AI Services
AI governance and security services for UK organisations
Your people are probably using AI already. We help you find out where, set the rules, test what you build or connect, and evidence it for your board, auditors and customers, with one partner accountable throughout.
Book an AI services consultation
Want to talk through how AI is used in your organisation? Book a free consultation and we will give you recommendations and clear next steps, with no obligation to buy.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
The short version
What AI governance and security services are.
AI governance and security services help an organisation find where AI is used, set the rules for it, test the AI it builds or connects to its data, and keep the evidence for its board, auditors and customers. Threat Protect selects and oversees the specialists who do this work and is the client’s single point of accountability.
What we help with
Eight services, one partner accountable.
Govern the AI your people use
Most organisations start here, because staff are usually using AI before anyone has set the rules.
AI inventory and shadow AI
Find out which AI tools and features are in use, including those inside software you already buy, and give each one an owner.
AI governance consultingAI policy and acceptable use
A short policy covering approved tools, what data must stay out of them, and when a person must check the output.
What an AI policy includesCopilot and generative AI readiness
Check permissions, data and rules before a rollout, so a new assistant does not surface what people should not see.
Seven questions before a rolloutManage the risk
Not every use of AI carries the same risk, so the controls should not be the same either.
AI risk assessment
Classify each use by what could go wrong, who could be affected and which rules apply, so that controls match the risk.
AI supplier risk
Ask your suppliers the right questions about the AI in their products, then record the answers in your supplier assurance.
Secure the AI you build or connect
A chatbot or assistant connected to your data is part of your attack surface and needs testing like any other system.
AI application testing
Independent testing of AI and LLM applications through CREST accredited partners, including prompt injection and data leakage.
Penetration testingProve it
Customers, auditors and regulators increasingly ask for evidence rather than assurances.
ISO 42001 readiness
Build an AI management system and get audit-ready. Certification is delivered through certified assessment partners.
How ISO 42001 certification worksEU AI Act preparation
Work out whether the Act reaches you and prepare for the obligations that apply, including from the UK.
EU AI Act timelineWhere to start
Start from your situation
| Your situation | Start with | What you get |
|---|---|---|
| Staff are using AI and nobody has set the rules | AI inventory and AI policy | A list of what is in use, with owners and clear rules |
| You are about to roll out Copilot or a similar tool | Copilot and generative AI readiness | A list of what to fix first, and agreed rules for use |
| Suppliers keep adding AI to their products | AI supplier risk | Recorded answers in your supplier assurance |
| You have built a chatbot or connected AI to your data | AI application testing | Prioritised findings, a fix plan and a retest |
| A customer or the board is asking for proof | AI risk assessment and ISO 42001 readiness | An evidence pack and an audit-ready management system |
| You serve users or customers in the EU | EU AI Act preparation | A read on your scope and the gaps to close first |
Related
Copilot and generative AI
Get ready before the rollout
An AI assistant makes it easier to find whatever a person can already open. Microsoft 365 Copilot, for example, works within existing permissions, so files that were overshared and forgotten become much easier to surface. The risk usually comes from the permissions, not the tool.
- Who can see what, and where files are overshared
- Whether sensitivity labels and retention rules are in place
- Which uses are approved, and when a person must check the output
- What to fix before rollout, and what can follow afterwards
AI supplier risk
The AI you did not choose to buy
Suppliers are adding AI features to software you already use, sometimes switched on by default. These features belong in your inventory and your supplier assurance, like any other change to how your data is handled.
- Which AI features are in the product, and can they be switched off?
- Is your data used to train models?
- Where is the data processed, and which third parties are involved?
- How will the supplier tell you when this changes?
AI application testing
Testing the AI you build or connect
A customer chatbot, an internal assistant or an agent connected to your documents needs testing like any other application, plus testing for how AI fails. Testing is carried out independently, through CREST accredited partners, and the findings feed into how you govern AI across the organisation.
- Prompt injection
- Leakage of data the model can see
- Unsafe handling of what the model returns
- AI features and agents with more permissions than they need
Related
Rules and standards
Which rules and standards apply
The UK has no single AI act. The UK government has published a voluntary Code of Practice for the Cyber Security of AI, and existing duties such as UK GDPR and your sector regulator’s expectations still apply when AI is involved. The EU AI Act can reach UK organisations that serve the EU market. ISO 42001 is a voluntary, certifiable standard that buyers increasingly ask about, and it is not, on its own, legal compliance with the Act.
FAQ
Questions buyers ask
Short, straight answers to what boards and buyers ask most. Still need a steer on your own situation?
Book a call More on AI governance consulting- They help an organisation use AI safely: finding where it is used, setting rules for it, assessing the risk, testing the AI it builds or connects to its data, and keeping evidence for its board, auditors and customers. Governance covers the rules and accountability. Security covers whether the AI holds up under attack.
- Yes, usually in a lighter form. Buying AI rather than building it avoids most application testing, but you still need to know who is using what, what data goes in and who checks the output. An inventory and a short AI policy are normally the right first step.
- Mainly who can see what. Microsoft 365 Copilot can surface anything a user already has permission to open, so overshared files become easier to find. An assessment reviews permissions, sensitivity labels and retention, agrees rules for use and sets out what to fix before rollout.
- Specialist testers try to make it misbehave: prompt injection, leaking data the model can see, unsafe handling of what the model returns, and AI features given more permissions than they need. The OWASP Top 10 for LLM Applications is the usual baseline. We arrange this through CREST accredited partners.
- Ask each supplier which AI features are in the product, whether they can be switched off, whether your data is used to train models, where it is processed and which third parties are involved. Then add the answers to your supplier assurance and review them at renewal.
- Vetted specialist partners. Threat Protect selects them, oversees delivery and stays accountable to you, so you deal with one team. Certification audits are carried out independently by certification bodies, and Threat Protect does not issue certificates.
- No service can promise that on its own. We help you build audit-ready AI governance and prepare for the Act, and ISO 42001 is a strong foundation, but it is not legal compliance with the Act. Questions about your legal position are for your legal advisers.
- Price on application. Cost depends on how many AI uses are in scope, whether you build or only buy AI, how many systems need testing and how much governance you already have. A short call is enough for us to give you a quote.
Find out where AI is already in your organisation.
Tell us how AI is showing up in your organisation. We’ll tell you where to start, and which specialists fit.
Book a call