List the AI tools
Check where data goes
Agree what must change
You get data-use findings and conditions for approval.
Where AI data leaks
People paste things into AI. Confidential emails with their customers' names. Contracts. Entire spreadsheets. Sometimes they're logged into ChatGPT on their personal account, don't know the terms, and you have no idea what happened to that data afterwards.
Copilot can see more than you'd like. Documents marked sensitive get summarised for users who shouldn't have access, because Copilot shows people whatever they already have permission to see.
You don't know what your vendors are doing with your data. It's not always obvious if AI vendors train on prompts or if they store them, and if they do how long for. Sometimes this varies by plan, sometimes by config, and sometimes by region.
Your company's confidential info can be extracted through search or AI. If we build an index of your company's documents so staff can search them, then someone can prompt it with 'What are our engineers' salaries?', 'What are our executives' GP appointments?', 'What's the API key for production?'.
AI is susceptible to prompt injection. Data given to models can influence them in ways which expose confidential info.
Our audit will reveal what AI tools your business is using, how they're configured, and how data flows through them. Then, we'll match it to applicable legislation and provide a prioritised list of improvements.
What will you get?
AI data map: Where your AI is used, where data goes when used with AI, where it's stored, and who can access it.
Shadow AI sweep: Identify any AI your business isn't aware it's using. We'll also look at the impact of copy-pasting confidential info into third-party AI.
AI vendor audit: Check that your AI is configured to match how you think it's configured, and check AI vendors' terms of service against your needs.
Copilot scan: Check permissions and config to identify data exposures.
Specific processes: Happy to investigate particular processes or workflows, for example if you have a team using AI to make decisions.
Summary of applicable legislation: What your AI usage means for you, for example transparency and automated decision making requirements in Articles 22A to 22D added to UK GDPR by the Data (Use and Access) Act 2025.
Prioritised list of actions: Findings ranked by effort and risk, with pointers to how they could be resolved.
How it works
Kick-off call
Discovery: Review of configs, vendor ToS, AI-related logs, and a handful of staff interviews
Analysis against applicable legislation
Readout call with process owners
Report: Short, board-ready. We'll happily answer questions afterwards, or work with you to resolve issues.
Remediation support: We don't do implementation as part of the audit, but can scope a separate engagement to implement improvements alongside your engineers.
Frequently Asked Questions
How much does an AI data map and audit cost? We'll put together a proposal after a scoping call.
How long will it take? Depends on the scope, but most are done within a few days.
What if we have a DPO? Not all companies need DPOs, but where they're required by law, this audit could help them fulfil their responsibilities. We'll tell you during scoping if you need one, and can work alongside your DPO if you've got one.
What if we think we've been subject to a security breach? In that case, don't get an audit, get a lawyer. Security breaches take precedence over everything else and need to be notified to the ICO within 72 hours of becoming aware of it.
What about the EU AI Act? The Act has been generally applicable since August 2026, with high-risk rules following on later dates. We'll make sure your processes are compliant.
Can you do a pentest? We can identify risks in your AI's data flows, config, and regulatory compliance, but don't carry out tests to identify security risks.
How does this differ from a DPIA? Where required, a DPIA will be necessary, and our output could feed into one, but audits are much wider, identifying uses of AI that could be problematic, reviewing your vendors' data handling, and so on.
Who does the audit apply to? Any business. Particularly useful for leadership and compliance.
