ServicesStrategy & advisory
AI Assessment
An independent review of the AI your business runs or is about to launch. We test it for fairness, security, compliance and performance, on any model and any platform, and tell you plainly what to fix first.
AI rarely fails in the model. It fails in the data it reads, the permissions it inherits and the process nobody wrote down. An assessment looks at all of it, before your customers, regulators or auditors do.
60%
of AI projects unsupported by AI-ready data will be abandoned through 2026, Gartner predicts.
Gartner, February 2025What we assess
Each lens answers a question your board, your customers or a regulator could ask tomorrow. Choose one to see what we examine.
What we examine
What you learnWhere your AI could treat people unfairly or mislead them, and which safeguards close the gap.
What we examine
What you learnHow an attacker, or a curious employee, could get your AI to do or reveal something it shouldn't.
What we examine
What you learnWhich obligations apply to each use case, and the evidence you're missing to show you meet them.
What we examine
What you learnWhether your AI is accurate, fast and affordable enough to scale, and where it will break first.
Coverage
Most AI problems sit around the model, not inside it. Every assessment covers six layers, and each lens goes deepest where its risks live.
Any model, any platform
Models from providers such as OpenAI, Anthropic, Google, Meta and Mistral. Platforms such as Amazon Bedrock, Google Vertex AI and Azure AI Foundry. Open-source and custom models. And AI built into the software you already use, from Microsoft 365 Copilot and Copilot in Dynamics 365 to your CRM, service desk and HR tools.
| Layer | Responsible AI | Security | Compliance | Performance |
|---|---|---|---|---|
| People & processWho uses it, who signs off, who steps in | Deep | Checked | Deep | Checked |
| Interface & promptsWhat users see, type and are told | Deep | Deep | Checked | Checked |
| ModelBought, fine-tuned or built in-house | Deep | Checked | Checked | Deep |
| Data & retrievalTraining data, documents, knowledge bases | Deep | Deep | Deep | Deep |
| Access & permissionsWhat the AI can reach on a user's behalf | Not in scope | Deep | Deep | Not in scope |
| Infrastructure & integrationsHosting, APIs and connected systems | Not in scope | Deep | Checked | Deep |
How it runs
An indicative plan for a full assessment of two or three AI systems. A focused review of one system usually takes one to three weeks.
We list every AI system in scope, its owner, the data it touches and its likely risk class, and agree how we'll test.
Week 1
We review designs, policies, data sources and logs, and talk to the people who build, run and rely on the system.
Weeks 1–3
Adversarial prompts, bias and accuracy test sets, permission checks and load tests, in a non-production environment wherever possible.
Weeks 2–5
Each finding is rated by impact and likelihood, backed by evidence and paired with a practical fix.
Weeks 4–6
An executive briefing, then a working session with your teams to agree owners and dates for every fix.
Week 6
Deliverables
Frameworks
We don't invent our own yardstick. Findings are mapped to recognised frameworks, so your legal, risk and audit teams can use them straight away.
FAQ
Can't find what you're looking for? We're happy to talk it through.
Ask us a questionAn AI assessment is an independent review of the AI your organisation uses or is about to launch, such as chatbots, assistants, agents and predictive models. We examine it through four lenses (responsible AI, security, compliance and governance, and performance) and give you a scorecard, evidence-backed findings and a prioritised roadmap.
Any of them. We assess AI built on models from providers such as OpenAI, Anthropic, Google, Meta and Mistral, AI running on platforms such as Amazon Bedrock, Google Vertex AI and Azure AI Foundry, open-source and custom models, and AI features inside the software you buy, as long as we can access them for testing.
No. Many clients ask us to assess a system before launch, when fixes are cheaper. We can also review an AI use case at the design stage, before anything is built.
Typically the EU AI Act, ISO/IEC 42001 for AI management systems and the NIST AI Risk Management Framework, along with data protection law such as GDPR and the rules of your industry. We agree the relevant frameworks with you during scoping.
It can, even if your business is based outside the EU, for example if you offer AI systems in the EU or their output is used there. What you must do depends on the risk level of each use case, and the obligations are being phased in over several years. We classify your use cases and show which obligations apply.
Yes. Assistants usually inherit the access of the person using them, so weak permissions in file shares, email and business apps become an AI problem. We check what your assistant can reach, look for oversharing and recommend the controls to put in place.
A focused review of one system usually takes one to three weeks. A full assessment of two or three systems typically takes around six weeks, depending on access to people, data and test environments.
No. We agree the scope and testing approach with you in advance, test in non-production environments wherever possible and schedule any production testing to avoid disruption.
An AI risk scorecard, a findings register with evidence and recommended fixes, a prioritised roadmap and an executive briefing. If you choose, we can also help you put the fixes in place.
Whenever a model, data source or use case changes significantly, and at least once a year, because the accuracy and risks of AI systems can drift over time.
Tell us which AI you run or plan to launch. We'll suggest the right scope, from a focused review of one assistant to a full assessment across your business.
