Sector
AI consultancy for central government
Departments must adopt AI fast, and are assessed against the NCSC CAF every year. Someone has to explain, in a GovAssure submission, how the AI platform is governed. We build so that answer already exists.
The constraint
Why departmental AI projects stall
Pilots get funded. Production is harder: it brings the platform into scope for GovAssure, Secure by Design and possibly the Algorithmic Transparency Recording Standard, and a senior information risk owner must sign for it.
GovAssure is the sharp end. An AI platform stood up outside the normal architecture process reaches its departmental CAF assessment with nothing prepared: no contributing-outcome commentary, no asset ownership, no detection coverage. A finding waiting to be written.
Secure by Design changed the timing. Security is evidenced continuously by the delivery team, not assembled for a final gate. Treat AI as an exception and you rediscover this at the worst moment.
And the data is the point. Casework, correspondence, draft policy and citizen records would make an assistant useful, and cannot go to a commercial API on a shared tenancy.
Where it works
Where AI earns its place
Ordered roughly by how quickly they get approved. The first is usually the right first project: it is the least contentious.
Policy and guidance retrieval
Staff query policy, guidance and instruction with citations. The same answer whoever asks, whichever version they remember.
Correspondence, PQ and FOI support
Find material across systems and draft first-pass responses for official review. High volume, well defined, measurable.
Casework triage and summarisation
Classify, route and summarise casework, flagging urgency and vulnerability for a human to decide.
Legacy records and document processing
Extract and structure scanned records, forms and legacy stores. Less rekeying, fewer errors.
The gate
What assurance will ask for
We produce it during delivery. Cheaper, and more likely to be accurate.
- NCSC CAF contributing-outcome commentary for the AI platform, ready for GovAssure
- Secure by Design artefacts produced through delivery
- ATRS record drafted during the build where the tool affects decisions about the public
- DPIA and equality impact assessment completed before processing begins
- DISA STIG and CIS Level 2 build evidence, with justified deviations
- Data flow and residency documentation naming every processor and location
- A risk position in the department’s own language, for the SIRO
Questions from this sector
How does an AI platform fit into GovAssure?
As a system in scope, like any other. The work is CAF contributing-outcome commentary for the platform: ownership, asset inventory, identity and access, logging and monitoring, incident response. Cheap during the build. Reconstructed for a submission, expensive, and it exposes gaps when they cost most to close.
Can we use a hyperscaler UK region instead of on-premise?
Often, yes. Dedicated capacity in a UK region covers most departmental workloads with far less operational burden. On-premise is right when classification, network position or sustainment require it: fewer cases than the market implies, more than a cloud-first policy assumes.
Do we have to publish an ATRS record?
The Algorithmic Transparency Recording Standard applies to algorithmic tools used by public sector organisations that affect decisions about members of the public, with scope guidance from the Central Digital and Data Office. Draft the record during the build whatever you decide about publication. It surfaces oversight and data gaps while they are cheap to fix.
Can you work through an existing framework?
Yes. Tell us your route to market, including framework options and direct award thresholds where they apply, and we will work with your commercial colleagues on the compliant path.
Next step
Start with a 30-minute call
No deck. Tell us the problem. We will say whether AI is the right tool, what it would take and roughly what it would cost.