The guidance that applies
- The AI Playbook for the UK Government sets out principles for using AI safely and responsibly across government.
- The Algorithmic Transparency Recording Standard is how public bodies publish information about algorithmic tools they use. It is mandatory for central government departments and recommended for the wider public sector.
- The ICO guidance on AI and data protection covers lawful basis, fairness, transparency and data protection impact assessments.
- The NCSC guidelines for secure AI system development covers security across design, development, deployment and operation.
A practical order of work
- Classify the information each use would touch, using your existing classification policy.
- For each tool, record where prompts and outputs are processed and stored, and for how long.
- Complete a data protection impact assessment where personal data is involved.
- Agree a named owner and a human review point for anything that affects a member of the public.
- Decide what you will publish about the tool, and when.
- Pilot one workflow, measure it against a baseline, and only then scale.
Where AI should run
Most public bodies need a mix: tightly controlled services for sensitive or personal data, and UK-region cloud services for everything else. See on-premise versus cloud AI for the trade-offs.
Procurement routes
- Find a Tender. The UK central platform for public procurement notices under the Procurement Act 2023. find-tender.service.gov.uk.
- Sell2Wales. Where public bodies in Wales advertise contracts. sell2wales.gov.wales.
- Contracts Finder. Lower-value public contracts in England. gov.uk/contracts-finder.
- G-Cloud. The Government Commercial Agency framework for cloud software, hosting and support. G-Cloud 15 runs from August 2026 to February 2028. G-Cloud 15.
- Below threshold. Many public bodies can buy smaller, fixed-price pieces of work, such as a one-day review, under their own procurement rules. Check with your procurement team first.
Certifications buyers ask for
- Cyber Essentials and Cyber Essentials Plus. A National Cyber Security Centre scheme covering basic security controls. Often a condition of public sector contracts that handle personal data.
- ISO/IEC 27001. The international standard for information security management. ISO/IEC 42001 is the newer standard for AI management systems.
- Data Security and Protection Toolkit (DSPT). An annual self-assessment that organisations with access to NHS patient data and systems must complete.
- Digital Technology Assessment Criteria (DTAC). NHS England's baseline for digital health technologies: clinical safety, data protection, technical security, interoperability, usability and accessibility.
- Ask for evidence. Ask every supplier, including us, for certificates in writing, and check them against the issuing body. A certificate covers a named scope and date; check both.
How to start, and what it costs
- Free AI Readiness Audit. 15 questions, about 5 minutes, including AI governance. Take the audit.
- AI and Copilot Discovery Day. One day with a consultant, £950 + VAT, fixed. For a public body this is where we classify your data, map where each AI tool processes it and agree the rules. See what is included.
- Implementation. Value based, scoped and quoted after the Discovery Day.
When we are not the right fit
If you need a large systems integrator to run a multi-year programme across many sites, or a supplier already on a specific framework, that route will suit you better. We work best where a public body wants a small, fixed-price first step and hands-on help in the systems it already runs. Back to sovereign AI for UK organisations.
Questions we are often asked
Can public bodies use generative AI?
Yes, within their own policies and the law. The AI Playbook for the UK Government sets out principles, and the ICO explains data protection requirements. Start with low-risk, non-personal uses and a named owner.
Do we have to publish details of AI tools we use?
Central government departments must use the Algorithmic Transparency Recording Standard. It is recommended for the wider public sector. Check your own organisation's policy.
Can we buy a Discovery Day without a full tender?
Often, because it is a small, fixed-price piece of work. Your procurement team will confirm which route applies to your organisation and the contract value.
Do you hold public sector certifications?
Ask us for our current status in writing. We will not claim a certification or framework listing on this site unless we hold it and can show the certificate.