For UK boards, owners and executives
The questions arrive long before the incident does
A customer sends a security questionnaire. An insurer asks what has changed since last renewal. A director wants to know whether anybody checked the AI tool before it was switched on. None of these are technical questions. All of them need an answer somebody outside your business will believe.
Will not sign until the questionnaire comes back clean.
Prices the renewal on what you can show, not what you say.
Carries the duty, and is the last to find out.
Two UK laws most businesses have not read
You are already required to do more than you think
The law behind every breach decision
It governs personal data handled by very nearly every organisation operating in the United Kingdom.
What it actually asks of you: keep an internal record of every personal data breach, including the ones you decided were not worth reporting, setting out the facts, the effects and what you did about it, and produce it for the ICO on request. Where a breach is likely to put people at risk, tell the ICO within 72 hours of becoming aware of it. Where that risk is high, tell the people affected without undue delay.
Most businesses keep no such record at all.
The one that already covers AI
The UK has no AI Act. This is the law that reaches AI decisions instead.
What it actually asks of you: since 5 February 2026, if a significant decision about a person is made solely by automated means, with no meaningful human involvement, you must tell them it happened, let them make representations about it, give them a route to a human who can intervene, and let them contest the outcome. The Act widened the grounds on which such decisions may be made. It did not remove the safeguards, and special category data stays fenced off.
That describes a great deal of what companies are currently calling AI.
Neither of these needs a new law to reach you. They are in force today.
What is actually coming, and when
The dates already in your diary
Four things that reach UK boards this year. Two are in force. One is a submission cycle that is open now. One is not law yet, whatever you have been told.
-
In force5 February 2026
Automated decisions about people
The date the safeguards set out above started to bite. Anything your organisation automated before then was not built to meet them, which is why this one catches people out: the obligation arrived after the system did.
The board question: which decisions about people do we already make without a human in the loop, and could we name them today?
-
In forceFinancial years beginning on or after 1 January 2026
A declaration that your controls work
Provision 29 of the UK Corporate Governance Code asks the board to declare that its material internal controls are effective, on evidence the board has seen. It applies to companies in the commercial companies and closed-ended investment funds listing categories. Large private companies report against the Wates Principles instead, which is not the same test.
The board question: if cyber is a material control for us, what will the board have actually looked at before it signs?
-
Open nowDSPT 2026-27, version 9
NHS data, and everyone who touches it
The Data Security and Protection Toolkit is CAF-aligned for trusts, integrated care boards, commissioning support units, and independent providers who are operators of essential services. It reaches suppliers, not only providers. Version 9 is aligned to CAF v4.0 and the deadline is 30 June 2027. Read our 2026-27 guide.
The board question: which of our suppliers hold NHS data, and have they submitted?
-
Not lawLords report stage scheduled for 26 October 2026
The Cyber Security and Resilience Bill
It has cleared the Commons. It has not received Royal Assent. It will matter a great deal when it does, and it does not bind you yet.
The board question: is anyone selling us readiness for a Bill that has not passed?
Checked on 30 September 2026. We date this section, because a governance claim without a date is not a governance claim.
How we work
What we will not tell you
We will not tell you the Cyber Security and Resilience Bill is law.
It is not. It has cleared the Commons and the House of Lords committee stage, and Lords report stage is scheduled for 26 October 2026 (checked 30 September 2026). It has not received Royal Assent.
You will find UK firms selling readiness for it as though it already binds you. When it passes, we will tell you what changed, what it asks of you, and by when. Not before.
The same rule covers everything else on this site. If we say a duty applies to you today, we will show you where it comes from and when it started. Where we are not sure, we will say that instead.
And where a date on this page turns out to be wrong, tell us and we will correct it and say what changed.
27 August 2026
The window they are describing is a governance window
116 companies and organisations, among them OpenAI, Anthropic, Google, Microsoft, Amazon and Oracle, signed a joint letter warning that AI-enabled attacks will become far more widespread and sophisticated within months. Their instruction to every other organisation was short: fix your vulnerabilities, modernise the systems you have been putting off, and put AI to work on defence.
It is good advice, and most UK mid-market businesses cannot act on it. Not for want of tools, but because nobody owns the question of which vulnerabilities, ranked how, signed off by whom, at the expense of what else. A risk measured in months does not wait for an organisation that needs three months to decide who decides.
What we do
Six ways in. Every one ends with something your board can act on.
Board simulation and tabletop exercises
A real scenario, run against your actual people, in the room. Not a slide deck about ransomware — a morning where the backups are gone too, the insurer wants an answer within the hour, and somebody has to decide. You get the decision log, the gaps it exposed, and an evidence pack that shows the exercise happened and what it found.
From £2,650 + VATBoard and executive governance sessions
What your board is now expected to know, in language that does not need an interpreter. Ends with the questions your board should be asking, and a record that the session took place.
From £2,400 + VATNHS: CAF-aligned DSPT
Independent work against the CAF-aligned Data Security and Protection Toolkit, for trusts, integrated care boards, commissioning support units, and the suppliers who hold their data. Where you stand, what evidence each outcome needs, and what to deal with before you submit.
Priced on scopeAI deployment review
Before you switch it on: what the deployment would actually expose, the oversight you need around it, and whether the automated decision rules in the Data (Use and Access) Act 2025 reach you.
From £3,200 + VATVirtual CISO and virtual DPO
Senior security and data protection judgement without the hire, and someone accountable for it. Either role on its own, or both together where the two questions keep arriving as one.
From £3,000 / month + VATIndependent assessment
A dated report against a defined control set that you can hand to a customer or an insurer.
Typically £3,200–£4,800 + VATIf you have no security function at all
Start with the free things
Plenty of UK businesses have nobody whose job this is. No security team, no budget for one, and a customer questionnaire sitting in somebody’s inbox. None of what follows costs anything, and none of it is a sales route.
- Where do you stand — a self-assessment you run yourself. No sign-up, and no call from us afterwards.
- The control set — every control we assess against, published in full, with the evidence each one requires. Work through it yourself if you would rather.
- Posters and policy templates — staff awareness material and starting-point policies, free to use under your own name.
- What Cyber Essentials actually asks — the questionnaire, the five controls behind it, and what it costs. Most organisations can pass it without paying anyone for help, and we say so.
- Copilot: free tier or paid — what each licence can reach inside your Microsoft 365, and the one question to settle before anyone switches it on.
If you reach the end of those and still want help, the small business page sets out what we do for organisations with nobody in the role, and what each piece costs. If you do not, that is a good outcome as well.
Documents, not consulting
The writing, already done
Some of what a board needs is not judgement. It is a document that should have existed for years and does not. You can buy those from us and never speak to us. No call, no discovery session, no licence that expires.
Full ISMS pack
Everything ISO/IEC 27001:2022 asks for, written out: policies, the Statement of Applicability, the risk method, the registers and the internal audit programme.
£795 + VAT 8UK overlay
The part the international toolkits leave to you. UK GDPR and the Data Protection Act 2018, the ICO clock, and the breach record under Article 33(5).
£245 + VAT 8EU overlay
For selling into the European Union from the UK. One management system, two regimes, without running the whole thing twice.
£245 + VATEvery document carries the date it was last checked and the law it reflects. When the law moves we reissue it and tell you what changed — a document with no date on it is a liability, not an asset.
Before you talk to anyone
Where do you stand?
Ten questions about whether you could show it, not whether you feel secure. Five minutes, no email required, and nothing you answer leaves your browser. You get the gaps back in the order we would fix them.
No mystery scoring
The control set, published in full
Thirty-six governance controls, what evidence satisfies each one, and what it maps to in UK law. We publish it so you can see what is being asked of you before you engage us, or work through it yourself if you would rather not.
Free, and nothing to sign up for
Where to watch
The five sources worth following if you are accountable for this in a UK organisation, and the board question that goes with each. UK regulators first, one international source, no newsletter.
Recognise any of these
What bad looks like
The seven failures we keep finding in UK organisations — the supplier nobody assessed, the account with no second factor, the backup nobody restored. Written as patterns rather than named companies, with the question a board should ask about each one.
Why anyone believes our answer
We never assess our own work, and never sell the fix for what we assess.
An assessment is only worth something if the person doing it has no stake in the result. If we have designed your controls or written your policies, we will not then turn round, assess you and tell the world you passed.
It costs us work. We think that is the point.
Latest briefings
What changed, what it means, and the question a UK board should ask next.
Start with a conversation
Tell us what has been asked of you and who is asking. We will tell you what we think it needs, and whether that is us. The first conversation is free and there is no obligation at the end of it.
Tell us about your organisation+44 161 391 1889
UK Cyber-Safe is based in Manchester. We work with UK organisations only.