The problem
What is Shadow AI, and why is it already inside your firm?
Shadow AI is the unapproved AI tools staff use without oversight — free chatbots, browser extensions, AI features switched on inside existing software.
A fee earner with a five o'clock deadline pastes three paragraphs of a client file into a free chatbot and asks it to tighten the language. The letter improves. Nobody is told, because there is nothing to tell: no policy was broken, because no policy exists.* It is rarely malicious. It is always your liability.
This is not misconduct. It is initiative without infrastructure. For a law firm it puts SRA confidentiality duties in question. Under UK GDPR, client data has gone to a third party with no processing agreement — and if that is a reportable breach, Article 33 gives you 72 hours to notify the ICO. The same pattern engages FCA Consumer Duty.
A building surveyor runs site photographs through an AI defect-detection tool before writing up. It is quicker, and the report reads well. There is no record of which tool, which version, or what it did not flag — and since March, the RICS standard has required a register of exactly that.*
The cost is not a fine on day one. It is the moment you are asked for evidence and have none.
* A composite pattern, not a client case study.
Jurisdiction
Which AI rules actually bind your firm?
Most of them are already in force, and most of them are British.
UK GDPR and the Data Protection Act 2018 apply to any AI use that touches personal data. Every firm, every sector, no threshold. The accountability principle requires you to demonstrate compliance, not merely achieve it.
RICS members and regulated firms. The Professional Standard on responsible use of AI in surveying practice has been mandatory since 9 March 2026, wherever AI has material impact on surveying services. It requires a written AI use policy, a register of AI systems in use, and a risk register documenting risks including bias and erroneous outputs. Separately, RICS CPD Rules made AI, data and technology a mandatory training topic from January 2026.
Law firms. SRA confidentiality and competence duties apply to AI-assisted work exactly as they apply to any other work.
Financial services. FCA Consumer Duty has applied since 31 July 2023 and covers outcomes influenced by AI.
The EU AI Act — Regulation (EU) 2024/1689 — is EU law, not UK law. It binds UK firms only where they have EU operations, EU clients, or systems or outputs used in the EU market. Article 4, requiring documented staff AI literacy, has applied since 2 February 2025.
If your business is UK-only, you do not need Article 4 compliance — and any consultant who tells you otherwise is selling you the wrong problem.
Check each of these yourself. None of it is prediction. All of it is in force.
What Dousatsu does
What does standing behind your AI use require?
Three things, all documented: a register of what is in use, training records, and a decision trail. UK GDPR's accountability principle requires firms to demonstrate compliance, not merely achieve it.
Governance
Shadow AI Audit
Builds the register. The Shadow AI Audit combines network and SaaS usage analysis with no-blame staff disclosure sessions. You receive a register of every AI tool in use, a data-flow map, a risk classification for each finding, a remediation plan and a usable AI policy — evidence you can put in front of a regulator, not a slide deck. Delivered over a 30-day engagement; for firms with EU market exposure, an EU AI Act Article 4 review is included.
from £2,500 + VAT
Training
AI Training & Literacy
Builds the training records. Bespoke training for individuals and teams — Claude-specific or broader AI literacy, in half-day, full-day, online or in-person cohort formats. For firms in scope of the EU AI Act, every session produces the documented records Article 4 requires. For UK-only firms, documented training is the accountability evidence the ICO expects.
Priced per cohort or engagement — quoted in writing before you commit
Opportunity
AI Opportunity Audit
For firms not yet using AI. The business mapped, highest-value opportunities identified, risks flagged, and a prioritised roadmap delivered in five working days.
From £995
Implementation
AI Implementation
Workflow automation, tool selection and integration — built to your operations, not a generic template.
Scoped per engagement
Govern first. Then build. The order is the point.
Accountability
Who answers for this work?
Founded by
Chris Hampson
AI Governance Consultant · Dousatsu AI Solutions
Northwest England · Regulated sectors · Evidence-based
Chris Hampson, founder of Dousatsu — a business owner himself, working with regulated UK SMEs in legal, financial services and property. Every engagement is delivered personally, through DIOS — Dousatsu's five-plane AI governance framework: not an account manager, not a junior.
"Some of this law binds you. Some of it does not. I will always tell you which is which. Most won't."
DIOS
Dousatsu's five-plane AI governance framework: Control · Data · Memory · Trust · Intelligence
UK jurisdiction accuracy
Every obligation routed to the regulator that actually binds you — ICO, FCA, SRA, RICS
Named-person delivery
Chris Hampson delivers every engagement personally
Evidence standard
Every claim traceable to a named source
Prices
How much does an AI governance consultant cost in the UK?
Three rows carry fixed entry prices. Two are scoped — and where a row says "scoped" or "per cohort", you receive a fixed written quote before any work begins, and it does not move afterwards. "From" is the genuine entry point, not an anchor.
Why publish prices? Because regulated firms budget in numbers, not in discovery calls. Dousatsu does not sell AI. It sells governed, accountable AI infrastructure — work you can stand behind in front of a regulator, a client, or a board.
Free · 5 minutes · No signup
Not sure where you stand?
7 questions. Scored against UK GDPR accountability expectations and Shadow AI exposure. Results shown immediately.
Start the conversation.
Tell us where you are. We'll tell you where the risk is.
Or email us directly at chris.hampson@dousatsu.co.uk
Frequently asked questions
How much does a Shadow AI audit cost in the UK?
Dousatsu's Shadow AI Audit starts at £2,500 + VAT for UK SMEs, delivered over a 30-day engagement. Shadow AI means AI tools staff use without approval or oversight. The audit delivers a register of every AI tool in use, a data-flow map, risk classifications, a remediation plan and a usable AI policy. For firms with EU market exposure, the audit also covers EU AI Act Article 4 review.
What is Shadow AI?
Shadow AI is the use of AI tools — chatbots, browser extensions, unvetted apps — by staff without their employer's approval or oversight. In regulated firms it creates data-protection risk under UK GDPR, because client and personal data can leave the organisation with no contract, no risk assessment and no record.
Does the EU AI Act apply to my UK business?
Only if you have EU operations, EU clients, or systems or outputs used in the EU market. The EU AI Act (Regulation (EU) 2024/1689) is not UK law. UK-only firms are governed instead by ICO guidance under UK GDPR, FCA Consumer Duty, SRA rules, the RICS AI Practice Standard, and the UK Data (Use and Access) Act 2025.
Does the RICS AI standard apply to my firm?
The RICS Professional Standard on responsible use of AI in surveying practice has been mandatory since 9 March 2026 for RICS members and RICS-regulated firms, wherever AI has material impact on surveying services. It requires three documented items: a written AI use policy, a register of the AI systems in use, and a risk register covering risks including bias and erroneous outputs. The standard does not define material impact quantitatively, so scope is a self-assessment — and a documented self-assessment is worth considerably more than an assumed one.
What is EU AI Act Article 4?
Article 4 of Regulation (EU) 2024/1689 requires organisations providing or deploying AI systems to ensure their staff have sufficient, documented AI literacy. It has applied since 2 February 2025 and binds UK firms only where they have EU exposure. Where it applies, Article 4 review is included in Dousatsu's Shadow AI Audit, from £2,500 + VAT.
Will a Shadow AI Audit get my staff into trouble?
No. Disclosure sessions run on a no-blame basis. Staff who used unapproved tools were solving real problems without infrastructure — the audit exists to replace prohibition with governed access, not to discipline initiative.
Does AI literacy training make sense for a UK small business with no EU exposure?
Yes. Dousatsu's AI Training & Literacy (Track 03) teaches staff what AI tools can and cannot safely do with firm and client data. For UK-only firms the driver is UK GDPR, professional-conduct obligations and Shadow AI risk — not the EU AI Act. Delivered in half-day, full-day, online or in-person cohorts, priced per cohort with a written quote up front.
What happens on a scoping call?
Thirty minutes with Chris Hampson, Dousatsu's founder. You describe the firm, the regulatory context, and what prompted the call. You leave with a recommended engagement, a fixed written price, and a start date. No obligation follows the call.
Written by Chris Hampson, founder of Dousatsu. Delivered through DIOS, Dousatsu's five-plane AI governance framework.