About Us
We built Trestano because most businesses can't answer one simple question.
Which AI tools does your business actually use?
Not the ones on the approved software list — the ones your team has quietly signed up for because they made a task faster. The chatbot a salesperson uses to draft proposals. The tool marketing uses to write ad copy. The spreadsheet plug-in someone installed to summarise customer feedback.
Most businesses can't give a complete answer to that question. And as of 2026, that's no longer just a minor operational gap — it's a compliance blind spot. The EU AI Act now applies its high-risk obligations directly, reaching UK businesses whose AI touches EU customers or staff. The UK, meanwhile, has no single AI law of its own — instead, compliance means navigating a patchwork of UK GDPR, sector regulators, and general-purpose AI guidance all at once, with no single checklist to follow.
We think that's an unreasonable amount of complexity to expect a small business to absorb on top of actually running the business.
| Region | What SMEs must do | Why it matters |
|---|---|---|
| EU | High-risk obligations apply directly | UK SMEs serving EU customers are affected |
| UK | No single AI law; multiple regulators | Harder to know what's required |
AI rules are changing monthly. SMEs who wait risk discovering their obligations only after a regulator asks the question.
Why businesses struggle
None of this happens through negligence. It happens because AI adoption is fast, easy and invisible — while the compliance side of it is slow, unfamiliar and easy to put off.
Staff quietly sign up for AI tools
A free trial here, a browser extension there. Within months, tools are in daily use that nobody with responsibility for compliance has ever heard of.
No central record of AI usage
The knowledge lives in individual heads and inboxes. When a client, insurer or regulator asks what AI you use and why, there's nothing to point at.
No idea which tools touch customer data
Copying a client brief into a chatbot, or pasting customer feedback into a summariser, sends personal data to a third party — often without anyone realising it counts.
No process for updating compliance documents
Even businesses that wrote a policy once find it quietly goes stale as tools change, staff move on, and the rules evolve underneath it.
Trestano exists to close that gap — one register, one place, kept current.
What we do
Trestano helps organisations move from AI Readiness to Certification Readiness. That happens two ways: a self-service platform that shows you where your AI use actually stands, and a structured methodology that turns that picture into governance which holds up in practice.
Our work covers:
- Diagnostics
- Governance Architecture
- Governance at Execution™
- Governance Operations™
- Continuous Assurance
On the platform side, you tell us what AI tools you're using and how. We tell you where your real exposure sits — plainly, not buried in legal language — and generate the practical documents that go with it: a usage policy your team can actually follow, and an impact assessment for anything higher-risk. As your AI use changes, your register and your documents update with it, so you're not doing this once and hoping nothing's moved since.
No legal team required. No jargon you have to look up. Just a clear picture of where you stand, and what to do about it.
How it works
Three steps, in order. Most businesses finish the first pass in about ten minutes.
Register your AI tools
List every AI tool your team actually uses — from chatbots to spreadsheet plug-ins — with a simple form per tool.
Assess your risks
Each tool gets an instant Higher, Medium or Lower risk rating based on what data it touches and what decisions it influences.
Generate the documents regulators expect
Turn your register into an AI usage policy and a risk & impact assessment — the paperwork a client, insurer or the ICO may ask to see.
What you get
Everything below is produced from the register you build — no separate briefs, no document chasing:
- A complete AI register of the tools your team uses
- Higher, Medium or Lower risk ratings for each tool
- Plain-English explanations of why each rating applies
- An AI usage policy your team can actually follow
- Impact assessments for anything higher-risk
- Automatic updates when your AI use changes
What Trestano is not
We'd rather be upfront than win you over twice. Two promises, in plain terms:
We won't pretend AI compliance is solved forever
The rules are still being written and your toolset will change. Trestano keeps your register and documents current — it doesn't hand you a certificate and disappear.
We won't bury risks in legal jargon
Every rating and document is written so the person running the business can read, understand and act on it. Where something genuinely needs a solicitor, we'll say so plainly.
Built for UK SMEs across sectors
The approach is built for small and medium businesses in sectors with the most immediate AI governance exposure — including:
- Recruitment & HR
- Legal services
- Retail & e-commerce
- Healthcare
- Financial services
- Professional services
Trestano is a young company, and we won't put invented quotes on this page. Instead, ask us — email info@trestano.com and we'll walk you through a live example built on your own sector.
How we think about this
Plain English, always
If a term needs a law degree to understand, we haven't done our job. Every risk rating comes with a one-line reason in normal language.
Built for the size of business we serve
We're not building enterprise GRC software with a six-week onboarding process. Everything here is designed to be completed by one person, in one sitting, without a procurement process.
Honest about what we are
Trestano helps you get organised and gives you a strong starting point — it isn't a substitute for advice from a qualified solicitor, and we'll never pretend otherwise. For anything high-stakes, we'll tell you plainly when it's time to bring in a professional.
Built to keep up, not to be finished once
AI regulation is still being written. Our job is to track what changes and make sure your business doesn't find out about a new obligation after the fact.
Trestano Today
What began as a response to AI compliance challenges has evolved into a governance methodology. Trestano has moved beyond AI inventories and compliance documentation.
Today we help organisations move from:
- AI Readiness
- Governance Architecture
- Attributable Authority™
- Governance at Execution™
- Governance Operations™
- Continuous Assurance
- Certification Readiness
through a structured methodology designed specifically for SMEs.
Our focus is helping organisations build governance that works in practice, not just on paper.
The Trestano Journey™
The Trestano 7-Step Methodology™ in five stages — from AI ambition to AI assurance.
What Makes Trestano Different
Most providers focus on policies.
We focus on governance.
Most organisations can produce a policy.
Far fewer can explain:
- Who authorised an AI system to act
- What authority was delegated
- What boundaries apply
- How decisions are monitored
- How governance remains effective over time
This is the gap Trestano was built to address.
Who's behind this
We kept meeting owners who were excited about AI but terrified of the paperwork — and realised nobody was building tools for them.
Trestano began with a moment that kept repeating: sitting with owners of good, sensible businesses as they realised their teams were using AI tools nobody had approved, nobody had documented, and nobody could now account for — and watching the confidence drain out of the room when a client, an insurer or a tender asked the one question they couldn't answer.
The tools weren't the problem. The silence around them was. Again and again, it wasn't recklessness — it was that the available help was written for companies with legal departments, and the businesses in front of us had an ops lead doing three jobs.
Trestano was founded in 2026 to close that gap: to give small businesses the same defensible picture of their AI use that a large enterprise takes for granted — without the six-week onboarding or the six-figure invoice.
We're a small, UK-based team working across compliance, product and software. If you want to talk to a person about your situation, email info@trestano.com — you'll get a reply from someone who works on the product.
Your data stays yours
We don't sell it, share it, or use it to train models. Everything you enter is encrypted in transit and at rest, and stored in the UK.
- Encrypted
Data is encrypted in transit and at rest.
- UK-stored
Hosted in UK data centres, under UK jurisdiction.
- Never resold
No sharing, no selling, no training on your data.
Ready when you are
Ready to see where your business stands?
It takes 10 minutes, costs nothing, and gives you clarity instantly — a full picture of the AI tools your team uses, the risks that matter, and the documents you can show a client, insurer or regulator.
No credit card. No legal team. Nothing to install.
Discover your AI Governance Maturity Score
The Trestano AI Governance & Readiness Diagnostic™ measures where you stand across five dimensions — and gives you a prioritised plan for what to do next.
Book a Diagnostic