How much does GRC software cost? Compare three years, not the list price
List prices for GRC software can't be compared directly. Ask every vendor the same seven questions, put the answers in one sheet and work out what you'll actually pay over three years.
You've written the requirements, sent them to four vendors and now have four quotes on the table. One is €350 a month, another €600. A third is priced per user and the fourth per legal entity. On paper the choice looks easy. It rarely is.
GRC software (governance, risk and compliance) is priced in so many different ways that two list prices almost never describe the same thing. One price covers a single company and ten users, another covers the whole group with unlimited users. One includes onboarding, the next bills it by the hour. Compare the monthly figures and you're comparing a known cost with invoices you haven't seen yet.
This guide gives you seven questions to put to every vendor, a worked example over three years and a comparison sheet you can download. It's written to be useful whichever vendor you end up choosing. We're a vendor ourselves, so you can put the same questions to us, and we show our own answers at the end.
The short answer: how much does GRC software cost?
For an organisation with 50 to 1,000 employees, the licence is only part of the price. Onboarding, data import, extra users, more group companies, new frameworks and expert help can add up to more than the licence itself over three years. Work out the total cost of ownership (TCO) over three years using the same seven lines for every vendor. The cheapest list price is rarely the cheapest solution.
If you haven't settled on your selection criteria yet, start with our GRC software guide, which has a weighted scorecard and 14 questions for vendors. Those 14 questions test whether a platform can do what you need. The seven in this article test what it will cost.
Why GRC software pricing can't be compared directly
Vendors tie their price to different units. Some charge per module or framework, some per user, some by company size, and some only quote after a scoping call. Each model is perfectly reasonable. The trouble starts when you put them in the same spreadsheet column.
| Pricing model | What the price follows | What to watch over three years |
|---|---|---|
| Per module or framework | Number of areas you cover (GDPR, NIS2, ISO 27001 and so on) | Every new requirement becomes a new module |
| Per user | Named users with a login | Auditors, system owners and managers who only need to read |
| Per entity or company size | Employees, revenue or number of legal entities | Subsidiaries bought or set up during the contract |
| Tiered packages | A bundle of features | The feature you need next sits in the tier above |
| Quote-based | A negotiated scope | What falls outside the scope, and the price at renewal |
On top of the model come the terms. Is the price monthly or annual? Is it paid in advance? Does it include onboarding? Is it fixed for the whole term or indexed every year? Two quotes can share a pricing model and still be miles apart once you read the small print.
Seven questions to ask every vendor about GRC software cost
Send these seven questions to every vendor on your shortlist and ask for a written answer with a figure. "It depends" is a fine starting point, but not a fine final answer. Each question becomes a row in the comparison sheet further down.
1. What does it cost to include every company in the group, including those added during the contract?
Many quotes cover the parent company only. If you have subsidiaries, or expect to buy or set up new ones, ask what each extra entity costs and whether it's added at the same price throughout the term. A group price that looks generous today can grow quickly after an acquisition.
2. How are users charged, and what does access cost for auditors, system owners and external advisers?
Compliance work involves more people than the compliance team. System owners need to update their assets, managers need to sign off risks, and your auditor or external DPO needs read access. Ask whether there's a user cap, what an extra user costs and whether read-only or guest access is priced differently.
3. What do onboarding, data import and support cost, and how many hours are included?
This is often the largest one-off cost and the easiest one to miss. Ask what onboarding includes, how many hours the vendor expects to spend, who imports your existing data from spreadsheets or an old system, and what support level comes with the price. Ask too how many hours the vendor expects from your side. Internal time is real money, and a realistic GRC implementation plan shows you where it goes.
4. How long is the commitment, what is the notice period and how is the price adjusted?
A three-year commitment with six months' notice is a very different deal from a monthly contract, even at the same monthly price. Ask for the minimum term, the notice period, whether the price is indexed each year and by how much, and what it costs to get your data out if you leave.
The law helps you on exit. Under Article 29 of the EU Data Act, providers of data processing services may not charge customers for switching from 12 January 2027, and until then any switching charge must be limited to the provider's actual costs. Under GDPR Article 28(3)(g), your data processing agreement must also say that personal data is deleted or returned when the service ends. Check both as part of your due diligence on the vendor.
5. Which features are included in the price you've quoted, and which are add-ons?
Don't ask whether the platform can do something. Ask whether it's in the price. Typical add-ons include incident logging, internal audits, an annual compliance calendar, single sign-on, API access and extra templates. Ask for the add-on price list in writing, so you can see what next year's wish list will cost.
6. What does it cost when a new requirement or company comes into scope?
Regulation won't stand still for three years. A subsidiary may fall under NIS2, you may start using high-risk AI under the AI Act, or a financial customer may ask you to document DORA requirements. Ask whether each of these means a new module, a new framework, a new licence or nothing at all, and put a price on it. In Denmark the national NIS2 act has applied since 1 July 2025, and in the UK the NIS Regulations 2018 still apply, so this isn't a hypothetical cost. Our NIS2 implementation guide shows what a new entity in scope has to do.
7. What does help after go-live cost, both technical support and expert advice?
Every organisation gets stuck at some point. Maybe it's a risk assessment nobody knows how to score, or an audit finding nobody knows how to close. Separate the two kinds of help. Technical support covers how the platform works. Expert advice covers what the rules actually require. Ask what's included, who delivers it, how quickly they respond and what an hour costs beyond the included amount. Help always costs something somewhere, so make sure it's in the comparison.
Worked example: the cheaper quote that costs more over three years
Coastline Logistics A/S and both quotes are fictional. We made them up for this article. The amounts sit within the range we see in the European mid-market, but the hourly rates are assumptions.
Coastline Logistics has 300 employees, a parent company and two subsidiaries. One subsidiary comes into NIS2 scope in year two. The compliance lead has two quotes. Quote A costs €340 a month. Quote B costs €600 a month. On list price, A is 43% cheaper.
| Cost line (3 years) | Quote A: lowest list price | Quote B: more included |
|---|---|---|
| Licence | €340 × 36 months = €12,240 | €600 × 36 months = €21,600 |
| Group companies | Parent only. 2 subsidiaries × €100 × 36 = €7,200 | All companies included = €0 |
| Users | 10 included. 8 extra × €20 × 36 = €5,760 | Unlimited = €0 |
| Onboarding and data import | 40 hours × €170 + import €2,000 = €8,800 | Included = €0 |
| NIS2 for a subsidiary from year 2 | €200 × 24 = €4,800 | €200 × 24 = €4,800 |
| Expert help after go-live | 10 hours a year × €190 = €5,700 | Basic help included. 5 extra hours a year × €160 = €2,400 |
| Commitment | 36 months, 6 months' notice | None |
| Total over 3 years | €44,500 | €28,800 |
Quote A ends up €15,700 more expensive over three years, roughly 55% more than B. The biggest single driver is onboarding and data import, followed by the subsidiaries and extra users. None of those lines were visible in the monthly price.
Two things are left out on purpose. Internal time is excluded because we've assumed it's the same for both quotes. In your own sheet it probably won't be, so add it. Price indexation is also left out to keep the sums readable. If one vendor indexes by 4% a year and the other by 2%, that difference belongs under question 4.
The example doesn't prove that the dearer quote always wins. Sometimes the low list price really is the best deal. The point is that you only find out once all seven lines are filled in for every vendor.
Comparison sheet: put the seven questions side by side
We've turned the seven questions into an Excel sheet. Each question is a row, each vendor gets a column, and the sheet adds up year one, year two and year three for you. It complements the requirements specification PDF in our GRC software guide. The specification helps you choose the right platform, and the sheet helps you see what that platform will cost.
| Row | Vendor 1 | Vendor 2 | Vendor 3 |
|---|---|---|---|
| List price per month | ☐ | ☐ | ☐ |
| 1. Group companies | ☐ | ☐ | ☐ |
| 2. Users and guest access | ☐ | ☐ | ☐ |
| 3. Onboarding, import and support | ☐ | ☐ | ☐ |
| 4. Commitment, notice, indexation and exit | ☐ | ☐ | ☐ |
| 5. Included features and add-ons | ☐ | ☐ | ☐ |
| 6. New requirements and companies in scope | ☐ | ☐ | ☐ |
| 7. Help after go-live | ☐ | ☐ | ☐ |
| Internal hours (your estimate) | ☐ | ☐ | ☐ |
| Total over 3 years | ☐ | ☐ | ☐ |
Download the GRC price comparison sheet
Three tabs: a short guide, a comparison sheet with the seven questions as rows and room for three vendors, and the worked example from this article. Enter monthly and one-off amounts, and the sheet adds up year one, two and three, including annual price indexation.
Presenting the choice to management and procurement
The person who signs off rarely reads the quotes. They read your summary. Keep it to three things. Show the three-year total for each vendor with the same lines. Name the two or three assumptions that move the result most, such as how many subsidiaries you'll add. And state the exit terms, so the board knows what it costs to change its mind. A recommendation that shows its working is much easier to defend than one built on a monthly price.
How .legal looks through the checklist
We said you could use the questions on us too. Here are our answers, based on our published pricing. Where something is agreed case by case, we say so.
| Question | .legal's answer |
|---|---|
| 1. Group companies | Covered under Enterprise by agreement. It's not a list price, so ask us for a figure |
| 2. Users | Unlimited users |
| 3. Onboarding and support | Onboarding and support are included. Assisted data migration is priced on request |
| 4. Commitment | Monthly payment, no commitment |
| 5. Features and add-ons | Priced per module, with add-on prices listed on the pricing page |
| 6. New requirements | A new area is a new module. Core starts at €200 per module per month |
| 7. Help after go-live | Support is included. Ask us what expert help your plan includes and what more would cost |
Two facts matter for the due diligence part of the decision. Our controls are covered by ISAE 3402 type 2 and ISAE 3000 type 2 reports, audited by BDO. And .legal is Danish-owned, with no private equity fund behind it.
Download the comparison sheet and fill it in for every vendor on your list, including us. If you'd like a second pair of eyes, book 20 minutes with us and we'll go through your sheet together. If you still have questions, ask Johannes directly.
.png?width=600&height=400&name=securitybreach-feature%20(1).png)
.legal compliance platform
Put .legal through the same seven questions
Our prices are published, billed monthly and carry no lock-in. Start with one module and add the next when a new requirement comes into scope, with unlimited users from day one.
-
Free plan with unlimited users
-
Core from €200 per module per month
-
Onboarding and support included
-
Monthly billing, no lock-in period
-
EU-hosted and covered by ISAE 3402 and ISAE 3000 reports
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
