AI consultancy in Oxford
TLG Solutions is an AI consultancy based in Oxford. We help research led organisations, spinouts and regulated teams take AI from a promising prototype to a private service they can run, assure and put in front of a reviewer.
Book an assessmentPrivate AI for Oxfordshire organisations
Oxfordshire's economy runs on research, specialist knowledge and confidential work. That makes it full of documents worth searching with AI, and full of documents that must not leave the organisation. Our work sits between the two: private AI platforms that let your people use language models on sensitive material, inside the cloud or data centre you already control.
The situation this page is about is a common one: a prototype that works, built quickly, and a partner, customer or investor asking how it is run and where the data goes. Oxford is one of the UK's leading universities for spinout companies, and the science and technology parks around it, from Begbroke and The Oxford Science Park to Milton Park and Harwell, are home to many research led companies.
From prototype to operated platform
A prototype proves an idea. An operated platform is something your organisation can rely on, defend to a reviewer and keep running when the person who built it is busy. Between the two sit ten decisions: five before real data comes in, and five before people rely on the result.
Dashed lanes run outside your estate. Solid teal lanes run inside it. Each diamond is a decision someone in your organisation owns.
Data
Prototype: Sample files in a public tool. Pilot: Real documents, one team. Operated: Every source, its permissions.
Before real dataWhich data may it read, and on what basis? Classify the documents, check the agreements they came under, and record the lawful basis for any personal data.
Before people rely on itWhich sources, under whose permissions? Every connector is listed, and search returns only what the person asking could already open, tested with accounts that should be refused.
Access
Prototype: One shared login. Pilot: Your sign in, one group. Operated: Roles and partners scoped.
Before real dataWho signs in, and through what? Your identity provider and your conditional access rules, with no shared accounts.
Before people rely on itHow do partners get scoped access? Guests in your identity provider, scoped to named collections, removed when the work ends.
Model
Prototype: A public model API. Pilot: Model on your compute. Operated: Versions under change control.
Before real dataYour compute, or a managed model service? A model on compute you control keeps prompts and answers inside. A managed model in your own subscription and UK region is a crossing to assess: prompts and the passages sent with them are processed by the provider's model in that region, under your agreement.
Before people rely on itWho approves a model change? A new model or version goes through your change process and is tested against the same questions.
Running
Prototype: A notebook on one laptop. Pilot: Built as code. Operated: Monitored, patched, restorable.
Before real dataWhich subscription or data centre hosts it? It is built as code in an environment you own, so it can be rebuilt without the person who wrote it.
Before people rely on itWho is on call when it fails? Monitoring, patching, backups and a tested restore have named owners before anyone depends on it.
Evidence
Prototype: A demo and some slides. Pilot: Measured, written up. Operated: A pack reviewers have read.
Before real dataWhat must the pilot prove? Agree the questions, the people who judge the answers, and the result that means continue, change or stop.
Before people rely on itWhat will reviewers ask to see? The architecture pack, the decisions record and the test results, read by your security team before go live.
Most teams find two or three of these already answered and one or two that nobody owns. A proof of concept is the usual way to settle the first five on your own data; a platform build settles the rest.
Five decisions research led teams face
These come up again and again in spinouts and research led organisations. Each is a decision for you to make, with the facts set out, not a technology choice we make for you.
Protecting research IP
The situation
Lab reports, draft papers, assay results and invention notes are the most useful things to search and the most damaging to leak. Public AI tools are already open in someone's browser.
The decision
Which documents may be read by a model at all, which only by a model on compute you control, and how you will know if anything left.
Start with
An AI readiness assessment, which classifies the documents before anything is built.
Giving partners and collaborators access
The situation
Research is shared. A pharma partner, a hospital group or a university lab needs answers from the platform, but only from the material their agreement covers.
The decision
Whether partners sign in through your identity provider as guests, which document collections each can reach, and what happens to their access and their data when the collaboration ends.
Start with
A proof of concept with one partner and one collection, so the permission model is tested before it is scaled.
Moving from a demo to an operated platform
The situation
The prototype runs on a public model API and one person's cloud account. It impressed the room. Nobody is on call for it.
The decision
Where it runs from now on, who owns it, how it is changed, patched, backed up and restored, and what it costs to keep running.
Start with
A private AI platform build, delivered as code in your own subscription or data centre.
Preparing for investor and customer review
The situation
An enterprise customer sends a security questionnaire, or an investor's technical adviser asks for the architecture. Buyers now ask AI suppliers which models sit in the request path, whether customer data trains anything, and whether any certification covers the AI features themselves.
The decision
What you can show today, what you can truthfully answer, and what must be built or written down before you answer.
Start with
An AI Solution Architect retainer, for the design review and the documents a reviewer reads. Our architecture pack shows the headings.
Handling sensitive datasets
The situation
Some of the data is personal, some is patient level, and some came from a collaborator or a university group under an agreement that says what it may be used for.
The decision
Which datasets the platform may never touch, which it may read only after pseudonymisation, and which stay in their own secure environment with only approved outputs leaving.
Start with
An AI readiness assessment. Life sciences teams should also read private AI for life sciences.
Five sectors, five boundaries
Five kinds of regulated work, each with its own line that data must not cross. The detail is on our regulated industries page.
Research and higher education
Universities, research institutes and the groups and companies around them hold unpublished work, grant documents and study data shared under agreement.
The boundary: each project sees only its own collection, and access ends when the project does.
Life sciences
Biotech, diagnostics and research teams across the county work with study data, research documents and collaborator material.
The boundary: collaborators see only their own collection, and we propose keeping patient level data out of scope.
Legal teams
Oxford's legal practices advise research organisations, their commercial partners and private clients.
The boundary: a search should only return what the person asking could already open in the matter file, and that is tested before anyone relies on it.
Finance
Wealth managers, insurers and finance teams along the Thames Valley hold client and transaction records.
The boundary: the model and its logs sit inside arrangements your outsourcing and resilience rules already cover.
Energy
Energy research and engineering organisations in south Oxfordshire hold drawings, inspection records and operational data.
The boundary: the platform lives on the IT side, and operational networks only ever send data out to it.
Working across Oxfordshire and the Thames Valley
We are based in Oxford and work with organisations across Oxfordshire, the Thames Valley and the rest of the UK. Much of the work can be done remotely and securely. Being nearby makes in person workshops and site visits easy to arrange where they help.
If it would help, we can work through the decision map above with your team in person, and leave you with it filled in.
Where to start
AI readiness assessment
Find where AI is safe to start.
Proof of concept
Rebuild one use case on your own data, with the controls you would need later.
Private AI platform build
A platform in your own cloud or data centre, delivered as code.
AI Solution Architect
Senior architecture and the documents a reviewer reads.
Bring us the prototype.
Tell us what it does, where it runs and who is asking about it. We will come back with the decisions that matter first.
Thank you. Your request is on its way. We will reply from info@tlgsolutions.co.uk to arrange a first discussion.
That did not send. Please email info@tlgsolutions.co.uk instead, and we will reply from there.