Undeclared AI Review
AI is already in your operational data. Your suppliers use it to capture, process and summarise the information your people sign off. Accountability for those decisions stays with you.
The Undeclared AI Review maps where AI already touches the information your business relies on, what that means for the people who carry the accountability, plus what to do about it in the next 90 days.
Who it is for
Boards and executive leadership
Directors and non-executive directors who are accountable for controls they have not been shown, in businesses where a failure is expensive, regulated and public.
Operational and technical leadership
Engineering, operations, quality and technical authority leads who carry accountability for decisions made on supplier-produced data.
Service and supply chain leadership
Technical and operations leaders who need to state clearly, to clients and to auditors, where AI sits in their own deliverables.
What you get
Exposure map
Where AI already produces or shapes the data your decisions rest on, across your supply chain and your own systems.
Accountability view
Which decisions rest on AI shaped information, plus who signs them off today.
Prioritised 90 day action list
Sized for your team. What to fix first, what to ask suppliers, what can wait.
One page board summary
The position, the exposure and the plan, written for the leadership table.
How it runs
Ten working days from start. Fully remote. No site visit, no software to install, no disruption to operations.
Two interviews
Two 60 minute calls: one with the person accountable for the operation, one with your contracts or digital owner.
Supplier and toolchain register
A structured register of the suppliers who produce data you rely on, plus the software in the chain, completed with guidance.
Document review
We review what you already hold: contract clauses on software and data, the deliverables your suppliers produce, your reporting and record flows. Nothing new to produce.
Findings and plan
The exposure map, accountability view, 90 day actions plus board summary, walked through with you on a closing call.
Fixed price
Agreed before the work starts, invoiced in two stages. No day rates, no scope creep. The figure is confirmed on the scoping call.
Ten working days
From start date to delivered findings. Start dates are scheduled; two reviews run at any one time at most.
Straight answers
If the review finds nothing material, the report says so. The findings are yours either way.
Two clauses of ISO/IEC 42001, the AI management system standard, describe this work almost exactly. A.7.5 requires data provenance. A.10.3 puts the supplier relationship inside the management system. An organisation that cannot answer either one has an undeclared dependency. Where the business also holds ISO 55001:2024, clause 7.6 already requires documented data sources. The same question, asked by a second standards body.
What it is not: a certification audit, a software sale, or the start of an open-ended engagement. Led by Grant Blackaby, BSI Lead Auditor for ISO/IEC 42001.
