AI services
AI Governance and Assurance
A written position for each workflow: what it runs on, where client data goes, and what you would show a regulator or a client if they asked.
The issue
The problem shows up differently depending on the firm. These are the questions we hear, in the words clients actually use, and the answer we would give in the room.
- Legal
What can we defend to the SRA, and to a client, if they ask where the prompt went?
- Accounting and finance
The demo went well. Nobody will put their name on the tool. What would they sign?
- Medical and scientific
Patient data sits in the way of every workflow. Which ones, if any, can actually run?
We write a clear position for each workflow, so a partner can sign something specific. The blocker on AI in regulated firms is almost never capability. It is confidentiality, data protection and professional obligation, together with the fact that nobody wants their name on a blanket approval. We map which work could run on what, where the data goes, and what evidence you would need if a client or a regulator asked. Some workflows are cleared. Several are declined. The refusals are what make the approvals usable.
This is AI consulting in the language a shortlist uses, and assurance in the language a risk committee uses. The output is written per workflow rather than as a general policy: the system it runs on, where the data goes, the engagement-letter language, and the evidence trail. The deliverable is something the people who have to sign can keep, not a slide deck.
How this looks in your firm
In a law firm, the question that stalls the partnership is what you would say to the SRA, and to a client, if they asked where the prompt went.
In an accountancy, the demo went well and nobody will put their name on the tool, so the useful output is something they would actually sign.
In a medical or scientific practice, patient data sits in the way of every workflow, and the honest finding is which ones, if any, can run.
Legal, accounting and medical feel that obligation first. Travel is not on this page for that reason, and we would rather say so than stretch the service onto a sector that does not feel the block.
If the firm will not name the workflows, we cannot start. The output is something the people who have to sign can keep and defend later, without us in the room.
What you get
These are the concrete things the engagement delivers, not only a report and an invoice.
A workflow list, a go or no-go for each item, and a written pack the partnership can keep.
For every cleared workflow: the system it runs on, the data path, the engagement-letter language, and the evidence trail.
For every declined workflow: the reason, in one paragraph a non-specialist can read.
Meetings with the people who have to sign. A slide deck is not the deliverable.
MeasurementHow we will know it is done
The review is done when the partnership has a list it can defend, including the things it will not do.
We do not measure this service in tools deployed.
We measure it in workflows with a written position, and in whether a partner can explain a refusal without us.
Typical elapsed time is six weeks from the first list to the pack.
If the firm will not name the workflows, we cannot start.
The output is something the people who have to sign can keep, not a principle on a poster.
Who this is not for
If you want a generic policy document, or you simply need someone to approve tools the firm has already bought, we are not the right firm. Some workflows will fail the review and we will say so plainly, so you should only commission this if you are prepared to hear that answer.
An example of this work
Wanted AI in the practice without breaching a single obligation
Multi-office accountancy group, eight offices. Anonymised.
The partners were not asking what AI could do. They were asking what they could defend to a regulator and to a client, which is a different question and a harder one.
Questions
Is this a legal opinion?
It is a written position a regulated practice can defend, prepared by a principal who is a UK legal practitioner with a background in data compliance. It is not a substitute for the firm's own general counsel, and we will say when a question needs them. The output is per workflow, not a general principle: what it runs on, where the data goes, what the engagement letter needs to say, and what evidence exists if anyone asks twelve months later. Partners can sign off a specific thing far more readily than a slogan.
Can we use public models at all?
Sometimes. The answer turns on what leaves the building rather than on which model it is. Five questions decide it: where the prompt goes, whether it is retained, whether it trains anything, what the engagement letter already says about third parties, and whether you could show a regulator the trail. A tool demonstration answers none of those, which is why the conversation in most partnerships stalls immediately afterwards. Some workflows clear. Several usually do not.
Why is travel and hospitality not on this page?
Legal, accounting and medical feel the obligation first, and that is who this service is for. Travel and hospitality have data duties of their own, and we will say so if a group in that sector asks. They are not the firms whose partners are currently blocked after a tool demonstration because they cannot defend the work to a regulator. Forcing this service onto a sector that does not feel that block would be selling the wrong thing, and we would rather point them at operations or measurement.