AI Governance: A Ladder, Not a Cliff
Ten productised AI governance services, ordered from a free 10-minute self-assessment all the way to an ISO/IEC 42001 certification pathway. Start where you are; we'll tell you which rung is the right next step. Every paid service is fixed-price and time-bound, with no open-ended day rates.
Need the platform and process behind it? Explore our ServiceNow and Enterprise Service Management practices. Just need an AI policy? See AI policy for SMEs.
AI Readiness Scorecard
The Problem We Solve
Most SMEs don't know whether AI rules apply to them at all. A long sales call is the wrong way to find out. So we built a free 10-minute self-assessment you can take anonymously, covering how your team uses AI, whether you make automated decisions about people, whether you sell into the EU, and which UK rules and voluntary frameworks are most relevant to you.
What You Receive
Who This Is For
Anyone curious about their AI exposure. Founders, ops directors, HR leads, compliance managers, IT leads: anywhere AI is creeping into the day-to-day.
AI Exposure & Scope Check
The Problem We Solve
The hardest question for any UK SME using AI is the most basic one: which rules are we actually subject to? The EU AI Act gets the headlines but it's only a legal duty for firms that touch the EU market. UK GDPR, the reformed Article 22 rules under the Data (Use & Access) Act 2025, and the Equality Act bite far more often, plus your sector regulator. We unpack that with you in a single call.
What We Do
A focused conversation with someone who understands both your sector and the regulatory landscape. We walk through how your business actually uses AI, then map that against UK legal duties (Bucket 1) and voluntary best-practice frameworks (Bucket 2). Most clients leave reassured. The few who don't get a clear, proportionate roadmap.
What You Receive
AIME-based AI Governance Health Check
The Problem We Solve
DSIT's AI Management Essentials (AIME) is the UK government's free, SME-friendly AI governance baseline, built on ISO/IEC 42001, the EU AI Act and the NIST AI Risk Management Framework. It's a thorough self-assessment but not a certification, and most teams who try to run it alone get stuck on what "good" looks like. We run it with you, properly.
What We Do
We work through the AIME questionnaire with your team, score each of the ten governance dimensions (fairness, transparency, accountability, oversight, third-party communication and the rest), and turn the result into a maturity report with a prioritised, proportionate action plan. Government framework plus our expertise equals instant board credibility.
What You Receive
EU AI Act Rapid Audit
The Problem We Solve
If you sell products into the EU, provide services to EU users, or operate AI systems whose output is used in the EU, the EU AI Act is a hard legal duty for you, not a benchmark. The 2 August 2026 enforcement window for the high-risk obligations is now close, and the Act is complex enough that most in-house teams can't safely self-assess.
What We Do
We give you a complete picture of your EU AI Act exposure in two to three weeks. We inventory your AI systems, classify each one against the Act's risk tiers (unacceptable, high, limited, minimal), gap-test against the high-risk obligations, and deliver a written audit report with prioritised actions before the enforcement deadline.
What You Receive
Who This Is For
UK manufacturers and exporters with EU customers, SaaS firms whose products are accessed by EU users, healthcare and life-sciences firms with EU clinical or commercial operations, and any UK business that sells into or operates within the EU market. For purely domestic UK businesses, the EU AI Act is voluntary best practice and we'd typically point you to the AIME Health Check instead.
Automated Decision-Making Audit
The Problem We Solve
The Data (Use & Access) Act 2025 reformed Article 22 of UK GDPR: the rules on solely-automated decisions with legal or "similarly significant" effects on people. These rules are already in force, and they hit hiring, credit, insurance, pricing and recruitment harder than anything in the EU AI Act. They're also where you have real Equality Act exposure if your model produces biased outcomes against protected characteristics.
What We Do
A focused audit of every automated decision your AI makes about a person. We map the decision flow, identify where Article 22 conditions apply, assess your safeguards (meaningful human involvement, information rights, contestability), and stress-test for algorithmic bias against the Equality Act's protected characteristics.
What You Receive
Who This Is For
HR and people teams using algorithmic CV screening or candidate ranking. Recruitment agencies. Lenders and credit-scoring teams. Insurers. Retailers using personalised pricing. Anyone whose AI decides things about a customer or employee.
ISO 42001-Aligned Governance Framework
The Problem We Solve
Audit findings are only useful if you act on them. Most businesses that complete an AI audit then struggle to build the governance infrastructure around it: the AI register, policies, decision audit trails and human oversight controls that regulators, insurers, customers and procurement teams increasingly demand. We build that infrastructure and align it to ISO/IEC 42001 so you have a credible certifiable end-state.
What We Do
A complete AI governance framework. AI systems register, decision audit trail architecture, staff training materials, transparency and explainability documentation, and the human oversight controls that high-risk systems require. Built to ISO/IEC 42001 structure throughout, so if certification ever becomes commercially valuable you're already most of the way there.
What You Receive
AI Policy Starter Pack
The Problem We Solve
Most SMEs have staff quietly using generative AI tools without a policy, without an inventory, and without any literacy training. That's the easy yes that anyone can act on. The EU AI Act's Article 4 explicitly expects AI literacy for any organisation deploying AI, which is becoming a baseline procurement expectation even for purely domestic firms.
What We Do
A done-for-you policy and governance starter pack. We give you an acceptable-use policy tailored to your business, a simple AI system register your team will actually maintain, role and accountability assignments, and a short AI-literacy module for your staff.
What You Receive
AI Controls & Security Assessment
The Problem We Solve
AI systems introduce new attack surfaces, data risks and operational vulnerabilities that traditional IT security frameworks weren't designed to address. As AI adoption accelerates, most organisations have accumulated a sprawling, undocumented AI estate with little visibility over what data it processes, what decisions it influences, and where it is exposed.
What We Do
A comprehensive security and controls assessment of your AI estate, aligned to NCSC and DSIT AI cyber-security guidance. We map what you have, identify vulnerabilities, assess data-handling risks, and deliver a prioritised remediation plan.
What You Receive
Agentic AI Implementation
The Problem We Solve
Most businesses use AI reactively, a chatbot here, a summarisation tool there. The real competitive advantage comes from agentic AI: systems that independently take actions, manage workflows and make decisions within defined parameters. Building it correctly, with the governance, oversight and controls the regulators (and your customers) expect, demands specialist expertise most organisations don't have in-house.
What We Do
We design, build and deploy agentic AI systems for your specific business context. From automated customer handling to internal process orchestration, the systems work autonomously within clearly defined guardrails, with compliance architecture embedded from day one, not retrofitted.
What You Receive
ISO/IEC 42001 Certification Pathway
The Problem We Solve
ISO/IEC 42001:2023 is the only certifiable international standard for AI management systems. Under 100 organisations worldwide are currently certified. It's becoming a powerful procurement and trust signal, particularly for SaaS firms, regulated sectors and anyone selling enterprise. Getting there is a multi-year journey if you go it alone. We shorten it.
What We Do
An ongoing retainer that takes you from your current governance baseline through to certification readiness. Gap analysis against ISO 42001, controls implementation, internal audit cycles, management review preparation and liaison with your certification body. Designed to run alongside your existing AIME and ISO 27001 work.
What You Receive
Start at Rung 00. It's Free.
Take the 10-minute AI Readiness Scorecard. It'll tell you where you sit across the ten AIME governance dimensions, which UK rules and benchmarks actually apply, and which rung of the ladder is the right next step. No salesperson, no follow-up unless you ask.