AI readiness assessment
Find out where AI is safe to start in your organisation, and leave with a prioritised plan your board and compliance team can act on.
Book an assessmentWho it is for
The assessment is for organisations that want to use AI, hold data they cannot afford to mishandle, and need a defensible place to begin. It usually starts with one of these:
- Staff are already pasting work into public AI tools, and nobody is sure what has gone where.
- Suppliers are pitching AI features, and you need to know what they would do with your data.
- The board has asked for an AI plan, and compliance needs to be able to stand behind it.
- A use case looks promising, but nobody can yet say whether the data can be used for it.
Research teams should also read private AI for life sciences.
What we review
A fixed scope review of four areas.
Data
Where your data lives, how it is classified, who owns it, and which of it is personal, special category or client confidential.
Infrastructure
Your cloud and on premises estate, identity, networking and any GPU capacity, and what a private platform could run on.
Security and compliance
Your policies and controls, the frameworks you report against, and what your regulator expects.
Use cases
The ideas your teams already have, gathered and described in enough detail to judge them.
Who we speak to and which documents we review are agreed in the scope, usually the people who own these areas and documents you already have, such as architecture diagrams, policies and risk registers.
How use cases are ranked
Each use case is ranked by value and by risk, side by side, so the plan favours work that is both worthwhile and safe to start.
Value
Time saved, quality gained, and how often the task comes up.
Data risk
How sensitive the data is, whether personal data is involved, and where it would have to be processed.
Consequence
What happens if an answer is wrong, and whether a person checks it before it is used.
Readiness
Whether the data is available, clean enough and owned by someone.
Scope, decisions and what you receive
In scope
- Data: where it lives, how it is classified, who owns it, and which of it is personal, special category or client confidential.
- Infrastructure: your cloud and on premises estate, identity, networking and any GPU capacity.
- Security and compliance: your policies, controls, the frameworks you report against and what your regulator expects.
- The use cases your teams propose, described well enough to judge.
Decisions required
What your organisation decides, with our advice:
- Which business areas and use cases the review covers.
- Who we speak to, and which documents we may read.
- Which data is off limits from the start.
- Who receives the findings, and how they are classified.
Delivered
- Written findings on your data, infrastructure and security position.
- Use cases ranked by value and by risk, with the reasons for each ranking.
- A prioritised plan, including where a private platform, a proof of concept or no AI at all is the right answer.
- The technical facts your data protection team needs to start a DPIA for the first use cases.
- A list of open decisions, each with its options and a suggested owner in your organisation.
Not included: building anything, legal advice, or the DPIA itself, which stays with your data protection officer.
Scope and fee are agreed in writing before any work starts.
How it connects to UK GDPR and your DPIA
The ICO expects organisations to carry out a data protection impact assessment before processing personal data with AI where the processing is likely to be high risk, and generative AI on personal data often is. It also expects a clear lawful basis, and clarity on who is controller and who is processor.
An assessment does not replace your data protection officer's judgement or legal advice. It gives them what they usually lack: an accurate technical picture of where the data would go, who could see it and what controls would apply.
What happens next
The plan points to one of three next steps:
- Test one use case first, when a single use case stands out and needs proving on your own data.
- Build the platform, when several use cases share the same documents and the case for a private platform is clear.
- Keep a senior architect on hand, when your own team or a supplier will build, and you want independent review.
Book an assessment.
Tell us which use cases you have in mind and which data worries you most. We will come back with a scope. Not sure what to ask? Start with a discussion brief.
Thank you. Your request is on its way. We will reply from info@tlgsolutions.co.uk to arrange a first discussion.
That did not send. Please email info@tlgsolutions.co.uk instead, and we will reply from there.