Banning AI doesn't work.
Ignoring it is worse.
Use moves to phones.
People still use AI, just on personal devices and accounts where you can't see it, protect it or prove anything about it.
Data goes where it goes.
Client data ends up in tools you never assessed, with no record of who decided that was fine. It holds until a client, insurer or regulator asks.
Safe use becomes the easy use.
Know what's in use, decide what's allowed, protect the data that matters and be able to prove it. People use AI more, not less.
Every tool. A decision on each.
The centre of the work. Each AI tool and feature, who uses it, what data it touches, the risk and a recorded decision: approve, restrict or stop. Most uses get a quick yes. The few that don't get proper attention.
Find it. Decide. Control it.
Seven areas, with the depth of each agreed in scoping based on your size, your sector and how sensitive your data is.
AI inventory and shadow AI audit
Approved tools, personal accounts, browser extensions, note-takers and the AI built into software you already pay for. Technical discovery as well as asking people.
Risk assessment
Each use assessed against what it touches: client data, personal data, financial decisions, hiring, regulated advice.
AI acceptable use policy
Short enough to read, clear enough to follow. Approved tools, what data goes where, when a person checks the output, who to ask.
Technical controls
Approved tools on business accounts, risky ones blocked or restricted, data loss prevention where it matters. A policy without controls is a suggestion.
Supplier due diligence
A repeatable check before a tool is approved: where data goes, whether it trains their models, retention, security and contract terms.
Regulation, clients and insurers
Your obligations mapped and turned into evidence you can hand over when a client questionnaire or insurer renewal asks.
Training and ownership
AI literacy training, clear owners, an approval route for new tools and a review rhythm that keeps up with the next release.
No single UK AI law. Plenty of rules.
We map which of these reach your business and turn them into evidence. For formal legal advice, we work alongside your solicitors.
UK GDPR
Applies whenever AI touches personal data, including impact assessments for higher-risk processing.
ICO guidance
Expects accountability, fairness and transparency when AI is used on people's data.
Sector regulators
Bodies such as the FCA and SRA hold firms responsible for the tools they rely on.
EU AI Act
Can apply if you serve EU clients. Obligations are phased and some deadlines have moved.
Clients and insurers
Questionnaires and renewal forms increasingly ask how you manage AI.
Three stages. One evidence pack.
Free scoping
Your business, the AI you know about and what's prompting the question: a client questionnaire, an incident, an insurer or a nagging worry.
- 30-minute call
- Fit and rough scope confirmed
Discover and assess
You approve a written scope and fee. We build the inventory, assess the risks and agree with you which uses to approve, restrict or stop.
- AI inventory
- Risk register with decisions
Policy and controls
We write the policy, configure the controls, train your people and hand over the evidence. Governance becomes how you work, not a document in a drawer.
- Acceptable use policy
- Controls configured
- Supplier checklist
- Board, client and insurer pack
- Staff training
Need it kept current? We can stay on for scheduled reviews, or hand it to your team with a review calendar.
Written by people who build AI.
A lot of AI governance is written by people who have never deployed an AI tool. It shows: 40-page frameworks, risk matrices nobody updates and policies that ban things staff do every day.
We build and run AI ourselves, including Ellis, our AI receptionist, and we run security for our clients. So the policy reflects how the tools actually work, and the controls are ones we configure, not recommendations we leave you to work out. For the thinking behind it, read why shadow AI is your biggest blind spot.
Rolling out Microsoft 365 Copilot? Fix the oversharing, labels and controls before it goes live.
ExploreSomeone to own AI decisions month to month: priorities, delivery and adoption.
ExploreIT, cyber and AI for practices handling client financial data under HMRC and PI scrutiny.
ExploreQuestions boards ask first.
What directors, partners and compliance leads ask before an AI governance engagement.
The rules, ownership and controls for how your business uses AI. In practice: knowing which AI tools are in use, deciding what's allowed, protecting the data that matters, checking outputs where mistakes are costly and being able to show clients, insurers and regulators that you're in control.
There's no single UK AI law. But UK GDPR already applies whenever AI touches personal data, the ICO expects you to manage the risks, and sector regulators such as the FCA and SRA hold firms responsible for the tools they use. If you serve EU clients, parts of the EU AI Act may apply too. Clients and insurers are increasingly asking the question as well.
Yes. Those are exactly the tools staff use with client data. A short policy that says which accounts to use, what data can go in and when to check the output prevents most of the problems we see.
Rarely. Bans push use onto personal phones where you can't see it. We'd rather approve the right tools on business accounts, restrict the risky ones and make the safe option the easy one.
Where it applies to you, yes. We map which of your AI uses could fall in scope and what that means in practice. Obligations are being phased in and some deadlines have moved, so we work from the position at the time of your engagement. For formal legal advice, we work alongside your solicitors.
It depends on your size and how much AI is already in use. One real engagement, a 70-person practice, had governance in place within six weeks. We confirm your timetable after scoping.
It's priced on scope: headcount, number of tools, how sensitive your data is and how much technical control is needed. You get a written scope and fixed fee before work starts. The scoping call is free.