Where does your organisation stand on AI?
Most Boards cannot yet answer, from evidence, five questions: where AI is being used in the organisation, what personal data and other information it touches, who authorised it, what supports the decisions it shapes, and where human judgement remains.
Parliament is debating how AI should be regulated; employees are already using it. The gap between those two is a governance gap, and it does not depend on what legislation eventually says.
Mediajem offers two ways to close it, in proportion to what your organisation needs: a short fixed-fee review, and a full gap analysis with a Board-ready report for organisations that want to go further.
Both treat AI and data protection as one question, because in practice they are: what information the AI touches, about whom, on what basis, and who decided.
Both are built on the same structured method, applied by an experienced practitioner, and neither will hand you a colour-coded scorecard.
AI & Data Governance Review — £295
A structured, fixed-fee starting point. It tells you where you stand, what matters most, and whether anything further is warranted.
What happens.
You complete a short questionnaire (about fifteen minutes) about your organisation, the AI already in use and what has prompted the enquiry.
We then hold one structured session of ninety minutes by video, for up to three people from your organisation, working through the questions a Board would have to answer: where AI is used, including tools staff have adopted on their own initiative; who decided; what personal data and other information is involved, and on what basis; who can stop it; what evidence exists; what happens when something goes wrong; and what the Board has been told.
What you receive.
Within seven working days, a Findings Note of four to five pages: an inventory of AI use as disclosed to us; your position against each of the eight governance capabilities we assess, with the reasoning for each; the three exposures that matter most; three proportionate actions for the next ninety days; and a plain statement of whether a full gap analysis is warranted. Sometimes it is not, and we will say so.
Fee.
£295, fixed, plus VAT where applicable. The fee is credited in full against a Gap Analysis commissioned within sixty days.
Book a Review
Enquire about an AI & Data Governance Review
Complete the form below to tell us a little about your organisation and what you would like to discuss.
Submitting this form is an enquiry only. It does not confirm a booking or create an obligation to pay. We will contact you to discuss the next steps.
Please do not include names or identifying details of employees, customers or service users, confidential documents, or sensitive case information in your responses. A secure means of sharing any information needed for an agreed engagement will be arranged separately.
We use the information you provide to assess and respond to your enquiry and, if you decide to proceed, to prepare for your Review. Please see our Privacy Policy for details of how we handle your information.
You will not be subscribed to marketing updates unless you separately choose to receive them.
AI & Data Governance Gap Analysis and Board Report — from £2,950
For organisations whose Board or executive needs an evidenced answer, not an impression. Scoped and quoted after a review.
What it includes.
A review of your AI and data protection documentation: policies, impact assessments, records of processing, supplier terms for AI services, incident records and the Board papers that mention AI, tested for whether they describe what is actually happening rather than whether they exist.
Four to six structured interviews across leadership, technology, data protection and the business owners of AI uses.
A short anonymous staff survey, because what leadership believes about AI use and what staff actually do are rarely the same.
An inventory of the AI actually in use, with the personal data, other information and decisions each touches.
An assessment against eight governance capabilities that keeps a clear line between what the law requires, what a regulator expects, what a standard recommends and what good governance suggests.
A read-across to the mechanisms you already run (impact assessments, records of processing, risk register, information security controls, procurement, internal audit, Board reporting) so that the recommendations extend what exists rather than creating a parallel bureaucracy.
What you receive.
A Board report of twenty to twenty-five pages with a two-page Board summary written to be read in ten minutes, and a sixty-minute presentation to your Board or executive. The report states its evidence standard and what it did not examine.
Scope.
AI and data protection together, always. Where an organisation turns out to have little material AI use, the report says so and the data protection findings carry the weight; where data protection is already mature, the report concentrates on the AI uses that framework has not yet caught. Where your organisation also operates under a sector regime, such as the FCA's cryptoasset rules, that regime is part of the same picture.
Fee and timing.
From £2,950 for a small organisation; £4,950 to £7,950 for a medium or regulated one; quoted above that. Plus VAT where applicable. Three to four weeks from start to Board presentation.
Ongoing governance support
For organisations that have completed a gap analysis, Mediajem offers ongoing support on a monthly basis: keeping the inventory, the evidence and the Board reporting current as systems, suppliers and uses change, and answering the questions that arise in between. It continues the fractional model we already provide for data protection. Details on request following a gap analysis.
Our Expertise and Approach
The work is done by Vera Ishani and her team of associates. Vera is the founder of Mediajem, a former COO and registered Data Protection Officer in FinTech who has worked directly with the FCA and the ICO, with specialist associates brought in where a sector requires it.
The method is Mediajem's own, developed from primary research into UK and EU law, regulator guidance and standards; it is applied by people, and the judgement in the report is ours.