Safe AI Adoption · Steps 3–4 · Implement & assure, then monitor & sustain
Choose, test and run AI safely.
Many organisations buy AI rather than build it. These four services cover everything around the build: checking a supplier before you sign, preparing for Microsoft 365 Copilot, testing a system before it goes live, and keeping it governed once it is running.
Supplier due diligence from £895 · Copilot Readiness from £1,100 · Pre-launch AI Testing from £1,650 · Managed AI Governance from £695/month · all excl. VAT
The whole lifecycle
Every stage of AI, one accountable partner
From the first question to switching a system off, each stage has a service with a published starting price. The new services fill the stages around the build: buying, testing and running.
| Stage | VisionXY7 service | Step |
|---|---|---|
| Strategy and readiness | Free checks, Mini Scan, Quick Scan, Full Audit, EU AI Act Applicability | 1 Assess |
| Policy, risk and legal duties | DPIA & Privacy Risk Assurance, Combined Impact Assessment, Safe AI Starter, AI Safety & Assurance Programme | 2 Govern |
| Choosing a tool or supplier | AI Supplier & Tool Due Diligence New | 3 Implement & assure |
| Preparing a rollout | Copilot Readiness Review New | 3 Implement & assure |
| Building | Custom and voice AI agents, Smart Secretary, workflow automation and RPA | 3 Implement & assure |
| Testing before go-live | Pre-launch AI Testing New | 3 Implement & assure |
| Running, monitoring, improving | Managed AI Governance New, DPIA Review, Fractional Chief AI Officer | 4 Train, monitor & sustain |
| Skills | Board, team and 1-to-1 training | 4 Train, monitor & sustain |
| Retiring a system | Included in Managed AI Governance: data deleted, access removed, risk record closed | 4 Train, monitor & sustain |
Step 3 · Before you sign · New
AI Supplier & Tool Due Diligence
Check an AI tool or supplier before your data goes into it. For many organisations, AI arrives through a subscription someone signed, not a system anyone built.
You receive a supplier risk report with a clear recommendation — go, go with conditions, or do not proceed — the questions to put back to the vendor, and the contract points to raise. Contract wording itself is for your solicitor.
The other way round: if your own customers send you AI due-diligence questionnaires, we help you answer them with evidence. Scoped on a call.
What is checked
- Contract and data-processing terms: who owns your inputs and outputs, and whether your data trains their model.
- Where data is stored and processed, sub-processors, and transfers outside the UK.
- Security evidence: ISO/IEC 27001 certificates, SOC 2 reports, penetration-test summaries, incident notification.
- AI-specific claims: accuracy, human oversight features, logging, model provider.
- Exit: how your data is returned and deleted if you leave.
Step 3 · Before you switch it on · New
Copilot Readiness Review
Microsoft 365 Copilot works with whatever each user can already open. That is why the files people can see, but should not, matter before rollout — not after.
You receive a readiness report with prioritised fixes, a DPIA screening statement for the rollout, plain staff guidance and a phased rollout plan with success measures. We review and advise; changes in your Microsoft 365 tenant are made by your IT team or partner unless agreed. Pairs naturally with team AI training. VisionXY7 is independent of Microsoft.
What is reviewed
- Sharing and permissions across SharePoint, OneDrive and Teams: where content is overshared.
- Sensitivity labels and data loss prevention settings.
- Which users and which data are in scope for the first phase.
- DPIA screening for the rollout, and acceptable-use rules for staff.
- A phased rollout plan, with the success measures agreed first.
Step 3 · Before it goes live · New
Pre-launch AI Testing
Prove a chatbot, agent or scoring tool is accurate, fair and secure before customers or staff rely on it — whether we built it or someone else did.
You receive the test plan, the results, every issue with its severity and the fix, and a go-live recommendation. Fixed issues can be re-tested on request. It is the evidence behind “governed first, then built”.
What is tested
- Accuracy on test cases drawn from your real work.
- Bias and fairness across the groups the system affects.
- Security against the OWASP Top 10 for LLM Applications, including prompt injection, sensitive information disclosure and excessive agency.
- Human-review points, and what happens when the AI is unsure.
- Logging: can you reconstruct what it did, and why?
Step 4 · Once it is running · New
Managed AI Governance
Governance that keeps working after go-live: the register stays current, assessments are reviewed when things change, and someone checks that the controls still hold.
Includes up to four DPIA or impact-assessment reviews a year and a quarterly call with Dr Seify; new assessments are priced separately. Minimum six months. Need someone who owns AI decisions and sits on your steering group? See the Fractional Advisory Retainer and Fractional Chief AI Officer.
Every month and quarter
- Your AI register kept up to date: systems, owners, data and risk.
- DPIA and impact-assessment reviews when a system, supplier or law changes.
- A quarterly internal AI review against your policy and the controls you have adopted, with a short report.
- An AI incident response plan, and one practice exercise a year.
- A retirement checklist when a system is switched off: data deleted, access removed, risk record closed.
Questions
Choosing, testing and running AI, answered
Why check an AI supplier before signing?
Because the contract decides who owns your data, whether it trains the supplier's model, where it is processed and what happens when you leave, and those terms are hard to change after signing. VisionXY7's AI Supplier & Tool Due Diligence checks the terms, the security evidence and the AI-specific claims, and ends with a go, go-with-conditions or do-not-proceed recommendation, from £895 per supplier or tool.
Do we need a DPIA before rolling out Microsoft 365 Copilot?
Often. Copilot works across email, chats and files, so it processes personal data at scale, and the UK regulator's AI guidance says that in the vast majority of cases using AI involves processing likely to result in high risk. The Copilot Readiness Review, from £1,100, includes a DPIA screening statement alongside the permissions and oversharing review.
Can you test an AI system that someone else built?
Yes. Pre-launch AI Testing works on any chatbot, agent or scoring tool, whoever built it. It covers accuracy on your own cases, bias and fairness, security against the OWASP Top 10 for LLM Applications, human-review points and logging, and ends with a go-live recommendation. It starts from £1,650 per AI system.
How is Managed AI Governance different from a Fractional Chief AI Officer?
Managed AI Governance keeps the system running: the register, assessment reviews, a quarterly internal review and an incident plan, from £695 a month. A Fractional Chief AI Officer owns AI decisions and sits with your leadership, from £3,500 a month. Many organisations start with the first and move to the second as their AI use grows.
Next step
Tell us what you are about to buy, build or switch on.
Twenty minutes is enough to say which check it needs first — or that it needs none.