A fixed-price, three-week health check that shows where you are exposed and what to fix first. Then practical training and ongoing support to keep it that way.
New UK data law is in force, AI tools are spreading through every team, and regulators expect evidence, not just policies.
Most remaining provisions of the Data (Use and Access) Act 2025 came into force, with complaints-handling duties following in June. There is no exemption for small businesses.
Source: ICO announcement, Feb 2026of UK businesses have no formal written AI governance policy, while staff use AI tools every day.
Source: Startups.co.uk survey, via UKTN, Aug 2026of UK organisations have fully embedded AI governance. More than half have minimal governance or none at all.
Source: Trustmarque AI Governance Index 2025An independent review of where your governance stands today, scored across six areas, with a clear plan your board can approve.
Sessions built around your own policies and findings, so your people know what good looks like in their day job.
A senior governance lead for a few days a month, without a full-time hire.
Named data owners, a governance forum, and clear sign-off on data and AI risk.
Retention, classification, quality and AI-use policies that are current and followed.
Record of processing, asset register, key data flows, third parties and transfers.
Critical data defined, quality rules monitored, issues logged and fixed.
UK GDPR and the 2025 Act: subject access, complaints, automated decisions, DPIAs.
Which AI tools you use, what data goes in, vendor checks and human oversight.
About 8–10 hours of your team's time in total. Remote by default.
A one-hour call to agree scope, who to interview and which documents to share.
Document review and short interviews. We map your key data flows and the AI tools in use.
Spot checks of how controls really work, then a maturity score and RAG rating for each area.
Gap report, findings register and 90-day roadmap, walked through with your senior team.
Every session uses your own policies and real examples. Each one comes with slides, a one-page handout, an attendance record you can show an auditor, and a short quiz to evidence understanding.
| Session | For | Length |
|---|---|---|
| Data governance essentialsClassify data, know who owns it, know who to ask | All staff | 60 min |
| Safe and responsible AI useWhat can and can't go into AI tools | All staff | 60 min |
| AI governance for leadersApprove AI uses and read the risk | Board, exco | 2 hrs |
| UK data law in practiceSubject access, complaints, DPIAs | Ops, product | 90 min |
| Data ownership and stewardshipRun the role: rules, issues, sign-off | Data owners | Half day |
| Data quality in practiceRoot causes, fixes, quality on key reports | Finance, data | Half day |
The full health check at a reduced rate, in return for a testimonial and an anonymised case study.
Apply for a placeFull scope for firms up to around 250 staff. Report, findings register, roadmap and readout.
Book a gap chatFor 250–500 staff or more than one regulated entity. Up to 10 interviews and a second readout.
Book a gap chatTraining from £750 per session. Annual training programmes from £5,000 a year. Fractional governance lead from £2,000 a month. Health checks are invoiced 50% on signing and 50% on delivery. This is governance advice, not legal advice; where a finding needs a legal view, we say so.
I've done data governance from the inside, in regulated finance and energy. Now I research how to make AI verifiable and privacy-preserving. You work with me directly, from the first call to the readout. No juniors, no hand-offs.
Pick a service and a time that suits you. You'll get a confirmation within one working day.
hello@provenantadvisory.co.ukYou'll get a calendar invite at your email within one working day. If the slot has gone, we'll suggest the nearest alternative.
No. The health check is governance and operational advice. Where a finding needs a legal view, the report says so clearly, so you can take it to your lawyers with the evidence already gathered.
About 8–10 hours in total over three weeks, spread across 5–7 people. Most of it is 45-minute interviews and the readout.
The health check is advisory. Afterwards, many clients keep Provenant as a fractional governance lead to run the roadmap, while their own team does the hands-on build.
Yes, if you handle sensitive or regulated data: insurers, wealth platforms, healthtech and data-heavy SMEs are a good fit. Book a gap chat and we'll be straight with you about fit.
A 30-minute call about where you are now, what's worrying you, and whether a health check, training or something else makes sense. No pitch deck.