Enquirer Consulting Group

Reachable Buyer Map

Prepared for Kika Von Kluck · BNS · August 2026
Here is the map. Data and AI lifecycle work is bought where the data is already a liability, which means the market is not defined by industry so much as by which organizations have a rule, a regulator or an examination date attached to their data. This page covers the US segments where that is true, who signs inside each one, and roughly how many organizations sit there. It describes the market rather than your business, and there is nothing to buy at the end of it.
Banks and credit unions
The segment with the shortest distance between a data problem and a written consequence. Examination cycles are scheduled, findings are documented, and remediation work has a deadline attached to it before anyone goes looking for a vendor. Small institutions have the same obligations as large ones and a fraction of the staff, which is where outside help gets funded.
Who signs: chief data officer, chief information security officer, head of data governance, chief risk officer, chief compliance officer.
8,700 to 9,200
federally insured banks and credit unions combined; the two populations are close to the same size and buy in noticeably different ways
Insurance carriers
Decades of policy, claims and actuarial data sitting across systems that were never designed to talk, now being asked to feed models that have to be explained to a regulator. The clearest overlap between the governance side of your offer and the enablement side, in the same account and often in the same year.
Who signs: chief data officer, chief information security officer, chief compliance officer, head of analytics, chief actuary.
5,600 to 6,000
licensed US carriers, held under a much smaller number of groups where the buying decision usually sits
Health systems, hospitals and payers
The largest concentration of sensitive records in the country and the sector where privacy, security and AI ambition are argued in the same meeting. Long cycles, committee decisions, and a buying seat that has multiplied recently: many now carry a data leader, a privacy leader and an AI leader who do not report to each other.
Who signs: chief data or digital officer, chief information security officer, chief privacy officer, vice president of clinical informatics.
6,000 to 6,200
US hospitals, held inside roughly 400 to 700 systems where the decision actually sits rather than at the individual site
Life sciences, pharma and device
Validated environments, audit trails and evidence that a record was not altered are the native language here, which is why proof of record work reads as normal rather than novel. The buyer is used to paying for assurance and used to a long qualification before the first purchase.
Who signs: head of data and AI, quality and regulatory lead, chief information security officer, head of clinical data management.
3,000 to 5,000
US registered manufacturers and sponsors of meaningful scale; registration counts sites and filings rather than companies, so this band is deliberately wide
Architecture, engineering and construction
Enormous project data estates, models and asset records that outlive the projects that created them, and almost no dedicated data function to own any of it. Worth naming the consequence: the message that works in a bank lands on nobody here, because the seat it is written for does not exist.
Who signs: chief information officer, digital delivery or virtual design lead, chief operating officer, head of information management.
2,000 to 3,000
US architecture and engineering firms at 100 or more staff, plus the large contractors above them
Media, entertainment and hospitality groups
Rights, audience and guest data spread across brands, franchises and operators, with ownership of the estate genuinely unclear between the group and the properties underneath it. Buys later than regulated sectors, and buys quickly once a breach or a privacy statute makes the question unavoidable.
Who signs: chief information officer, chief technology officer, head of data platform, chief privacy officer, chief marketing officer on the monetization side.
1,200 to 1,800
US media, entertainment and hospitality companies at 250 or more staff

Where the openings are

1
Governance and enablement are two budgets with two owners. Inventory, guardrails and privacy work is funded against a date on a compliance calendar and signed by risk. AI enablement and data monetization is funded by a growth program and signed by the business. They live in the same account, they rarely talk, and one message cannot serve both. Two lists and two messages reach twice the account.
2
The compliance calendar is a targeting trigger, and it is public. Examination cycles, published enforcement actions, breach notifications and new state privacy statutes taking effect are all dated and all visible from outside. Watching several thousand named organizations for those events is mechanical work, and it is the one thing word of mouth structurally cannot do on a schedule.
3
Two of the segments on this page have no data leader at all. In construction and hospitality the person who owns this problem is a chief information officer or a chief operating officer with ten other problems, and the titles this category is usually pitched to appear on nobody's business card there. Those segments stay open precisely because reaching them takes a different list and a different first sentence, not a bigger send.
Built from public registries, counts banded deliberately. Registered entities are not the same as buying organizations: several of these registers count charters, sites or filings rather than groups, sector codes are self-reported, and where the decision consolidates above the site we have said so rather than inflating the count.
ENQUIRER CONSULTING GROUP
enquirerconsulting.com