About

A small, senior, engineering-led consultancy

Flowing Mind Ltd is based in Newcastle upon Tyne and works with regulated and public sector organisations across the UK. We are deliberately small, and the people who sell the work do it.

Why we exist

The gap we kept running into

There is no shortage of AI advice available to UK organisations. There is a real shortage of advice that has had to survive an information governance review.

The strategy firms produce documents. The automation agencies produce demos. Both are frequently competent at what they do, and neither reliably answers the question that actually determines whether the project happens in a bank, a trust, a law firm or a council: where does the data go, who can reach it, and can you prove it?

That question is architectural. It has to be answered in the first week, by someone who will also be there when the thing is built, because the cost of answering it in month nine is usually a rebuild.

So we do both halves. We assess and advise, we build, and we produce the evidence, and we tell clients when the honest answer is that they should not build the thing at all.

Who you work with

The people on the call are the people on the work

Tom

Founder & principal consultant

Tom's background is software engineering and quality engineering rather than management consulting: test automation, device management and security tooling before AI, which turns out to be unusually good preparation for it. The disciplines that make AI systems defensible in a regulated setting are the ones quality engineering has always cared about: measure it, define what correct means before you build, assume it will fail and design for that, and never ship something you cannot test.

He leads every engagement and does the work. If you are talking to Flowing Mind, you are talking to the person who will be writing the assessment or the code.

Flowing Mind Ltd

Registered in England & Wales · Trading since 2020

The company has traded since 2020 from Newcastle upon Tyne. Where an engagement needs capability we do not have (specialist legal advice, clinical safety, sector-specific regulatory expertise) we say so and bring in someone who does, rather than improvising at your expense.

We are not trying to become a large consultancy. Small and senior is the product, not a stage we are passing through.

What we believe

Four commitments we will put in the contract

Your data stays in the UK

Every engagement starts by drawing the boundary your data must not cross, then designing only within it. Where a hosted model is genuinely the right call, we say so, and document the residency and retention terms in writing.

You own what we build

No proprietary runtime, no per-seat licence on our own middleware, no hostage architecture. Open weights and open standards wherever they do the job, and a repository with tests and documentation that your team can run without us.

Evidence, not enthusiasm

Regulated buying decisions are not won with demos. Every build ships with an evaluation set, measured results, a risk register entry and the paperwork an auditor or procurement panel will ask for.

We will tell you not to

A good proportion of proposed AI projects should not be built. Where the answer is a database query, a fixed rule or better process design, that is what we recommend, and it costs you an assessment, not a year.

Some things we would rather say up front

We are small

If you need forty consultants mobilised next month, that is a genuine requirement and we are the wrong firm. Say so early and we will point you somewhere sensible.

We are not a law firm

We produce the technical and organisational evidence your DPO and counsel need. We do not give legal advice, and we will tell you when a question is one for a solicitor.

We publish our prices

Partly because vague pricing wastes the first meeting, and partly because a fee that varies with what the client appears able to pay is not a fee, it is a negotiation.

We are straight about clearance

Tell us the clearance level and any facility requirement in the first conversation. We will say plainly whether we can meet it as we stand and where we would work alongside cleared staff, rather than leaving you to find out in month three.

We are not your accreditor

We build to the baseline, produce the evidence and answer the questions. Accepting residual risk belongs to your security assurance coordinator, SIRO or accreditor, and a supplier who offers to approve their own work has told you something useful.

We will talk you out of things

A meaningful share of proposed AI projects should not be built. Finding that out during an assessment is a good outcome, and we would rather lose the build than deliver one we do not believe in.

Have a look at whether we fit

Thirty minutes, no deck. Describe the problem and the constraint you are stuck behind, and we will give you a straight read on whether it is worth doing, what it would take, and roughly what it would cost.

Book an intro call See how we price work