// Q:chi AI Consultancy
A structured service that finds out where AI is being used in your organisation, assesses the risks and delivers a clear, prioritised action plan your team can act on immediately.
Take our free AI Governance Exposure Check to see where you stand.
// sound familiar
AI tools are being adopted faster than policies can keep up. If any of these feel relevant, you are not alone.
31% of UK workers who use generative AI for work do so without their employer's knowledge (Deloitte UK, 2026). Staff adopt public tools while software suppliers introduce AI features into existing applications. Your AI estate can expand without a central purchasing decision or risk review.
62% of CEOs report that their boards are actively pressuring them to deliver measurable AI outcomes (Dataiku, 2026). When a customer, insurer or board asks how AI is governed, many organisations still have no credible way to show what they use, who owns it or how the principal risks are controlled.
34% of office workers have entered customer information into public AI tools, while 31% have shared financial data or confidential company documents (PagerDuty, 2026). Without clear policies and oversight, sensitive data leaves the organisation every day.
43% of UK businesses planning to adopt AI identify unclear or uncertain regulation as a barrier (GOV.UK, 2026). UK requirements arise through data protection, consumer, employment and sector-specific rules. The EU AI Act may also apply depending on where and how AI is provided or used.
Sources: Deloitte UK workforce study, 25,000 UK workers (2026). Dataiku CEO survey (2026). PagerDuty enterprise workforce study, 1,250 employees (2026). GOV.UK AI adoption survey, 3,500 UK businesses (2026, from 2025 fieldwork).
// what you receive
Every engagement produces tangible outputs: reports, risk assessments, policy templates and action plans.
01
We review your current AI landscape and identify risks across data, tools, processes and people. You get a clear picture of where you stand and what to prioritise.
02
We help you design an AI governance framework informed by ISO 42001 and the EU AI Act, tailored to your size, sector and risk profile.
03
We map the AI tools in use across your organisation, including those adopted without formal approval, and assess the data and risk implications of each.
04
We provide policy templates, review your existing documentation and advise on the governance materials you need, including acceptable use policies, AI risk registers and data handling guidelines.
05
We assess how your data is collected, stored and used by AI systems, and advise on controls that protect sensitive information and maintain regulatory compliance.
06
AI governance is not a one-off exercise. We offer ongoing advisory relationships to help you keep pace with new risks, regulatory developments and emerging best practices.
// how it works
Week 1
We meet with your leadership or IT team to understand your organisation, your current use of AI and the areas of most concern.
Weeks 2 - 4
We conduct our structured assessment covering governance, data, risk, tools and accountability. We analyse the findings and map your risk profile.
Weeks 5 - 6
We present our findings, risk assessments and recommended next steps. You receive your full deliverables pack including templates, reports and action plan.
// what you get
Two clear starting points depending on your size, complexity and level of assurance required.
A focused, fixed-scope review for organisations taking their first step into AI governance. One lead contact, structured questionnaire, clear deliverables.
A comprehensive review for organisations that need interviews across departments and a deeper view of risk, tools and accountability.
// go further
Available after your Essentials or Full Review. Build out your governance framework at your own pace.
Hit the ground running with tailored policy templates, a populated AI risk register and a staff awareness plan your team can adopt immediately.
Be ready when customers, insurers or procurement teams ask how you govern AI. Pre-drafted responses you can use straight away.
A polished, presentation-ready summary of your governance position, key findings and recommended next steps, designed for board or senior leadership audiences.
Bundle all three modules with a Full Review: £9,950 £10,950
12-month term · 4 hours per month · includes Annual Review
Prices are quoted exclusive of VAT. Scope and deliverables are based on a standard engagement; if your situation requires material adjustment we will confirm any change before work begins.
// about Q:chi
Q:chi is an ISO 27001 certified UK consultancy. We built our information security practice first, then expanded into AI governance as adoption accelerated and the need for practical controls became clear.
We practise what we advise. Q:chi holds ISO 27001 certification and applies information security governance across everything we do.
Our consultants are practitioners, not auditors. We build governance frameworks that work in the real world, not just on paper.
You keep everything we produce: reports, risk registers, policy templates and training materials. These are assets your organisation can use long after our engagement ends.
Our methodology is informed by ISO/IEC 42001, the international standard for AI management systems. We apply its principles across every engagement so you benefit from a recognised framework from day one.
Our approach is informed by ISO/IEC 42001, the EU AI Act, ISO/IEC 27001 and the Cloud Security Alliance.
// your consultants
Cross-discipline expertise spanning information security, software engineering, marketing operations and enterprise consulting.
// questions
AI governance is the set of policies, processes and controls an organisation puts in place to manage the use of artificial intelligence responsibly. It matters because AI tools are being adopted rapidly across every function, and without governance, organisations face data breaches, regulatory non-compliance, reputational damage and unchecked operational risk.
Shadow AI refers to the use of AI tools by employees without the knowledge or approval of IT, security or leadership. This includes tools like ChatGPT, Copilot, image generators and other AI-powered services used for everyday tasks. It creates risk because data may be shared with third-party platforms without oversight.
The AI Governance Assessment is a structured engagement delivered over approximately two to four weeks depending on scope. It includes a discovery session with your leadership team, a structured questionnaire covering governance, data, risk, tools and accountability, and named deliverables including a populated AI use register, governance maturity assessment, risk assessment of material AI uses and a prioritised action plan.
Q:chi provides advice, reviews your existing documentation and supplies policy templates. We do not write your internal documentation, but we give you the tools, templates and guidance to produce it effectively and in line with recognised frameworks.
Our approach is informed by ISO/IEC 42001, the EU AI Act, ISO/IEC 27001 and the Cloud Security Alliance. We use these frameworks as a foundation, but we tailor our guidance to what is practical and valuable for your organisation.
No. The review does not result in ISO/IEC 42001 certification and does not constitute a certification audit. It provides the governance foundations, evidence and documentation you would need if you choose to pursue certification separately.
Get in touch through our contact page and a member of the Q:chi team will respond as soon as possible to discuss your requirements and how we can help.
// go deeper
Article
What shadow AI looks like in practice, why it matters and what you can do about it. A practical guide for leadership and IT teams.
Free tool
A five-minute self-assessment covering visibility, policy, risk and accountability. See where your organisation stands and whether a formal review is the right next step.
