Written from hands-on implementation and audit experience — not generic checklists. Each guide links to the related service if you want implementation support.
What ISO 27001 covers, how the audit stages work, and how to scope an implementation.
Understanding the AI management system standard and where it fits alongside the EU AI Act.
Type I vs Type II, the Trust Services Criteria, and what a readiness programme looks like.
Follow one control from risk to evidence, and test ownership before audit week.
What a consultancy quote should include before you compare the headline fee.
Test readiness with real scenarios: data requests, deletion, suppliers and new AI tools.
Build a system-level record and map your role before collecting documents.
Connect every evidence request to the control objective, period and owner.
Reuse the governance process you already have — and examine where the AI risk discussion changes.
Start with the contract, information flow and system boundary before budgeting for readiness work.
Five questions a UK health technology supplier should ask before promising a scope, timeline or result.
Who genuinely needs it now, who can wait, and the trigger events that change the answer.
What's shared, what's genuinely new, and which order to tackle them in.
How to build one governance system that satisfies both.
Why ISO 42001 helps but doesn't automatically satisfy the Act, and what to map first.
What a proper AIMS gap assessment covers, from AI inventory to Annex A coverage.
What actually drives implementation cost and timeline — without invented price tags.
A startup budgeting view: consultancy, certification body and internal time, plus timeline phases.
The AI management control objectives auditors expect to see evidenced.
How to determine your role for each AI system, and why it decides which obligations apply.
What must be documented, for which risk tier, framed as informational guidance.
What was deferred, what applies now, and a 90-day readiness checklist for AI startups.
Triage, ownership, answer banks, and the most common mistakes.
What each format covers, when it's used, and how to prepare for each.
Structure a reusable answer bank and keep it consistent as certifications evolve.
AI tools vs an answer bank vs a consultant, and when each fits a startup.
Minimal viable scope and the mistakes early-stage teams make.
What a proper gap assessment delivers, and how to use it to plan budget and timeline.
What each proves, which buyers ask for which, and whether you need both.
A realistic month-by-month path from kickoff to certificate.
Fixed fee vs day rate, questions to ask, and red flags to watch for.
Why a UK company ends up needing a US-style attestation, and how to run the process from here.
What each report actually proves, and which one your customer is really asking for.
Kickoff to report, including the Type II observation window and common delays.
What auditors expect, organised by Trust Services Criteria.