Skip to content
CareersFree demoConsult an expert

Monthly AI advisory and fractional CTO

Each month a named adviser keeps the AI tools and agents you run under review, tells you in writing what changed and what to do, and can act as your technology lead for part of the month.

Request an advisory arrangement
Consulting

AI changes on the supplier's timetable, not yours.

What we do

Every AI tool and agent you run gets an owner, a record and a regular check.

Suppliers switch on new AI features, models are updated on the supplier's schedule, and staff adopt new assistants between one board meeting and the next. An agent that passed its tests before launch can behave differently after a change nobody at your end made. Renewal notices and requests for a technical view land with whoever opens them, and the decisions still get made, without an owner.

We act as your AI adviser each month, with a scope agreed with your team before work begins.

We keep a register of the AI tools and agents you run, send a short written brief each month on what changed and what to do about it, run the agreed test cases again against each agent in scope, and review any incident you report.

Where you need more, we act as your technology lead for suppliers, renewals and the technical side of your board papers. We also build software, so when advice could lead to work for us, we say so in writing and name who else could do it.

The recommendation may be to buy a product, renew what you have or change nothing.

What the published figures say about software buying

31%
of UK businesses had a board member or trustee with explicit responsibility for cyber security (30% of charities, 68% of large businesses).
22%
of businesses considered cyber security to a large extent when buying software (17% of charities).
15%
of businesses reviewed the cyber security risks posed by their immediate suppliers. 6% looked at the wider supply chain.
27%
of businesses named external cyber security consultants, IT consultants or cyber security providers as a source of cyber security information, the most common single answer (13% of charities).

Source: Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026

All four figures come from one government survey of UK businesses and charities, with fieldwork from August to December 2025. The survey notes that not all businesses have a formal management board, which may reduce the board figure for businesses. The sources of information question was unprompted for the telephone respondents, who made up 94% of organisations.

What an advisory arrangement covers

Monthly AI advisory and the fractional CTO role are retained each month. The other four run inside either one or as a single piece of work. Every recommendation is written down with the options considered and the reason for the choice.

Illustrative stock photo: a man seated at a desk by a window points with a pen at a printed report while a colleague stands beside him and listens.
Illustrative photography. The work is shaped around your organisation.
Monthly AI advisory

Retain a named adviser for the AI tools and agents you run and the ones you are considering. Each month, get a short written brief on what changed and what to do, and a check of each agent against the test cases agreed for it.

  • A monthly brief on changes in AI, regulation and your suppliers, each marked adopt, stop, watch or no action
  • An AI register: every tool and agent, its owner, the data it touches, and its next DPIA and supplier review dates
  • The agreed test cases run again each month against each agent in scope, with any change in results reported
  • A review of any incident you report, including whether the agent's level of autonomy still fits
  • A quarterly review of the register, incidents and decisions due, written for your board
  • An agreed route for questions and a response time set out in the engagement
Fractional CTO

Retain a named technology lead for part of each month to own your roadmap, suppliers and technical decisions between projects. Route every technical question to one person, and get each answer in writing.

  • A register of your systems, suppliers, contracts and admin accounts
  • A technology roadmap kept current
  • Attendance at the board, steering or management meetings where technology is decided
  • Decision records: the options, the recommendation and a date to revisit
  • Written disclosure whenever advice could lead to work for us
Supplier and renewal reviews

Review contracts, renewals and price rises before the notice date passes, and put the right questions to the supplier. Decide each renewal with the alternatives, the exit terms and the running cost in front of you.

  • A renewal calendar with every notice date, kept up to date
  • Supplier questions from the government's voluntary Software Security Code of Practice, including at least a year's notice before support ends
  • Processor terms and sub-processors read against UK GDPR Article 28
  • Exit terms: data export format, who holds the hosting account, who owns the code
  • A written recommendation to renew, renegotiate, replace or stop
Board and committee papers

Write or check the technical sections of board and committee papers, and present them when the item is technology. Give members who are not technical a summary they can question.

  • A plain-English summary stating the decision asked of the board
  • Options, costs and risks set side by side
  • Cyber security items set against the five principles of the government's Cyber Governance Code of Practice
  • Attendance to present the item and take questions
  • A decision record filed with the papers
Technical due diligence

Assess a system, supplier or software business before an investment, acquisition or major contract. Find out what its code, hosting, licences and people would cost you to take on.

  • Code, dependency and open-source licence review
  • Hosting, backups and the evidence of a recent restore test
  • Admin access, domains and who owns each account
  • Key-person dependency: what only one person knows
  • A risk list ranked by cost to fix
First technical hire

Write the role, set the technical exercise and sit on the panel when you hire your first developer or IT lead. Give the person you appoint clear first priorities and the access to act on them.

  • A job description scoped to the systems you run
  • A practical exercise with a marking scheme set before interviews
  • A seat on the interview panel
  • An induction plan with first priorities
  • A handover of admin access from suppliers or founders to the new hire

What you get

What the arrangement covers

  1. One register records every AI tool and agent you run, who owns it, the data it touches and when it is next reviewed.
  2. The agents you run are checked each month against the test cases agreed for them, and any change in their results is reported.
  3. Each month's brief says what changed and what to do about it: adopt, stop, watch or no action.

Ways to work

Advisory arrangements

Every arrangement names the adviser, the agents and systems in scope, the time held for you each month, how requests reach us, how quickly we reply and the notice either side gives. We set each of those in writing before any work starts.

Monthly AI advisory

A named adviser for the AI you run and the questions around it, answering in writing as they arise, without a standing seat in your meetings.

  • The monthly brief: what changed and what to do
  • The AI register, kept current
  • The agreed test cases run again against each agent in scope
  • An agreed route for questions and a response time set out in the engagement
  • Written answers to technical and supplier questions
  • A quarterly review written for your board
  • Written disclosure whenever advice could lead to work for us

Fractional CTO

A named technology lead for a set part of each month, who owns the roadmap and the suppliers and attends the meetings where technology is decided.

  • Everything in monthly AI advisory
  • Attendance at board, steering or management meetings
  • Technical sections of board and committee papers
  • The technology roadmap and the systems register
  • Supplier meetings and escalations

Interim technology lead

Cover between a departing IT lead, developer or supplier and a permanent appointment, ending in a written handover to the person you hire.

  • Takeover of admin accounts, domains and hosting access
  • Day-to-day supplier management
  • The role, exercise and interview panel for the permanent hire
  • A written handover and a planned end to the arrangement

Any arrangement can be resized at a quarterly review.

How it runs

Setting up and running an arrangement

  1. 01

    AI and systems inventory

    List the AI tools and agents you run or are considering, your systems, suppliers, contracts, renewal dates and admin accounts, and record the decisions already due.

  2. 02

    Arrangement in writing

    Set who advises, which agents and systems are in scope, the test cases for each agent, the time held for you each month, how requests reach us, who can make them and the notice either side gives.

  3. 03

    The brief, the checks and the questions

    Send the written brief each month, run the agreed test cases again, review any incident, and answer supplier proposals, renewals, hiring questions and board items as they arise, each in writing with the options and the reason for the recommendation.

  4. 04

    Quarterly review

    Report on the AI register, incidents, spend, risks, supplier performance and the roadmap, list the decisions due next quarter, and resize the arrangement if it no longer fits.

Read

Read the research.

Cover of the brief Before you sign: questions for any software supplier

Brief

Before you sign: questions for any software supplier

A short brief that turns the government's Software Security Code of Practice, UK GDPR Article 28 processor terms and exit terms into questions a board can put to any software supplier, including us.

Format
PDF, 4 pages
Published
July 2026
Download the brief

Worth asking first

  • Which AI tools and agents does your organisation run today, and who owns each one?
  • When a supplier last updated the model behind one of your AI tools, who checked what it changed?
  • Which of your contracts renew automatically in the next twelve months, and on what date does each notice period close?
  • Which of your suppliers could you not replace within a year, and what would it take?
  • Who on your board owns cyber security risk? The Cyber Governance Code of Practice, written for medium and large organisations, asks boards to define that ownership.
  • Which technology decision made last year would you like to have had challenged?

Talk to us if

  • An AI agent or assistant is live, and nobody has checked its answers since launch.
  • A supplier has switched on new AI features in a product you already use.
  • A supplier's renewal or price rise has arrived and it will be accepted unless someone tests it.
  • Your IT lead or sole developer is leaving, and the role needs covering until a permanent appointment.
  • The board has asked for a technology or cyber security paper and no member can write the technical section.
  • You are about to invest in, buy or sign a major contract with a software business.
  • You are hiring your first developer or IT lead and need someone technical on the interview panel.
  • Technology spend rises each year and nobody owns the roadmap it is meant to serve.

Questions

Questions buyers ask

What does the monthly check on an agent involve?

At the start we agree a set of test cases for each agent or AI system in scope, drawn from your own past work with personal data removed where the test allows. Each month we run the same cases again, compare the results with the previous run and report any change. It is a check against cases you agreed, not an audit or a certification, and it does not replace the day-to-day oversight your own staff provide.

Do you monitor our AI around the clock?

No. The arrangement covers a monthly check, a review of any incident you report and written answers to your questions. Continuous monitoring has to sit with your own team or your supplier, and we can help you specify what it should watch.

What if a renewal could become work for you?

The written recommendation says so, names who else could do the work, and sets that route beside renewing, renegotiating or stopping, each with its cost and exit terms.

Does technical due diligence cover the legal and financial side?

No. We assess the code, hosting, security, licences and the people a system depends on. Legal, financial and tax due diligence stay with your solicitors and accountants, and we write our findings so they can use them.

Which parts of a contract do you read?

The technical terms: support periods, data export, processor terms and exit. We refer to public guidance such as the Cyber Governance Code of Practice, give no legal advice on contracts or directors' duties, and leave anything contractual for your legal advisers to sign off.

What happens when a question needs more than the arrangement covers?

We say so and propose a separately scoped piece of work, such as an options appraisal or an architecture review, priced on its own. You decide whether it goes ahead and who does it.

Can the arrangement change size or stop?

Yes. The quarterly review asks whether the arrangement still fits, and the agreement sets the notice either side gives. Both are written down before any work starts.

We keep your AI under review, month by month.

Send us the AI tools and agents you run, and the renewals and board items due next quarter, and we will propose an arrangement sized to them.

Request an advisory arrangement