Service · Most popular starting point
Find out what your AI assistant would expose before your staff do
Copilot, Gemini, ChatGPT Enterprise and the agents built on them do not break your file permissions. They inherit every one you got wrong, and turn a decade of quiet oversharing into something anyone can find by asking a question in plain English. The AI deployment review tells you what would surface, what oversight the law now expects, and what to fix before you switch it on — or before you widen a pilot that is already running.
From £3,200
plus VAT, fixed scope agreed in writing before we startNo day rates
3–4 weeks
from evidence received to walkthrough, for a single tenantTypical elapsed time
2 documents
a written report for the people doing the work, and a one-page summary for the boardWhat you receive
5 Feb 2026
the date the automated-decision duties in the Data (Use and Access) Act 2025 started to biteWhy now
Who this is for
Organisations of roughly fifty to a thousand people that are about to roll out an AI assistant across the business, or that have one running in a pilot and cannot say with confidence what it can see. It suits a board that has been asked to approve the licences and wants something better than the vendor's assurance, and an IT lead who suspects the permissions are not as tidy as the org chart suggests and would rather find out from us than from a staff member.
It is also the right first step if you have already had a near miss — someone asked the assistant a question and got an answer they should not have — and you need a dated record that the organisation looked, and what it did about it.
What we actually do
What the assistant can reach, using the access your people already have.
- Sharing and permission sprawl across SharePoint, OneDrive, Teams and shared mailboxes, tested rather than assumed
- Sample prompts run against a representative set of accounts, with what came back recorded
- Sensitive categories found in reach: HR, payroll, board papers, customer data, legal privilege
- Whether your labelling and data-loss controls actually change what the assistant returns
The policy, records and decisions the deployment needs around it.
- Whether the automated-decision duties in the Data (Use and Access) Act 2025 reach any of your intended uses
- What your data protection impact assessment must say, and whether one is required at all
- Acceptable-use rules for staff, written for the tools you actually run
- An AI system and agent register, so the board knows what is deployed and who owns it
Two documents and a dated position.
- A written report: findings with severity, evidence, and what to fix in what order
- A one-page board summary: the position, the three decisions only the board can take, and the date
- A minute-ready paragraph recording that the board considered it
- A re-check of the priority fixes, included, once you tell us they are done
What we do not do
We do not sell licences, we do not implement the fixes, and we are not partnered with any AI vendor. The review reports what we found. If the answer is that the deployment should wait, we say so, and that costs us nothing because we have nothing else to sell you at the end of it. If you then want the tenant tidied up, we can introduce a firm that does that work; we will not then assess the result ourselves.
What it costs
One tenant, one assistant, up to roughly a thousand accounts. The fee is fixed in the scoping letter and does not change afterwards.
From £3,200 + VATFixed scope
Larger tenants, more than one assistant, or an agent estate built on top of the assistant are priced on scope. You have the figure in writing before any work starts.
If you want to check where you stand before spending anything, the free Copilot readiness check takes ten minutes and gives you a written position.
FreeNo account, no email address
Before you switch on Copilot → · The AI rollout governance pack (£495 + VAT) is the document set we use, if you would rather run the review internally.
What actually happens, and when
First conversation
No charge and no obligation. We establish which assistant, how many people, what it is meant to do, and whether a review is worth doing yet. Some organisations are better served by the free readiness check first.
Within a week
A scoping letter with the fixed fee, what is in and out, and the access we need: a read-only reporting account and a small number of test accounts that mirror real roles.
Your effort
Allow four to six hours of your IT lead's time across the engagement, mostly at the start. Nobody else needs to be involved until the walkthrough.
Two to three weeks
We test exposure, review the oversight documents you already have, and draft findings. If we find something serious we tell you the same day rather than saving it for the report.
Walkthrough
An hour with the people who will act on it, and a separate twenty minutes with the board or its chair if wanted. You receive both documents that day.
Afterwards
The findings are yours. When the priority fixes are done, we re-test them and issue a dated confirmation, included in the fee.
Questions we are usually asked
We have not switched anything on yet. Is it too early?
No — that is the cheapest time to do it. Permission sprawl is far easier to fix before an assistant is indexing it, and the board can approve the rollout with a dated position in front of it rather than a vendor slide.
Do you need administrator access to our tenant?
No. We work from a read-only reporting role and a handful of ordinary test accounts you create for the purpose and delete afterwards. We never hold credentials for your live administrator accounts.
Will this cover agents, not just the chat assistant?
The base review covers one assistant. Agents that act on your behalf — booking, drafting, moving data — carry different risks and are scoped separately. Tell us what is planned and we will price both together.
Is this a penetration test?
No. Nothing we do goes near your firewalls or tries to break in. We use the access your people already have, which is exactly what the assistant will use. If you also need a technical test, that is a separate service delivered by our accredited partner.
Can you then help us fix what you find?
We will explain every finding and what good looks like. We do not do the implementation, because we would then be assessing our own work. That rule is on our about page and it does not bend.
There is no charge for the first conversation and no obligation at the end of it. If a review is not the right next step, we will tell you what is.