Enquirer Consulting Group

Reachable Buyer Map

Prepared for Don Liyanage · TIKOS · August 2026
Here is the map. Assurance gets bought where a regulator, an auditor or a board is already asking who checked the model, so this market sorts by obligation rather than by industry. This page counts the United States, because the obligation is heaviest there and the register is the most complete. Your site names the UK government approval, so read this as the market next door rather than the home one.
Banks, savings institutions and credit unions
The segment that has been doing this for a decade under a different name. Model risk management is already a funded function with a written policy and an examiner who asks about it, so nobody here has to be sold the idea that a model needs independent challenge. The argument is coverage, not concept.
Who signs: chief risk officer, head of model risk management, chief data officer, chief information security officer, and the internal audit lead on validation work.
8,500 to 9,500
US depository institutions on the federal registers, banks and credit unions combined
Insurance carriers
Regulated at state level, which means the same obligation arrives fifty times in slightly different words. Rating, underwriting and claims models are all now in scope for fairness testing, and the actuarial function is used to documenting its reasoning, so explainability lands as a familiar demand rather than a new one.
Who signs: chief actuary, chief risk officer, head of data science, chief compliance officer.
3,000 to 3,500
US insurance carriers registered as employers across life, health and property lines
Hospitals and health systems
The sector where a wrong model has a patient at the end of it, and where the buying decision has moved in the last two years from the technology group to a named clinical governance seat. Long cycles, but the work recurs every time a new tool is brought inside the walls.
Who signs: chief information officer, chief medical information officer, head of clinical informatics, and where the seat exists, the chief AI officer.
Roughly 6,000
US hospitals, sitting inside about 400 multi-hospital systems where the governance decision is usually made once for the group
Device and medicine manufacturers
The only segment on this page where the software itself can be the regulated product. Anything that reasons about a patient carries a submission burden and a change control burden, so evidence of testing is not a nice-to-have, it is part of the file. This is also the segment where an outside assurance report carries more weight than an internal one.
Who signs: VP of quality, head of regulatory affairs, chief technology officer, software quality and validation lead.
Roughly 13,000
US registered medical device establishments, alongside about 9,800 registered drug establishments in the same federal system
Critical infrastructure operators
Power, gas, water and pipeline. Automated decisions here sit next to physical consequences, and the operating technology side is generally more conservative than the corporate side, which slows adoption and then makes assurance the condition of it going ahead at all.
Who signs: chief information officer, head of operational technology, chief information security officer, director of grid or network reliability.
5,000 to 6,000
US employers registered across electric power, natural gas and water utilities and pipeline transportation
Defense and national security suppliers
The closest analogue to the credential you already hold, and the hardest of these segments to enumerate cleanly. The federal contractor register is public and complete, but it does not say which registrants are building models, so the AI-relevant slice is found by evidence rather than filtered from a field. Worth saying plainly rather than implying a list exists.
Who signs: chief technology officer, director of mission systems, program manager on the relevant contract, security and assurance lead.
About 800,000 registrants
active US federal contractor registrations in total; the slice building or fielding models is identified one at a time, not filtered

Where the openings are

1
The five counted rows come to roughly 35,500 to 38,000 organizations and registered sites. Hospitals and manufacturing establishments are counted as sites, so a large parent can appear more than once, and the number of buying decisions behind it is smaller than the number of rows. That is still a market measured in tens of thousands, and almost none of it has any reason to have heard of a Bristol company with a UK government approval.
2
The buyer is a role that did not exist three years ago. Head of model risk outside banking, head of responsible AI, chief AI officer. New seats buy tooling early, because a new seat has to show in its first year that it was worth creating. Those appointments are announced publicly and they are a timing signal, not a directory entry.
3
A public sector credential is proof, but it is not a channel. Being approved to supply a government does excellent work in the second conversation and none at all in the first, because the people who would be impressed by it have to hear about it from somewhere. That gap between strong proof and no distribution is the most common shape we see in this category.
4
There are two buyers in the same account, and they do not agree. The team building the model wants explanation to improve the model. The team signing for it wants evidence it can hand to a regulator or a board. One reads Explore, the other reads Evaluate, and a single message aimed at the middle usually persuades neither. Two named audiences is a different reach problem, and a solvable one.
Built from public federal registers: employer benefit plan filings current to the 2024 filing year, the federal device and drug establishment registrations, and the active federal contractor register. Counts are banded deliberately and indicate scale rather than exact totals. Establishment and site counts are not company counts, so a single owner can appear more than once. Owner-only and very small companies are not published in the employer data. Sector codes are self-reported. It describes the market rather than your business, and there is nothing to buy at the end of it.
ENQUIRER CONSULTING GROUP
enquirerconsulting.com