AI Usage Audit
An AI usage audit shows which AI your firm already uses, and what data leaves
An AI usage audit is a structured review of which AI tools your people use, what data flows into them, what the vendor terms allow, and where AI output is relied on without review. It gives the chief executive one evidence-based picture of AI risk and opportunity, before a client, an insurer or the ICO asks for it.
30 minutes, free of charge. We respond within one business day.
- Evidence, not a surveyFindings come from logs and device data, checked against what staff tell us.
- Senior-ledThe consultant who scopes the audit runs it and presents it.
- Mapped to regulationEach finding is tied to UK GDPR, the EU AI Act or your sector regulator where it applies.
What does an AI usage audit cover?
Seven workstreams, scoped in writing before we start.
- 01
Shadow AI discovery
Shadow AI is the use of AI tools by staff without the organisation's approval or oversight. We find it through network, identity and device data, including browser extensions and AI features switched on inside software you already pay for.
- 02
Data flow mapping
We trace what goes into each tool: client documents, personal data, source code, financial records. Each flow is classified by sensitivity and by where the data is processed and stored.
- 03
Vendor terms review
We read the terms your staff accepted: whether prompts are used for model training, how long data is retained, where it is processed, and who owns the output.
- 04
Reliance on AI output
We identify where AI output reaches clients, decisions or filings without a human check. This is where hallucinated facts and fabricated citations become professional liability.
- 05
Regulatory mapping
Findings are mapped to UK GDPR, ICO guidance on AI and data protection, the EU AI Act where your AI reaches EU users, and sector expectations from the FCA, the SRA or healthcare regulators.
- 06
Controls and policy gap
We compare your current policy and technical controls, such as data-loss prevention, conditional access and DNS filtering, with what your exposure requires.
- 07
Risk-ranked register and roadmap
The deliverable is a register of every AI tool in use, a risk ranking of each finding, and a roadmap ordered by impact. It is written for the board, with the technical detail attached.
For organisations where the regulator will ask
The AI Usage Audit is built for regulated mid-market organisations where "we don't know" is not a defensible answer when AI use shows up in an inspection, a client questionnaire, or a contract review.
- Financial services and fintech
- Legal and professional services
- Healthcare and life sciences
- Accountancy and audit firms
- Insurance
- Regulated manufacturing
How does the audit run?
Three stages. The first conversation is free; the audit itself is a scoped engagement.
-
Consultation
A conversation with a senior consultant about the AI tools you know of, what you suspect, and what is driving the question: a client, a regulator, an incident or a board.
-
Discovery and analysis
We agree in writing which systems, teams and data types are in scope, then gather the evidence from network and identity logs, device data, a short staff survey and interviews.
-
Findings and roadmap
You receive the register, the risk ranking and a prioritised roadmap, and walk through them with the consultant who ran the audit. Many clients move straight into governance or implementation.
What do leaders ask before an AI usage audit?
Not answered here? Ask it on the call.
What is an AI usage audit?
An AI usage audit is a structured review that discovers which AI tools are in use across an organisation, what data flows into them, what the vendor terms permit, and where outputs are relied on without review. It produces a risk-ranked register and a remediation plan. It is the usual first step before writing an AI policy or investing in AI projects.
Why audit AI use now?
Adoption is running ahead of control. The Cyber Security Breaches Survey 2025/2026 (DSIT, April 2026) found that 31% of UK businesses were using, adopting or considering AI, and only 24% of those had cyber security practices to manage AI risk. You cannot govern or insure what you have not inventoried.
Is staff use of public AI tools a data protection issue?
It can be. Pasting client or employee personal data into a tool whose terms allow retention or training is processing under UK GDPR, and the firm remains the controller. The audit shows where that is happening and what to change.
Does the EU AI Act apply to a UK firm?
It applies where a UK firm places AI systems on the EU market, deploys AI in the EU, or produces AI output used in the EU. Article 50 transparency duties applied from 2 August 2026, and the AI Omnibus (Regulation (EU) 2026/1744, July 2026) moved stand-alone high-risk obligations to 2 December 2027. The audit tells you which of your uses, if any, fall in scope.
Will the audit disrupt staff or feel like surveillance?
No. Discovery relies mainly on logs and device data you already hold, plus a short anonymised survey and a few interviews. Findings are reported by role and team, not by named individual, and the aim is safe approved tools rather than blame.
What happens after the audit?
Most firms move to an AI policy and governance programme, approve a set of tools with the right settings, or start a first implementation project with milestones. Governance, monitoring and optimisation can then run as a monthly retainer, on its own or alongside managed IT.
Free consultation
Know what AI is doing inside your firm before anyone else asks.
A 30-minute call with a senior consultant about your AI exposure and what an audit would cover. We respond within one business day.
Or call 020 3886 3001 or message us on WhatsApp.
What happens next
- 01You tell us briefly what has landed on your desk.
- 02We respond within one business day to arrange a time.
- 03A 30-minute call with a senior consultant, and an honest view of what to do first.