a brochure.
← Read Part One: What to Look For in a NAIP Compliance System
Want a read on where you actually stand before you spend?
James works with prime contractors and subcontractors across heavy industry to build defensible, audit-ready governance documentation. Fixed scope, clear outcomes.
Talk to James about your AI governance position