AI governance & compliance support for UK SMEs
AI Governance Services for SMEs
Expert AI governance services for UK small and medium businesses: ISO 42001 gap analysis, outsourced DPO support and practical governance frameworks — covering everything from an AI usage policy to vendor due diligence, sector playbooks and staff training.
Every service is priced as a fixed fee or a simple monthly rate, so you know the cost before you start. Buy one-off when a client, insurer or tender asks the question, or bundle them with a Pro subscription for ongoing oversight.
How Trestano Delivers Value
Every Trestano engagement is delivered through our 7-Step Methodology™, helping organisations move from AI adoption to AI assurance.
- 01AI Readiness
- 02Governance Architecture
- 03Attributable Authority™
- 04Governance at Execution™
- 05Governance Operations™
- 06Continuous Assurance
- 07Certification Readiness
The 7-Step Trestano Methodology™
Services mapped to the methodology
Every service supports one or more stages of the path. The shaded stages below are the ones each service covers.
The seven stages
- 01 AI Readiness
- 02 Governance Architecture
- 03 Attributable Authority™
- 04 Governance at Execution™
- 05 Governance Operations™
- 06 Continuous Assurance
- 07 Certification Readiness
Outcome: Understand current maturity, identify risks and establish priorities.
Outcome: Assess ownership, accountability and governance effectiveness.
Outcome: Define decision rights, ownership, accountability and governance structures.
Governance at Execution™ Review
Pilot Programme AvailableOutcome: Validate authority, controls and oversight at the point AI systems act.
Built around Authority Validity Checks (AVC), Execution Boundary Checks (EBC) and Conditional Delegation Rules (CDR).
Outcome: Operationalise monitoring, escalation, intervention and continuous improvement.
Continuous Assurance Review™
Design Phase - Early Adopter Programme AvailableOutcome: Independent governance health checks and assurance reviews.
Outcome: Prepare for certification through evidence, controls and governance maturity.
Not sure which stage you're at? The Diagnostic™ tells you.
Service Portfolio
Service Portfolio
Two ways to work with us: methodology-led strategic services, and practical specialist support you can buy on its own.
Strategic Services
Delivered through the 7-Step Trestano Methodology™ — from first assessment to certification readiness.
Assess
Understand current maturity, identify risks and establish priorities.
Find out more →Assess ownership, accountability and governance effectiveness.
Find out more →
Design
Define decision rights, ownership, accountability and governance structures.
Find out more →Governance at Execution™ Review
Pilot Programme AvailableValidate authority, controls and oversight at the point AI systems act.
Find out more →
Operate
Operationalise monitoring, escalation, intervention and continuous improvement.
Find out more →Continuous Assurance Reviews™
Design Phase - Early Adopter Programme AvailableIndependent governance health checks and assurance reviews.
Find out more →
Certify
Prepare for certification through evidence, controls and governance maturity.
Find out more →
Specialist Support Services
Fixed-fee, practical support that stands on its own — no methodology engagement required.
Vendor reviews
Independent due diligence reports on the AI vendors and tools your business relies on.
£195–£249
Find out more →DPO support
Outsourced DPO and compliance concierge support, on hand whenever you need it.
£495/month
Find out more →Training
Practical AI training that equips your team to use AI tools safely and lawfully.
£19
Find out more →Breach packs
ICO-ready breach response pack — the documents and steps you need if the worst happens.
£249
Find out more →The typical client journey
Typical Client Journey
Most engagements run in this order. Each step answers the question the one before it raises, and each one produces the evidence the next one needs.
The Trestano Methodology™ in practice
Your governance journey
Five stages, from understanding where you stand to being ready for certification. Start wherever you are — each stage builds on the one before.
Stage 1
AI Readiness Assessment™
Understand your organisation's readiness to adopt and scale AI.
- Readiness Index
- Governance Review
- Executive Report
- Roadmap
Outcome: Clear view of readiness gaps and priorities.
Enquire about AI Readiness Assessment →Stage 2
Governance Maturity Review™
Evaluate governance capability against best practice.
- Governance scoring
- Ownership review
- Risk review
- Gap analysis
Outcome: Improved governance visibility and control.
Enquire about Governance Maturity Review →Stage 3
Governance Architecture Design™
Define accountability, controls and oversight.
Built using: Trestano Governance Architecture Model™
- Governance structure
- Accountability model
- Decision rights
- Evidence model
Outcome: A scalable governance framework.
Enquire about Governance Architecture Design →See the Governance Architecture Model™ →Stage 4
Governance Operations Programme™
Operationalise AI governance.
Built using: Trestano Governance Operations Lifecycle™
- Detect
- Assess
- Intervene
- Recover
- Learn
- Improve
Outcome: Operational governance, not just documented governance.
Enquire about Governance Operations Programme →Read about Governance Operations™ →Stage 5
ISO 42001 Readiness Programme™
Prepare for certification and assurance.
- Gap analysis
- Clause assessment
- Documentation support
- Certification roadmap
Outcome: Confidence before certification.
Enquire about ISO 42001 Readiness Programme →
Trusted foundations
Our governance services are built on ISO 42001, ICO guidance and industry-standard AI risk frameworks — published standards you can check us against, not a proprietary methodology.
ISO/IEC 42001
The international standard for AI management systems — the framework our gap assessments, registers and roadmaps are structured against.
ICO guidance
The Information Commissioner's published expectations on AI and data protection, including automated decision-making under UK GDPR Article 22.
Recognised risk frameworks
Industry-standard AI risk approaches, so your documentation speaks the language enterprise buyers, insurers and auditors already use.
Who uses this approach
Operations leaders, compliance teams, directors and founders exploring AI adoption — businesses that need the governance question answered without hiring a full-time specialist.
Operations leaders who need a register of what AI the team actually uses, not a spreadsheet nobody updates.
Compliance and DPO staff who need documentation that stands up when a client, insurer or the ICO asks.
Directors and founders exploring AI adoption who want the governance question answered before it stalls a deal.
Small teams without specialists who have no in-house compliance function and need a practical starting point.
Services & fixed fees
The Trestano platform registers, classifies and documents your AI tools. These services cover the parts that need a person — from your first register to a defensible audit trail.
See pricing and fee options →Featured products
AI Accountability Framework
Know exactly who is accountable for every AI system you run.
£1,450–£1,950
View product →Consequential System Register setup & maintenance
Find the AI systems that can actually hurt your business — and govern them first.
£1,250–£1,650
View product →AI intervention rights & escalation design
Decide in advance how an AI action gets stopped.
£1,750–£2,250
View product →Governance Foundations
Governance Operations
Compliance & Assurance
Managed Services
Training & Capability
Start with the free register either way
Every service works better once we can see what your team actually uses. The free check takes about ten minutes and gives you a risk rating per tool.
AI governance guides →Explore the framework →
AI governance FAQs
Short answers to the questions business owners, ops leads and compliance staff ask most about AI governance, ISO 42001 and data protection officers.
What is ISO 42001?
ISO/IEC 42001 is the international standard for an AI management system — a structured way to govern how your organisation uses AI, covering risk assessment, documentation, roles and oversight. It is increasingly what enterprise buyers and public sector tenders ask suppliers about. For most SMEs, working towards documented alignment is enough to clear a procurement gate; full certification is not always necessary, and our gap assessment tells you honestly which route fits your business.
What does a DPO do?
A data protection officer oversees your compliance with UK GDPR: monitoring how personal data is used, advising on risk, handling questions from staff and regulators, and acting as the contact point for the ICO. A designated DPO must be independent, report to the highest management level and cannot be directed on how to do the job. The role is required where your core activities involve large-scale systematic monitoring or large-scale processing of special category data.
Do SMEs need a DPO?
Most SMEs do not need a formally designated DPO — the requirement only applies to specific processing activities, and the ICO's online checklists help you confirm whether yours qualify. What every business handling personal data does need is accountability: documented oversight of how data and AI are used. If a designated DPO is not required, our outsourced DPO service from £495/month provides named, ICO-aligned oversight without the cost of a full-time hire, and we will tell you honestly if your situation does require a statutory appointment.
How long does a gap analysis take?
Our ISO 42001 gap assessment runs over about three weeks plus a leadership debrief: week one is document review and an evidence request, week two is interviews with the people who own AI decisions, and week three delivers the RAG-rated gap register, prioritised roadmap and costed options. We work from what already exists — your register, policies, risk assessments and any ISO 27001 or Cyber Essentials work all count towards the standard.
What is included in the service?
It depends which service you choose, and every service page lists exactly what is included. The ISO 42001 gap assessment covers a clause-by-clause review, a RAG-rated gap register, a prioritised roadmap, a certification pathway assessment, an evidence pack index and a leadership debrief. The outsourced DPO service includes a named compliance contact, ICO-aligned oversight, policy and register management, incident response support and a monthly governance report. Every service is priced as a fixed fee or a simple monthly rate, agreed before we start.
Still have a question?
Tell us what you're dealing with and we'll answer in plain English — no obligation, no hourly billing.
Ready to get your AI governance in order?
Book a free 20-minute governance consultation and we'll map your exposure, or download the checklist below and work through it yourself.
Free, no signup required — the checklist opens as a PDF you can keep.
Start with a conversation
A free 20-minute call, no preparation needed. Tell us what you're doing with AI and we'll tell you honestly which step, if any, you need next.
Discover your AI Governance Maturity Score
The Trestano AI Governance & Readiness Diagnostic™ measures where you stand across five dimensions — and gives you a prioritised plan for what to do next.
Book a Diagnostic