A fixed-price, three-week health check that shows where you are exposed and what to fix first. Then practical training and ongoing support to keep it that way.
New UK data law is in force, AI tools are spreading through every team, and regulators expect evidence, not just policies.
Most remaining provisions of the Data (Use and Access) Act 2025 came into force, with complaints-handling duties following in June. There is no exemption for small businesses.
Source: ICO announcement, Feb 2026of UK businesses have no formal written AI governance policy, while staff use AI tools every day.
Source: Startups.co.uk survey, via UKTN, Aug 2026of UK organisations have fully embedded AI governance. More than half have minimal governance or none at all.
Source: Trustmarque AI Governance Index 2025An independent review of where your governance stands today, scored across six areas, with a clear plan your board can approve.
Sessions built around your own policies and findings, so your people know what good looks like in their day job.
Senior data and AI governance leadership for a few days a month, without a full-time executive hire.
Named data owners, a governance forum, and clear sign-off on data and AI risk.
Retention, classification, quality and AI-use policies that are current and followed.
Record of processing, asset register, key data flows, third parties and transfers.
Critical data defined, quality rules monitored, issues logged and fixed.
UK GDPR and the 2025 Act: subject access, complaints, automated decisions, DPIAs.
Which AI tools you use, what data goes in, vendor checks and human oversight.
About 8–10 hours of your team's time in total. Remote by default.
A one-hour call to agree scope, who to interview and which documents to share.
Document review and short interviews. We map your key data flows and the AI tools in use.
Spot checks of how controls really work, then a maturity score and RAG rating for each area.
Gap report, findings register and 90-day roadmap, walked through with your senior team.
| ID | Finding | Risk |
|---|---|---|
| F-01 | No approval route for new AI tools | HIGH |
| F-02 | Record of processing out of date | MED |
| F-03 | Critical data owners not named | MED |
| F-04 | Retention schedule not applied | MED |
| F-05 | DPIA template lacks AI questions | LOW |
Every session uses your own policies and real examples. Each one comes with slides, a one-page handout, an attendance record you can show an auditor, and a short quiz to evidence understanding.
| Session | For | Length |
|---|---|---|
| Data governance essentialsClassify data, know who owns it, know who to ask | All staff | 60 min |
| Safe and responsible AI useWhat can and can't go into AI tools | All staff | 60 min |
| AI governance for leadersApprove AI uses and read the risk | Board, exco | 2 hrs |
| UK data law in practiceSubject access, complaints, DPIAs | Ops, product | 90 min |
| Data ownership and stewardshipRun the role: rules, issues, sign-off | Data owners | Half day |
| Data quality in practiceRoot causes, fixes, quality on key reports | Finance, data | Half day |
Full scope for firms of up to around 250 staff: gap report, findings register, 90-day roadmap and a readout with your senior team.
Book a gap chatFor 250–500 staff or more than one regulated entity. Up to 10 interviews and a second readout.
Book a gap chatShort sessions (60–90 min) £950. Full day £3,500. Up to 20 attendees, built around your own policies. Annual programmes from £7,500.
Plan a sessionUp to 2 days a month. Quarterly governance steering committee, roadmap tracking, and advice on new data and AI uses as they come up.
Discuss supportUp to 4 days a month. We chair your monthly data governance council, review new data and AI uses before launch, and present a monthly data risk report to your board.
Discuss supportFor larger or time-critical programmes, such as preparing for a regulatory review or an acquisition. Scoped and priced after a short discovery call.
Talk it throughAll prices exclude VAT. The health check fee is credited against your first month if you start a monthly support plan within 30 days of the final report. Monthly plans have a 3-month initial term, then continue month to month with 30 days' notice. Retainer clients receive 20% off training; content built around your own systems beyond standard tailoring is quoted separately. Health checks are invoiced 50% on signing and 50% on delivery of the final report. Grasten Advisory provides governance advice, not legal advice; where a finding needs a legal view, the report says so.
Founder and Principal Consultant, Data & AI Governance
Stephen is a data governance specialist with over seven years of experience, and a doctoral researcher. He combines hands-on experience inside regulated organisations with research into how AI systems can be verified, audited and kept private.
Stephen has held data governance roles at Intercontinental Exchange, the global operator of financial exchanges and clearing houses, and at EDF, one of the UK's largest energy suppliers, as well as at MC Macy Ltd. Working as both a Data Governance Analyst and a Data Governance Engineer, he has bridged governance policy and the technical controls needed to make it work in practice.
He is a PhD researcher in the School of Computer Science and Electronic Engineering at the University of Essex. His research develops methods for verifiable and privacy-preserving AI, using zero-knowledge proof systems to show that an AI model produced a result correctly without exposing the underlying data. He benchmarks these against other privacy-enhancing technologies, including homomorphic encryption and secure multi-party computation, with applications in regulated finance, medical imaging and humanitarian AI.
Clients therefore get advice grounded in how governance really operates inside regulated firms, informed by a deep technical understanding of where AI and data privacy are heading. Every engagement is led by Stephen personally, from the first conversation to the final readout.
Data ownership, policies, quality and controls designed to stand up to scrutiny in financial services and other regulated sectors.
Postgraduate grounding in cyber security and data analytics, applied to UK GDPR and the Data (Use and Access) Act 2025.
Research-level understanding of how AI decisions can be verified and audited, translated into practical oversight for your business.
We help you put checks at each step, so you can show how an AI result was produced, without exposing the sensitive data behind it.
Choose a service and a time that suits you. We will confirm your booking within one working day.
step.appiah@grastenadvisory.co.ukA calendar invitation will be sent within one working day.
No. The health check is governance and operational advice. Where a finding needs a legal view, the report says so clearly, so you can take it to your lawyers with the evidence already gathered.
About 8–10 hours in total over three weeks, spread across 5–7 people. Most of it is 45-minute interviews and the readout.
The health check is advisory. Once the roadmap is agreed, clients can retain Grasten Advisory on a monthly plan, as Governance Oversight or a Fractional CDO, to oversee delivery, while their own teams carry out the technical work.
Yes, if you handle sensitive or regulated data: insurers, wealth platforms, healthtech and data-heavy SMEs are a good fit. Book a gap chat and we will give you a candid view of whether we are the right fit.
A 30-minute video call to understand your current position and priorities, and to agree whether a health check, training or another form of support would be most useful. There is no obligation to proceed.