AI policy · Governance and standards
How we use, build, and govern AI both inside the consultancy and inside the systems we ship for clients. Effective 28 May 2026.
Standards we align with
Alignment means our practice is built to satisfy these standards. Certification, where stated, means an external body has audited us against them. We are explicit about which is which.
Management-system standard for the responsible development and use of AI. We align our internal AI governance with its lifecycle, risk, and continual-improvement requirements.
Information security management. The control baseline for how we hold client data, including data that flows through AI workflows.
Govern, Map, Measure, Manage. We use the framework as the structure for risk assessment on every AI workflow we ship.
We treat the EU AI Act's risk-tiering as a baseline for any client deployment that touches EU users or operators, regardless of where the client is headquartered.
We track UK government guidance on AI safety, evaluation, and deployment and apply the relevant guidance to high-stakes workflows.
Prompt injection, sensitive information disclosure, supply chain, model denial of service, and the rest. Every LLM workflow we ship is reviewed against the current list.
Personal data inside AI pipelines is governed by the same lawful-basis, minimisation, and rights regime as any other personal data we process.
Eight principles inside every AI workflow we ship
Principle 01
Any decision that touches money, people, regulatory compliance, or clinical context requires human review before action. No exceptions. The human review step is built into the workflow, not bolted on afterwards.
Principle 02
Client data is sent to third-party models only when necessary, only with written consent, and only with the smallest scope that delivers the outcome. Where a self-hosted or smaller model can do the work, we use it.
Principle 03
Where facts matter, we prefer retrieval over open generation. Sources are cited so the user can verify in one click.
Principle 04
Every AI workflow logs inputs, outputs, model versions, costs, and human review decisions. Audit-grade retention configurable per engagement.
Principle 05
Workflows that produce decisions affecting people receive a documented bias and harm review before launch and on every material change.
Principle 06
Every workflow has a documented kill-switch and a rollback path. No AI system we ship is load-bearing in a way that cannot be undone.
Principle 07
Token, inference, and orchestration costs are tracked per workflow and reported back. Clients always know what each workflow costs to run.
Principle 08
Model providers and third-party AI vendors are reviewed for data-handling practices, training-data position, security posture, and incident history before we route any client data to them.
Inside the consultancy
Your rights as a client
We have answered most variants of it before. Send the question and you will have a plain-English answer in writing.