For Organisations that want to govern AI use
Your org uses AI. You just don’t know how.
Your staff are already using ChatGPT, Copilot and a dozen tools nobody signed off. Nobody can say what’s running, or what happens to the client data going into them.
Then a customer’s procurement team sends a due-diligence questionnaire, and the deal waits behind it until you can answer in writing.
“The organisations that can prove control close the deal, pass the audit, and get asked fewer questions next time”
– Alan Bates, Founder, 10 Kinds
![map[class:max-w-full mt-8 object-cover object-center rounded-4xl src:images/hero.jpg]](https://www.10kinds.co.uk/images/hero.jpg)
Does AI governance apply to you?
Two reasons it might, and most organisations have both. Some AI use carries legal duties. The rest gets asked about anyway.
You may have legal duties
- You place AI-enabled products or services in the EU market, or your AI outputs are used there
- Your AI speaks to customers, or generates content you publish under your name
- AI touches client data, personal data, or anything commercially sensitive
Either way, someone will ask
- A customer, insurer or regulator has ever sent you a security or AI questionnaire
- You sell software or services to enterprise or regulated customers
- Staff use ChatGPT, Copilot or another AI tool, with or without a policy covering it
- Your board has asked what AI the business is running, and what happens if it goes wrong
Even if you answered no, you still have work to do
UK GDPR already binds how you use AI the moment personal data is involved, and it almost always is. Someone pasting a customer email into ChatGPT is a processing decision nobody approved, in a tool nobody checked.
Potential fines
€15m / 3% turnover
for breaching the EU AI Act’s transparency rules, law since 2 August 2026. But most internal AI use triggers none of them.
Source: EU AI Act, Article 99
Shadow AI usage
71%
of UK employees have used AI tools at work without approval, and 51% do so every week.
What the EU AI Act really requires
The transparency rules in Article 50 apply since 2 August 2026. They’re narrower than most of the coverage suggests, so here’s the plain version of what they require and who they bind (this isn’t legal advice).
2 August 2026
Article 50 transparency obligations apply from this date
The four transparency duties
AI you talk to
Providers of AI systems that interact directly with people have to build them so those people know they’re dealing with an AI, unless that’s already obvious.
AI-generated content
Providers of systems that generate synthetic audio, image, video or text have to mark the output in a machine-readable format so it can be detected as artificially generated.
Emotion recognition
Deployers of emotion recognition or biometric categorisation systems have to tell the people exposed to them that the system is running.
Deepfakes and public-interest text
Deployers have to disclose deepfakes, and label AI-generated text published to inform the public on matters of public interest.
What Article 50 doesn't reach
Using Copilot or ChatGPT internally to draft documents triggers none of the four. Article 50 governs what you tell people when they’re seeing or speaking to AI. The obligations that do reach internal use come from UK GDPR, and from the customers whose due-diligence questionnaires ask harder questions than Article 50 does.
So what do we do about it?
We don’t tell you your legal classification. That’s a question for a solicitor, and you’d be right to want it in writing from one.
What we build is the machinery underneath: the AI inventory, the risk process, the documentation and the human oversight controls that Article 17 would require of you if you turn out to be in scope, and that a customer’s questionnaire asks for either way. When the legal answer arrives, you’re not starting from zero. With the high-risk obligations now deferred to 2 December 2027, there’s runway to build it properly rather than in a panic.
Source: European Commission guidelines on Article 50, adopted 20 July 2026
Where the pressure comes from
Four sources, and most organisations are carrying all four at once. Each one boils down to the same two questions: what AI is running here, and what happens to the data once it gets there.
The stalled deal
A customer's procurement team sends an AI due-diligence questionnaire, and the deal sits behind it until you can answer it in writing.
Shadow AI
Staff pasting corporate & client data into consumer AI tools, with no register of what's being used or where the data goes.
Vendor risk
Every AI-enabled tool you've brought in carries the vendor's governance gaps as well as your own.
Regulatory exposure
UK GDPR already binds how you use AI, with or without the EU AI Act in play. The ICO doesn't need Brussels to enforce it.
We can help you get in control so...
- A due-diligence questionnaire arrives and you answer it the same week, not the same quarter
- Your board can confidently state your AI exposure
- You know every AI tool in use across the business, and what each vendor does with your data
- The controls, records and oversight are in place and evidenced, whichever way your regulatory classification goes
Let's talk and start your journey. Book a free call
What a due-diligence questionnaire typically asks
These are the five questions almost every AI due-diligence questionnaire is built around, whatever words it uses to ask them.
Do you know what AI is in use across your business, including tools nobody signed off?
Is there a human in the loop for decisions that affect the customer, and is that documented rather than assumed?
What happens to the customer's data once it touches an AI system, and does any of it leave your control?
If something goes wrong, is there a known process, or does it get handled ad hoc?
Who is accountable for AI risk internally, by name, not by department?
Answer those five with confidence and you can answer most of what's in a typical questionnaire.
Get the free checklistWhat the work involves
Governance is the Discover and Foundations part of how we work. Find what’s running, change how people use it, then build the evidence.
Find where AI is being used
Sanctioned tools are the tip of it. We run a use-case inventory across your business, including the shadow AI nobody officially approved, so you have one accurate register instead of a guess.
Agree the rules
We write the acceptable use policy, then run the workshop that gets leadership to sign off on it. What’s approved, what’s off-limits, what needs a human, and who owns the call.
Change how people work
A policy nobody has been taught changes nothing. This is where the value is unlocked: everyone trained, desk to board, on what’s allowed and how to use these tools well. It’s also the competence an auditor asks you to evidence. How training works.
Get ready for the questions you'll be asked
A customer’s due-diligence questionnaire, a regulator and an auditor all ask the same underlying thing: can you show this is controlled? We run our ISO/IEC 42001 gap assessment and build the inventory, records and oversight controls that answer it, whichever way your regulatory classification goes.
Manage the risk your suppliers bring in
Most organisations don’t build AI, they buy it. You get a third-party and vendor risk assessment covering every AI-enabled tool you’ve bought, including the exposure that never shows up in your own audit.
Keep it running
A management system needs internal audit, management review and fresh evidence every year. You get all three on an annual cycle, plus surveillance audit prep, so the next visit isn’t a scramble. We stay on as the retainer rather than handing over a folder that goes stale.
What this gives you
- An AI inventory covering every tool in use, including the shadow AI
- An acceptable use policy your leadership has signed
- Staff and board trained on the policy, not just handed it
- Controls and documentation mapped to ISO/IEC 42001
- A third-party risk view across every AI-enabled tool you’ve bought
Governance is usually the first step. Once your people are working differently and the evidence is in place, we build the tools and workflows that make AI pay.
Three things we're clear about upfront
We don't give legal opinions
Your regulatory classification is a question for a solicitor, and you should want it in writing from one. We build the inventory, risk process, documentation and oversight controls that hold up whichever way the answer goes, and hand you the short list of questions worth paying a lawyer to settle.
We don't certify anyone
Certification is done by an accredited certification body, and no consultancy can both advise and certify. We build the management system and get you ready for that audit.
We only use frameworks that apply to you
ISO/IEC 42001, the EU AI Act and UK GDPR/ICO guidance. We leave out NIST's AI RMF because it's US-focused and adds little to a UK engagement. A longer framework list isn't a better one.
Governance engagements
Each one is a fixed price against a written scope agreed before we start. Stop after any of them. Training is priced separately on the [training page](/training/).
Govern
1 AI Discovery Most popular What AI are we running, and where would it pay? Where AI is already being used across your business, where it should be, and whether your organisation can adopt it. From £5,000 Typically 1-2 weeks +
- A map of AI use across the business, including what nobody officially approved
- A ranked shortlist of where AI would pay
- Risk register covering data, suppliers and regulatory exposure
- A straight go/no-go on what to do next
2 AI Policy & Sign-off What are we allowed to do? What your organisation permits, decided and signed by your leadership. This sets the rules. Proving you follow them is the next engagement. From £3,500 Typically 1-2 weeks +
- Acceptable use policy: what's approved, what's off-limits
- Which decisions need a human, and at which point
- A named owner for every area of AI risk
- Facilitated leadership session ending in sign-off
- Board-ready policy document
3 Gap Assessment How far off are we from proving it? Where your controls stand against ISO/IEC 42001, clause by clause, and what it would cost to close the distance. Rules on paper are one thing; this tests whether you could evidence them to an auditor. From £4,500 Typically 2 weeks +
- Your existing controls mapped against ISO/IEC 42001, clause by clause
- A written gap list, ranked by what a customer or auditor asks about first
- Your AI inventory tested against what the standard asks for, or a first one built if you haven't got one
- The regulatory questions worth putting to a solicitor, and the ones already settled
- A remediation plan with the work costed, so the next decision is yours
4 Compliance Readiness How do we close the gaps? The remediation itself, scoped against the gaps we found rather than guessed at before we started. Quoted from your gap assessment A few weeks +
- The inventory turned into a live register, with an owner and a review cycle
- Controls and documentation mapped to ISO/IEC 42001
- AI Act-aligned controls and documentation, built to support your classification once it's confirmed
- Human oversight and incident handling you can point an auditor at
- Audit trail and evidence design
- Certification-ready documentation
Our commitments
Fixed scope, fixed price
Each engagement is quoted at a fixed price against a scope agreed in writing before we start. No day-rate creep, and no surprise on the invoice.
Named deliverables
You get the documents listed on each engagement at the end of it, so you can put them straight in front of a customer, an auditor or your board.
Start anywhere, stop anywhere
Nothing here is a bundle or a prerequisite. Come for training, a prototype or a retainer on its own if that's what you need, and stop whenever you're done.
Confidential from the first call
Everything you tell us stays between us, on the free call as much as in a paid engagement, and we'll sign your NDA beforehand if you'd rather have it in writing.
Free download
Start by finding out where you are today
Twelve questions every leadership team should be able to answer about the AI already running in their business. It covers similar ground to a paid discovery engagement, condensed into something you can work through yourself in about ten minutes.
- Twelve questions across visibility, policy, suppliers, regulation and evidence
- Plain English, written for a leadership team rather than a compliance department
- A scoring note telling you what your answers mean
Questions
We were sent a customer due-diligence questionnaire about our AI. Can you help? +
That’s the most common way people find us. Book a free call and bring it with you: we can discuss it, and what it would take to close the gaps.
We don't build AI ourselves, we just use tools like ChatGPT or Copilot. Does this still apply? +
Yes, though usually not because of the EU AI Act. Article 50’s transparency duties mostly bind the people who build and supply AI systems, and drafting documents internally with Copilot triggers none of them.
What reaches you is UK GDPR, your customers’ due-diligence questionnaires, and the risk sitting in tools you’ve bought in: an unmanaged register of AI use, a policy nobody’s read, a vendor whose own controls you haven’t checked. That’s the ground we cover.
Will you tell us whether we're a high-risk provider under the EU AI Act? +
No. Your legal classification is a question for a solicitor, and you should want that answer in writing from one rather than from a consultancy.
What we do is build the machinery it depends on: the AI inventory, the risk process, the documentation and the human oversight controls. That work is useful whichever way the classification goes, and a customer’s questionnaire asks for it either way. We’ll also hand you the specific questions worth putting to a lawyer, so the legal spend is short and targeted.
Is this just data protection with an AI label on it? +
There’s real overlap. UK GDPR already covers a lot of what ‘AI governance’ means in practice. We’re clear about where your existing data protection work already answers the question, and where AI adds a distinct one.
Do we need to be ISO 42001 certified? +
Not necessarily. Certification only pays off if you’re regularly asked to prove it, most often because a customer’s procurement team demands it. We’ll give you a straight read on whether it’s worth pursuing or whether a lighter governance setup covers your actual risk.
We'd rather not advertise how messy this is. Is what we tell you confidential? +
Yes. Everything you tell us stays between us, on the free call as much as in a paid engagement, and we’ll sign your NDA before the first conversation if you’d rather have it in writing.
Nobody gets named in a case study, a talk or a post without asking you first. Most of what we’re shown is the same handful of gaps we see everywhere, so there’s nothing to be embarrassed about in any case.
What happens to our data while you're working with us? +
We work from the minimum we need to do the job, on our own equipment, and we hand back or delete what we hold at the end of an engagement.
Your documents and business data never get fed into public AI models to train them. Anything we build for you runs on infrastructure scoped to your organisation and sees only the data you point it at.
Does training count towards ISO 42001? +
It contributes. ISO/IEC 42001 asks you to show the people working with AI are competent to do so, and training is how you get there. Keeping the records is your side of it, and we’ll tell you what to keep. Training alone doesn’t get you certified, and nothing we do makes the certification decision for you.
How do we get started? +
Book a free 30-minute call. If a questionnaire’s what brought you here, bring it along and we can discuss it. We’ll give you a straight read on where you stand and what the right next step looks like.
Start with a conversation
Half an hour on where you stand: what AI is running, how well your people use it, and what would be worth automating. Bring a customer questionnaire if that’s what brought you here.
You'll leave with a clear position on where you stand and what to fix first, whether or not you hire us.