AI GOVERNANCE / REVIEW / OVERSIGHT

Your business is using AI.
But do you know the risks?

Your team is already using AI to draft advice, analyse figures and work with client information. An answer can sound convincing and still be wrong. Sensitive data may leave your control without anyone realising. If something goes wrong, who will answer for it? We help you find the exposure, establish safeguards and stay in control.

Arrange an initial conversation Explore our services

THE QUESTIONS THAT MATTER

01Do you know which AI tools your staff are actually using?

Unapproved tools can enter a business through ordinary staff accounts, browser extensions and personal subscriptions. If you do not know what is being used, you cannot assess the information going into it or the decisions being made with it.

02Are staff putting confidential client information into AI?

Contracts, accounts, correspondence and identifiable client details may be uploaded without approval. Depending on the tool, configuration and circumstances, this may breach confidentiality duties or data protection requirements before anyone in management is aware.

03Do you know what happens to your clients’ data after it is uploaded?

You need to understand the provider’s terms, retention arrangements, access controls and any onward processing. An enterprise setting and a personal AI account may present very different risks.

04Who checks that AI-generated work is actually correct?

AI can produce convincing but inaccurate answers, omit important clauses or invent supporting facts. If a client relies on unchecked advice or a flawed calculation, the resulting complaint or financial loss may fall on your firm.

05Would you know if an AI tool changed tomorrow?

Providers can change models, features and data handling arrangements. A tool that was acceptable when approved may need reassessment after a material change. Who is responsible for noticing?

06If a client challenged you, could you prove your safeguards worked?

Policies alone are not enough. Could you produce an approved-tool register, staff guidance, evidence of checking, risk assessments and a record of who authorised the use? Without records, defending your process becomes harder.

If you cannot answer these questions, you may already be exposed.

We help you establish where the risks lie, and what to do about them.

Clarity and control
in a changing landscape

Governance that works
in practice

AIME-informed,
ISO/IEC 42001-aligned

Commercially minded,
risk-led advice

Who we help

Where AI creates professional responsibility.

We help UK SMEs and professional firms adopt AI responsibly. If your team uses ChatGPT, Microsoft Copilot or AI features within existing business systems, we help you understand the risks to confidential information, reliability and accountability.

Professional services

Accountancy, legal, consultancy and other advice-led firms.

Finance functions

Businesses using AI across reporting, analysis and operations.

Education

Schools and education providers navigating staff and student AI use.

Growing organisations

Teams looking to formalise AI governance before risk outpaces control.

The starting point

Embrace AI.
But know the risks.

We assess how AI is already being used across your organisation, identify risks that may have gone unnoticed, and help you introduce the policies, safeguards and approval processes needed to manage them. We then provide continuing oversight as your use of AI develops, so you can embrace its benefits with greater confidence.

01 / VISIBILITY

We establish the facts.

We establish which tools are in use, who uses them, what information is shared and where approval may be missing.

02 / RELIABILITY

We check what matters.

We assess critical outputs and put proportionate checks, policies and safeguards in place to reduce the risk of errors.

03 / ACCOUNTABILITY

We make accountability clear.

We define ownership, approvals and monitoring responsibilities, and help maintain evidence that the controls are working.

Use AI with confidence. We look after the safeguards.We assess the exposure, implement controls and keep governance under review as your organisation changes.See how we can help

A REAL-WORLD SCENARIO / LEGAL SERVICES

A solicitor asks AI to draft a contract.
It looks right. It isn’t.

It takes minutes. The draft reads well, the fee earner is busy, and the contract goes to the client with only a quick review. Nothing seems unusual until there is a dispute.

WHAT HAPPENED

One everyday shortcut.
Several serious exposures.

These are illustrative potential outcomes, not a report of an actual case. The same pattern could arise with AI-drafted advice, accounts, reports or client letters.

01 / ACCURACY

A vital clause was missed.

An omitted limitation of liability leaves the client exposed and the firm facing questions over the quality of its advice.

02 / FINANCIAL LOSS

The client suffers a loss.

The contract is disputed. The client may seek redress. The firm must explain what was checked before it gave its advice.

03 / CONFIDENTIALITY

The contract was uploaded to AI.

Client information was entered into a tool that nobody approved or assessed. Confidentiality and data protection concerns now sit alongside the original mistake.

THE GOVERNANCE QUESTION

Who approved the tool, checked the work and assessed the data exposure?

We would examine the tool, its treatment of client data and the firm’s checking procedures, then help introduce clear approval, review and escalation controls.

See how we help

What we do

Review. Implement. Maintain.

Start with an independent assessment. We can then establish the necessary policies, records and controls, and maintain them as your use of AI changes.

Fees are indicative and scoped to the size, complexity and AI use of your organisation.

01 / REVIEW

AI Governance Review

We examine how AI is being used, identify gaps in safeguards and explain the practical steps needed to reduce your exposure.

AIME-informed assessment of AI use
Governance, policy and accountability gap review
Priority risk findings and practical recommendations
Clear action plan for next steps
Personal Teams meeting to discuss findings and priorities

From £675One-off review · + VAT

02 / IMPLEMENT

AI Governance Implementation

We develop and embed proportionate policies, risk assessments, approval processes and checks, with guidance from us on applying them.

AI inventory and approved-use register
Policies, risk assessments and boundaries
Ownership, approvals and escalation processes
Practical guidance and governance documentation
Working session to explain the framework and brief responsible staff

From £1,350One-off implementation · + VAT

Ongoing partnership

03 / MAINTAIN

Ongoing Governance & Oversight

We maintain your governance arrangements, consider new AI tools and uses, assess and help mitigate emerging risks, and talk decisions through with you.

Maintain your AI register and governance records
Assess new AI tools and uses before they are adopted
Identify changes in risk and recommend controls
Discuss material developments and decisions with you
Scheduled Teams oversight call and direct guidance

From £175/moOngoing retainer · + VAT

For organisations with established governance

ISO/IEC 42001-aligned Governance Audit

For organisations seeking a more substantial, independent-minded examination, we review the maturity and operation of your AI governance arrangements against relevant ISO/IEC 42001 requirements. We discuss findings with leadership and provide a prioritised improvement report.

From £3,500 + VATDiscuss an audit →

Indicative SME fees, excluding VAT. Final scope depends on organisation size, AI use and complexity. Services are advisory and do not constitute accredited ISO certification.

Our method

A disciplined, proportionate method.

Our work is informed by AIME and relevant ISO/IEC 42001 principles where appropriate. The scope reflects the organisation and the risks involved.

01 / DISCOVER

Understand the landscape

We map your AI tools, use cases, data flows and responsibilities.

02 / ASSESS

Evaluate the exposure

We evaluate material risks, supplier dependencies and weaknesses in current controls.

03 / ESTABLISH

Build the foundations

We develop proportionate policies, records and accountable processes with your team.

04 / OVERSEE

Keep it under review

We revisit the risks, update the records and report material changes to management.

What we put in place

Clear records. Practical safeguards. Ongoing accountability.

Depending on the scope of your engagement, we help establish and maintain the working documents and controls your organisation needs.

AI inventory & use registerRisk assessmentsGap analysis & prioritiesPolicies & approved-use rulesChecking & escalation proceduresManagement reporting & ongoing oversight

Beyond the initial review

Governance requires attention after implementation.

AI does not stand still. Employees try new tools, existing systems change and new uses bring different risks. We review these developments, assess the potential impact, recommend safeguards and help keep your policies, controls and records current. You can concentrate on using AI, knowing its governance is being looked after.

Through regular reviews, management updates and direct discussions when decisions arise, we help you maintain proportionate oversight without having to build a dedicated internal function.

Explore ongoing oversight

Your governance framework, maintained

AI register & ownership

Visibility of tools, use cases and those accountable for them.

Policies, risks & controls

Documentation that evolves alongside your operation.

Periodic challenge & reporting

Regular reviews, practical actions and leadership updates.

Access to experienced advice

A professional sounding board when new AI decisions arise.

Why AI Diligence

Established audit principles applied to emerging AI risks.

Our approach is rooted in more than 20 years of professional audit, financial reporting and control experience, combined with hands-on knowledge of AI, technology and the finance systems businesses rely on. We know how to challenge a process, assess evidence and turn a finding into a practical improvement.

Audit and assurance experience

An understanding of risk, internal controls, testing and documented evidence, with the professional scepticism to examine whether procedures work in practice.

AI and technology in practice

Direct experience of AI systems, digital processes and implementation challenges, including their operational limitations and changing capabilities.

Finance systems and commercial context

Familiarity with reporting, business systems, confidentiality and the consequences when information or controls cannot be relied upon.

Questions

Frequently asked questions.

Some common questions about the scope of our work and how engagements begin.

Do we need AI governance if we only use tools such as ChatGPT or Copilot?

Potentially, yes. Even everyday tools raise questions around confidential data, accuracy, human review, appropriate use and accountability. The appropriate controls depend on how your organisation uses them.

Is this an ISO/IEC 42001 certification?

No. We can use ISO/IEC 42001 as a framework for gap assessments and governance improvement, but certification is a separate process undertaken by an appropriate certification body.

Can we start with a review and move onto ongoing support?

Absolutely. The initial review provides a sensible baseline and practical priorities. We can then help establish the framework and maintain it through our outsourced governance service.

Will this stop our staff using AI?

Our approach is to help you adopt AI responsibly, not prohibit it by default. We focus on clear boundaries, sensible control measures and appropriate human oversight.

Can staff put confidential client information into ChatGPT or Copilot?

It depends on the information, the AI product, your organisation’s contractual arrangements and the safeguards in place. We review which tools are used, where information goes and whether staff have clear, appropriate rules before entering sensitive material.

How can we check whether AI-generated answers are reliable?

AI can produce convincing but incorrect work. We help identify high-risk uses, define checks and human approval points, and put appropriate evidence and escalation procedures in place.

Does a small business really need an AI policy?

If staff already use AI for client work, drafting, finance or decisions, proportionate written rules help clarify what is permitted, what needs review and who is responsible. We help tailor those rules to your actual use, rather than issuing a generic policy.

Take the first step

Know where you stand with AI.

Tell us how your organisation uses AI. We will discuss your potential exposure, explain where a review could help and recommend a sensible next step.

Direct advice from experienced professionals. No obligation.

Your business is using AI.But do you know the risks?