AI Governance & Compliance
Use AI confidently and stay on the right side of UK rules: ISO/IEC 42001, the EU AI Act and the NIST AI RMF, in plain English. Informed by DSIT's governance work.
Free 10-minute AI readiness check AI is already inside your business.
AI is already inside your business.
Who set the rules?
Microsoft has built it into the tools your team uses every day: 365, Copilot, Teams, Windows. It is switched on, drafting and deciding, often with client data, and in most firms no one governs any of it. We put plain-English guardrails around it, so you get the productivity without the exposure.
30+ yrs enterprise tech 10 governance dimensions ISO 42001 aligned
0
scanning
scanning · 10 governance dimensions
30+ years in enterprise technology & service management /award-winning leadership /ServiceNow & AI-governance specialists
Practices
What we do
Adopt, run and govern AI: across strategy, platform and discipline. Three connected practices, one team.
ServiceNow
Maximise your ServiceNow investment: the AI Control Tower, IRM/GRC and Now Assist. Run and govern AI where the work happens.
Enterprise Service Management & Process Design
Process re-engineering and service management beyond IT: the operating model that lets AI actually deliver.
AI Builds
We don't just govern AI. We build it.
Agents, custom CRMs, RAG assistants and workflow automation, with oversight and audit trails baked in from day one. The proof? Nim, the Claude-powered assistant inside our own CRM.
AI agentsCustom CRMsRAG assistantsWorkflow automation
Who's due for follow-up this week?
Nim3 contacts are due. Want me to draft Sarah's follow-up?
⚠ Send to [email protected]✓ ApproveDeny
Reads & drafts freely · every action confirm-gated & logged
0%
of UK AI adopters report improved workforce productivity
DSIT AI Adoption Research, 2026
0%
of AI-adopting firms report higher profits in the past year
Lloyds Business Barometer, 2026
0%
of businesses have not fully implemented an internal AI usage policy
techUK / Shoosmiths, 2025
0
governance dimensions we score you against, free
Nimble AI Governance Framework
AI Governance Services
A Ladder, Not a Cliff
Start with a free 10-minute scorecard, move to a fixed-price scope check, and build up to a full AI Governance Health Check, sector audits and ISO 42001 alignment, in proportionate steps.
Free
AI Readiness Scorecard
A free 10-minute self-assessment. Answer a handful of questions and we'll send a RAG-rated readiness score plus the next sensible step.
Triage
AI Exposure & Scope Check
A 30–60 minute call confirming whether the EU AI Act, Article 22, Equality Act exposure or sector regulators actually apply to you.
Baseline
AI Governance Health Check
We assess your business across ten governance dimensions using our ISO 42001, NIST AI RMF and EU AI Act-grounded methodology, with a prioritised, proportionate action list.
EU-Exposed
EU AI Act Rapid Audit
Risk classification, gap analysis and an action plan against the current EU AI Act timeline (high-risk now December 2027), for firms touching the EU market.
Article 22
Automated Decision-Making Audit
A focused audit for HR, recruitment, credit, insurance and pricing teams under the reformed DUAA 2025 rules, plus Equality Act bias.
Governance
ISO 42001-Aligned Framework
AI systems register, decision audit trails, transparency policy and human oversight controls, aligned to ISO/IEC 42001.
Policy
AI Use Policy Pack
A tailored acceptable-use policy, AI inventory, accountability assignments and Article 4 AI-literacy staff do's and don'ts. Delivered in around a week.
Build
Agentic AI Implementation
Move from AI that advises to AI that acts: built with governance, oversight and controls embedded from day one.
Shadow AI
78% of AI users bring their own AI tools to work. The risk is not the tool: it is the invisibility. See what your team is actually using, sanction it, and govern it.
Microsoft & LinkedIn Work Trend Index, 2024
Check your exposure
Where does AI put your sector at risk?
Tap your industry for an instant read on which UK rules bite today, which are conditional, and which are voluntary best practice.
👥Highest priority
HR & Recruitment
Auto-ranking CVs or AI shortlisting puts you squarely inside Article 22 and the Equality Act today.
DUAA 2025 — Article 22Hard duty · today
Equality Act 2010Hard duty · today
EU AI Act (high-risk)Conditional
🏦High priority
Financial Services
FCA/PRA SS1/23 model risk is your today-duty; Article 22 covers automated credit & pricing.
FCA/PRA SS1/23Hard duty · today
DUAA 2025 — Article 22Hard duty · today
EU AI Act (high-risk)Conditional
⚖️High priority
Legal
Document review & case triage AI carries confidentiality, privilege and UK GDPR duties today.
Confidentiality & privilegeHard duty · today
UK GDPR & DPIAsHard duty · today
DUAA 2025 — Article 22Conditional
🏥High priority
Healthcare & Life Sciences
The densest UK stack of any sector: MHRA, UK GDPR DPIAs and the ICO all apply today.
MHRA (SaMD)Hard duty · today
UK GDPR DPIAsHard duty · today
EU AI Act (high-risk)Conditional
🏭Highest priority
Manufacturing & Engineering
Your UK GDPR, Equality Act and NCSC duties apply today; the EU AI Act if you export.
UK GDPR & DPIAsHard duty · today
Equality Act 2010Hard duty · today
EU AI Act (high-risk)Conditional
🚚High priority
Logistics & Distribution
Scheduling & routing AI engages UK GDPR, the Equality Act and NCSC guidance today.
UK GDPR & DPIAsHard duty · today
Equality Act 2010Hard duty · today
EU AI ActConditional
🛍️Medium priority
Retail & eCommerce
Personalised pricing engages the Equality Act and UK GDPR; the EU AI Act is a benchmark.
Equality Act 2010Hard duty · today
DUAA 2025 — Article 22Conditional
EU AI ActVoluntary
🌾Emerging
Agriculture & Food
UK GDPR applies where AI touches people data; early governance is a competitive edge.
UK GDPRHard duty · today
ICO data & AI guidanceConditional
EU AI ActVoluntary
UK gov uses the EU AI Act as a benchmark
So the smartest move for UK SMEs is to adopt it voluntarily.
DSIT's AI Management Essentials work (a consultation draft, now shelved) was explicitly built on ISO/IEC 42001, the EU AI Act and the NIST AI Risk Management Framework. That says something important: those are the frameworks your own government chose as the reference points for responsible AI. Applying that risk-tiered approach isn't imposing foreign law; it's applying the framework UK policy itself references.
For purely domestic UK firms the EU AI Act is a voluntary best-practice benchmark, not a legal requirement, and we won't pretend otherwise. But adopting it now future-proofs you against wherever UK rules land, signals trustworthiness to customers, insurers and procurement teams, and means you're ready the moment you sell into the EU.
Your real, today, legal duties under UK law are different things: UK GDPR, the reformed Article 22 rules in the Data (Use & Access) Act 2025, the Equality Act 2010, and your sector's regulator. We map both layers for you.
Specialist. Industry-aware. Fast. And we lead with enablement, not fear.
75%
of UK AI adopters report improved workforce productivity
54%
of UK SMEs are actively using AI, up from 35% a year ago
61%
of firms have not fully implemented an internal AI usage policy
10
governance dimensions we score you against in the free initial readiness scorecard
Start where you are
Take the Free 10-Minute Scorecard
Answer a handful of questions about how your business uses AI. We'll send a RAG-rated readiness score, tell you which UK rules and voluntary frameworks actually apply, and recommend a sensible next step. No obligation, no sales pitch.