Fractional CTO: When You Need One and What the First 90 Days Hold
When does a business need a fractional CTO instead of a full-time hire? Our answer, a 90-day plan of what they own, and the measures that show whether it works.
Your app was built by an outside agency, an investor has sent a list of security questions, and nobody on your side can answer them or check the agency's latest estimate. That is the point where we recommend a fractional CTO: a senior technology leader who works for you part of each month. Bring one in when technology decisions carry real risk but there is not yet enough senior technical work for a full-time job. Hire full-time when an in-house engineering team needs daily direction, or when technology is what you sell and it changes every week.
What a fractional CTO does, and what stays with you
Under a written mandate, a fractional CTO covers architecture, engineering practice, security basics, suppliers and the technical roadmap. It is a leadership role. They decide or recommend, and they hold engineers and suppliers to account. They are not an extra developer.
Two roles get confused with it. A fractional chief AI officer owns the AI portfolio, AI vendors, AI governance and board reporting across the whole organisation. A fractional CTO owns the systems and the team that build and run your product, including the AI features inside it. An outside development agency builds what you ask for. A fractional CTO decides what to ask for and checks what comes back.
Some things stay with the owners and the CEO: the budget, hiring and firing, the contracts you sign and final accountability for risk. Put that in one line of the mandate, so nobody has to guess later.
When does a business need a fractional CTO?
We recommend a fractional CTO before a full-time hire when at least two of these are true:
- An outside agency or freelancers build and maintain your product, and nobody on your side can review their work or their estimates.
- An investor, buyer or large customer asks about security, architecture or data hosting, and the answers sit in one engineer's head.
- You want to add AI features, such as an Arabic chatbot or document reading, and cannot judge the proposals you receive.
- Cloud, licence and AI API bills rise every quarter and nobody can explain why.
- One or two people hold all the admin passwords, and every release waits for them.
Hire a full-time CTO instead when an in-house engineering team needs daily direction and line management, or when product decisions come up every day. A leader who is with you a few days a month cannot run daily planning or manage people closely.
Why we recommend fractional first
If you hire before anyone has mapped your systems, contracts and risks, you are choosing a CTO for a company nobody has examined yet. Ninety days with a fractional CTO should give you that map, a working plan and a clear picture of the full-time role, if you need one. What you give up is cover. Someone who works part of the month is not on call by default. The mandate must say who responds to an outage on a day they are not working, and how fast.
What a fractional CTO owns in the first 90 days
Write the first 90 days into the mandate as three blocks, each with outputs you can inspect. We recommend this order: control first, then stability, then direction. Improving a system you do not control means building on someone else's accounts.
| Days | What the fractional CTO owns | Done when |
|---|---|---|
| 1 to 30: control | A register of every system (cloud, code hosting, domains, payment, app stores) with its admins; billing moved to company accounts; a list of API keys and passwords with their purpose; a backup restored once; a map of suppliers and what each one runs | Every system has a company admin with multi-factor sign-in, and someone on your side has restored a backup |
| 31 to 60: stability | A release process with code review and a way to roll back; basic monitoring and an incident route; supplier contracts reviewed for code ownership, data and exit; the top technical risks listed | Releases no longer depend on one person, and each top risk has a person responsible and a date |
| 61 to 90: direction | A 12-month technical roadmap tied to business goals; build, buy or keep decisions for the main components; AI use cases ranked, each with a baseline (how the work performs today) and a stop rule; a budget for cloud, licences and AI APIs | The CEO or board has approved the roadmap or sent it back with comments |
Shared references and data hosting
Shared references keep the security work from turning into personal preference. The NIST Cybersecurity Framework 2.0, released on 26 February 2024, is written for organisations of every size and added a Govern function to Identify, Protect, Detect, Respond and Recover. For how software is built, NIST's Secure Software Development Framework lists Version 1.1 (SP 800-218, February 2022) as the final edition, with a Version 1.2 draft released on 17 December 2025. Neither is a law. Both give your fractional CTO and your team one checklist to work from.
Data hosting belongs in the first 30 days too: where customer data is stored, which cloud region holds it and which data protection law applies. A cloud region in the UAE, for example, is outside Saudi Arabia. This is general information, not legal advice. Your obligations depend on your sector and the data you process, so confirm them with counsel.
How to measure a fractional CTO
Measure outcomes and decisions, not hours. Agree four groups of measures on day one and review them on days 30, 60 and 90.
Delivery
The DORA research program's metrics guide (updated 5 January 2026) defines five software delivery measures: change lead time, deployment frequency, failed deployment recovery time, change fail rate and deployment rework rate. Record them in the first month as your baseline and judge the trend, not a single week. A team that releases once a month will not release daily after 90 days, and it should not try.
Control
- Critical systems with a company-owned admin account and multi-factor sign-in: all of them by day 30.
- Days since the last tested restore from backup.
- People who can release to production: at least two.
Cost
Monthly cloud, licence and AI API spend against the roadmap budget, with each line assigned to a product, team or customer. A bill nobody can break down is a finding in itself.
Decisions
Count the decisions taken on evidence. Were suppliers renewed, renegotiated or replaced? Were components kept, rebuilt or bought? Did each AI pilot continue or stop against its stop rule? A fractional CTO who produces documents but no decisions is acting as an adviser, not a leader.
Watch for two warning signs before day 90. Your agency still sends estimates nobody challenges, or the admin passwords still sit with the founder or one engineer. Either one means the mandate lacks authority or the person lacks time. Fix the mandate first, then judge the person.
Illustrative cases: a marketplace in Amman and a logistics company in Riyadh
An online marketplace in Amman with about 40 staff (illustrative). An outside agency built the app three years ago and bills by the hour. A regional investor wants answers on security and data hosting before the next funding round. A full-time search would take months and land in the middle of the investor's review. Here we would recommend a fractional CTO on a 90-day mandate. Month one takes back control of accounts and code. Month two puts the agency on a release process with review, and month three brings a roadmap and a supplier decision to the board.
A logistics software company in Riyadh after a change of owner (illustrative). The new owner wants AI to read shipping documents in Arabic and English. Two engineers know the system, and the cloud bill has no breakdown by customer. We would hold the AI work until day 61. Secure access, cost tagging and a second person able to release come first. Our guide to the first 100 days after acquisition follows the same order.
How to start
For businesses in our Venture Lab, GET acts as embedded fractional CTO and operating partner through Post-Acquisition AI Operations (VT2). It can follow the Technical & AI Due Diligence (VT1) review of code, data, infrastructure and AI risk before any acquisition. For any other organisation, a good first step is the free AI Exposure Scan: a 45-minute conversation that ends in a written next step. Bring your list of systems and your largest supplier contract.
Frequently asked questions
What is the difference between a fractional CTO and a full-time CTO?
A fractional CTO leads your technology part of each month under a written mandate, covering architecture, suppliers, security basics and the roadmap. A full-time CTO is with you every day and can manage an in-house engineering team directly. Fractional fits when technical decisions carry real risk but do not yet fill a senior full-time job. Full-time fits when product decisions come up daily or a growing team needs close line management.
How many days a month does a fractional CTO work?
There is no standard number. Agree the days in the mandate, along with the meetings they attend, what they may approve alone and who responds to an outage on days they are not working. The first 90 days tend to need more time than later months, because the work of taking control of accounts, code and suppliers comes first. Review the time at day 90 against what the roadmap needs.
What should a fractional CTO deliver in the first 90 days?
In days 1 to 30, control: a register of systems and admins, company-owned billing, a list of keys and passwords, and a tested backup restore. In days 31 to 60, stability: a release process with review and rollback, monitoring, and supplier contracts checked for code ownership and exit. In days 61 to 90, direction: a 12-month roadmap put to the CEO or board for approval, build or buy decisions and ranked AI use cases.
How do you measure a fractional CTO's performance?
Measure outcomes and decisions, not hours. Track the five DORA delivery measures against a first-month baseline, control measures such as company-owned admin accounts and tested backups, monthly cloud and AI spend against budget, and the number of supplier, build or buy and AI pilot decisions taken on evidence. Review them on days 30, 60 and 90.
Is a fractional CTO the same as a fractional chief AI officer?
No. A fractional chief AI officer owns AI across the whole organisation: the AI portfolio, AI vendors, AI governance and board reporting. A fractional CTO owns the systems and the team that build and run your product, including any AI features in it. A software company may need the CTO first. An organisation that buys rather than builds AI tools may need the chief AI officer first.
Get new insights by email
One email when we publish something useful. No spam; leave any time.
Services in this article
Related lab: Venture Lab ↗
