The AI Exposure Audit
A fixed-price, two-week engagement that finds every AI tool your staff are using, official and unofficial, maps which client data is passing through each, assesses each against your legal and professional duties, and hands the partners a plan.
Two weeks, four phases.
Discovery
Interviews with partners and team leads, and a questionnaire that asks what people actually use.
Scan
Browser extensions, card statements, connected apps, mailbox invitations and meeting-tool settings. The scan finds what interviews do not.
Assessment and legal review
Each system scored in the assessment matrix. Legal conclusions reviewed independently.
Report and presentation
The five documents, and the slide, presented to the partners.
- Days 1 to 3
Discovery
Interviews with partners and team leads, and a questionnaire that asks what people actually use.
- Days 3 to 6
Scan
Browser extensions, card statements, connected apps, mailbox invitations and meeting-tool settings. The scan finds what interviews do not.
- Days 7 to 11
Assessment and legal review
Each system scored in the assessment matrix. Legal conclusions reviewed independently.
- Days 12 to 14
Report and presentation
The five documents, and the slide, presented to the partners.
Delivery is two weeks from the day the last of your inputs arrives, not from signing.
What you provide.
- Twenty minutes each with the partners and team leads, on a call or in person.
- A named contact who can list connected apps, browser extensions and firm licences.
- Twelve months of card statements or expense lines, for AI subscriptions only.
- Mailbox search access for vendor invitations, or someone who will run the searches we give them.
We never need document content, message content or client files.
What you receive.
The slide
Every AI tool in the firm, and what passed through each.
One page, tool by tool, presented to the partners. This is the moment the audit exists for.
Risk register
Each system scored against UK GDPR, the DPA 2018, ICO guidance and your professional confidentiality duties, as at the date of assessment.
AI usage policy
A written policy your staff can follow: approved tools, prohibited uses, and what to do when something goes wrong.
Data protection impact assessments
DPIAs for the systems that need them, written to the ICO template.
Remediation roadmap
What to switch off, what to replace and what to keep, in order, with owners and dates.
What the report says, and what it does not.
Every report is an assessment of your use of AI tools against UK GDPR, the DPA 2018, ICO guidance and your professional confidentiality obligations, as at a stated date. It is an informational assessment, not legal advice, and it never states that the firm is compliant. Technical findings are signed by us. Legal conclusions are reviewed independently before they reach you.
Legal conclusions are reviewed by an independent solicitor or data protection officer, arranged per engagement.
Pricing.
Exposure Check
A 20-minute call and a one-page snapshot: the five most likely leakage points for a firm of your type, and the three questions you cannot currently answer.
Book a 20-minute Exposure CheckAI Exposure Audit
Discovery, scan, assessment, the five documents and the presentation. Two weeks.
AI Exposure Audit
The same engagement over three to four weeks, with a second assessor.
Ongoing Oversight
Quarterly re-scan, policy updates when the rules change, an incident line, an annual staff refresher, and a monthly three-number email to the managing partner.
Ranges, not starting prices. You will have a fixed figure before you sign.
Ongoing Oversight.
The audit is a photograph. Tools change, staff change and the rules change. Oversight keeps the register current.
- A quarterly re-scan of extensions, connected apps and expense lines.
- Policy updates when ICO guidance or your regulator moves.
- An incident line for the day someone pastes the wrong thing.
- An annual staff refresher.
- A monthly three-number email to the managing partner: tools in use, tools unapproved, incidents.
£1,000 to £3,000 a month, by headcount.
Start with twenty minutes.
The Exposure Check is a free call and a one-page snapshot of where your firm is most exposed. If the audit is the right next step, you will have a fixed figure before you sign.