AI in the back office. Engineering IP in the prompt.
Most manufacturers use AI somewhere — almost all of it back-office — while engineering and commercial IP gets pasted into tools nobody has reviewed.
of manufacturers have AI widely embedded (Make UK, 2026)
of manufacturers' AI use is back-office (Make UK, 2026)
adoption in transport and storage; 90% neither use nor plan (DSIT, 2026)
Accountability stays with a named person.
UK GDPR and the Data (Use and Access) Act apply to staff and customer data in any AI tool. The ICO’s recruitment findings (March 2026) apply to any employer using AI to screen candidates. Customers increasingly ask suppliers to declare AI use and evidence controls, as public bodies now must under Procurement Policy Note 017.
Regulator statements summarised from the published guidance; see the sources on the Problems page. This supports compliance; it is not legal advice.
- Quotes, tenders and technical documentation
- Supplier and customer communications
- Quality and maintenance notes
- Planning and scheduling support
- Drawings, formulations and pricing in public tools
- AI features inside ERP and PLM nobody reviewed
- Skills gap: staff lack time to train
Gateway redaction for IP and pricing. Register for AI inside operational software. Rules for what may be shared, by whom. Library so the quoting and documentation work is shared. Cyber Essentials pathway with Compliance Mapping.
Four agents, trained for this sector.
The rules, as controls.
- Cyber Essentials and NCSC
- Export control and IP
- Health and safety reporting
- UK GDPR and DUAA
Issues detected · needs attention first
| Issue | Rule | Severity | Owner | Status |
|---|---|---|---|---|
| Payroll file uploaded to an external AI tool | R-15 | High | HR Director | Blocked · reviewed |
| 31 personal AI accounts found in Sales | R-02 | High | Head of Sales | Migrating · 27 done |
| Customer data in a prompt without redaction | R-01 | High | Ops lead | Redacted · 0 left |
| Premium model used for internal drafts · 412 requests | R-07 | Medium | Engineering lead | Rerouted |
| CRM "AI assist" running without a DPIA | Policy | Medium | Head of Sales | DPIA in progress |
| Agent attempted an external email | R-12 | Low | S. Reid | Held · approved |
| Job | Owner | RAG | Effort | Cost to date | Forecast | Actual | Variance | Return / yr | Status |
|---|---|---|---|---|---|---|---|---|---|
| Migrate personal accounts to managed | IT Director | 12 d | £4,200 | £6,000 · 20 d | £4,200 · 12 d | −£1,800 · −8 d | risk | Done | |
| Route everyday tasks to standard tier | FD | 3 d | £900 | £1,200 · 4 d | £900 · 3 d | −£300 · −1 d | £58,400 | Done | |
| Payroll upload block (R-15) | HR Director | 1 d | £300 | £300 · 1 d | £300 · 1 d | 0 | risk | Done | |
| Collections letters via Comms agent | Head of Collections | 18 d | £11,600 | £14,000 · 25 d | — | on track | £96,000 | In progress | |
| KYC document checks | Head of Onboarding | 9 d | £5,100 | £9,000 · 15 d | — | on track | £61,000 | In progress | |
| Contact-centre adviser assist | Head of CS | 26 d | £19,800 | £16,000 · 20 d | — | +£3,800 · +6 d | £142,000 | At risk · vendor delay |
Effort, cost and return are recorded against each job as it happens. Done means the job is solved in production with its owner’s sign-off, not that a licence was bought.
From this sector.
We are not a tech company. Is this too much?
The SME plan is managed accounts, three rules and one page a month. The audit is fixed-fee and tells you if you need more.
Where does our data go?
Nowhere new. Everything runs inside your own cloud account. Nothing routes through GenWA's infrastructure. Sensitive data is removed before a request leaves your environment.
Find out where your AI stands. Then decide.
Under a minute, an upload, or a visit. Something for the board either way.