AI Readiness Audit for UK Businesses

Why audit before you buy

Most failed AI projects fail on the basics, not the model. The answers are only as good as the documents behind them. An assistant that searches your files will find the salary spreadsheet someone shared with the whole company in 2019. An integration cannot start if the system holding the data has no API. A readiness audit finds these problems while they are cheap to fix, before licences are bought or a build begins.

It is a fixed-scope piece of work with a clear output. If you need a broader view of where AI could help first, start with AI consultancy; the audit is the deeper technical check.

What we check

1. Data. Where customer, product, financial and operational data lives; duplication and quality; whether documents are text or scanned images; retention and deletion; what is personal or special category data.
2. Systems. Whether your CRM, accounting, stock and job systems have documented APIs, webhooks and sensible rate limits, or whether data is trapped in a legacy system that needs work first.
3. Security and permissions. Who can open what in Microsoft 365 or Google Workspace, multi-factor authentication, admin roles, and logging.
4. Processes. Which tasks are documented and consistent enough to automate, and where the exceptions are.
5. People and policy. Whether there is an acceptable use policy for AI, which tools staff already use, and what training they have had.

Microsoft 365 and Copilot

Microsoft 365 Copilot only shows a user content they already have permission to open. That sounds safe, but in many tenants permissions are far wider than anyone realises: SharePoint sites shared with everyone in the organisation, Teams files inherited by every member, old "anyone with the link" sharing. Before Copilot, nobody stumbled on those files. With Copilot, a simple question can bring them up.

We review site and library permissions, organisation-wide sharing links, guest access and sensitivity labels, and list what to tighten before rollout. Making the changes in the tenant is IT administration work; our sister site dijitul support handles Microsoft 365 support if you need hands-on help.

Risk and data protection

For each AI use you are considering, we screen against UK GDPR: lawful basis, transparency, where processing happens, whether the provider uses your data to train models, international transfers and retention. Where a use is likely to be high risk, such as automated decisions about people, we flag that a data protection impact assessment is needed and outline what it should cover, following the Information Commissioner's Office guidance on AI and data protection.

We also note AI-specific risks such as prompt injection through incoming emails or documents, and where a person must stay in the loop.

Shadow AI gets a section of its own. We ask, without blame, which tools staff already use and for what. Free consumer accounts used for work are common, and the fix is usually to provide an approved business tool and a clear policy rather than to ban everything and drive use underground.

The report and next steps

You get a written report scoring each area red, amber or green, with the evidence behind each score. The action plan lists fixes in order, separating quick wins such as tightening sharing links from larger work like cleaning a customer database or adding an API to an old system. It ends with three to five AI use cases that are ready to scope, each with a recommended route. Some can be bought; others suit AI integration or AI automation builds. We present the findings in a call and answer questions.

The scores are not a pass or fail. A business with red ratings for data quality can still start with a narrow AI use that only touches one clean system, while fixing the rest in parallel. The point is to know which projects are safe to start now and which would be built on sand.

The audit is quoted at a fixed price after a free chat, based on the number of systems and the size of your Microsoft 365 or Google Workspace estate. Get in touch.

What we deliver

• A data inventory: what you hold, where, in what state
• A systems and API review of your core software
• A Microsoft 365 sharing and permissions review
• A risk and data protection screening, with DPIA pointers
• A scored readiness report with red, amber and green ratings
• A prioritised action plan and shortlist of AI use cases

How it works and what it costs

Every project gets a fixed-price quote after a free initial chat and a short scoping stage. You own the code and the data.

1. Free chat

   Tell us the problem in plain English: what you do now, what goes wrong and what "better" looks like. No charge, no obligation.

2. Scoping

   We map the processes, systems and data involved, agree what is in and out, and write it down so there are no surprises.

3. Fixed-price quote

   You get a fixed price for the agreed scope, or a phased plan for bigger builds, so you can start small and prove it works.

4. Build and test

   We build in short stages you can see and try, test against real data, then go live carefully with a rollback plan.

5. Hand over and look after

   You own the code and the data. We can host it, support it and keep improving it, or hand it to your own team.

Related