The highest adoption of any sector. Developers calling models directly.
Information and communication firms lead UK adoption — engineers call model APIs straight from code, and customers now ask whether you can evidence ISO/IEC 42001.
of UK information and communication firms use AI, the highest of any sector (ONS, 2026)
of AI cost now goes to premium models, up from 6% in ten months (Ramp, 2026)
now appears in enterprise procurement questionnaires (BSI/UKAS, 2026)
Accountability stays with a named person.
The ICO (2026): organisations remain responsible for their use of agentic AI, and hallucinations can cascade across tools and databases. Any product sold into the EU carries AI Act obligations, and a supplier that substantially modifies a high-risk system is treated as its provider. NCSC guidance (August 2026) asks for scoped credentials, dedicated identities, logging and a kill-switch for every agent.
Regulator statements summarised from the published guidance; see the sources on the Problems page. This supports compliance; it is not legal advice.
- Code generation and review
- AI features inside your own product
- Support and success automation
- Sales research and outbound
- API spend with no budget line
- Customer data in product AI with no record
- Procurement blocked on evidence you do not have
Gateway routing and metering for API spend with per-team budgets. Ledger for product AI. Change Control and sandbox testing before model switches. Compliance Mapping and ISO/IEC 42001 readiness for the sales cycle.
Four agents, trained for this sector.
The rules, as controls.
- ISO/IEC 27001 and 42001
- UK GDPR and DUAA
- Consumer Rights Act 2015
- Online Safety Act (where applicable)
Issues detected · needs attention first
| Issue | Rule | Severity | Owner | Status |
|---|---|---|---|---|
| Payroll file uploaded to an external AI tool | R-15 | High | HR Director | Blocked · reviewed |
| 31 personal AI accounts found in Sales | R-02 | High | Head of Sales | Migrating · 27 done |
| Customer data in a prompt without redaction | R-01 | High | Ops lead | Redacted · 0 left |
| Premium model used for internal drafts · 412 requests | R-07 | Medium | Engineering lead | Rerouted |
| CRM "AI assist" running without a DPIA | Policy | Medium | Head of Sales | DPIA in progress |
| Agent attempted an external email | R-12 | Low | S. Reid | Held · approved |
| Job | Owner | RAG | Effort | Cost to date | Forecast | Actual | Variance | Return / yr | Status |
|---|---|---|---|---|---|---|---|---|---|
| Migrate personal accounts to managed | IT Director | 12 d | £4,200 | £6,000 · 20 d | £4,200 · 12 d | −£1,800 · −8 d | risk | Done | |
| Route everyday tasks to standard tier | FD | 3 d | £900 | £1,200 · 4 d | £900 · 3 d | −£300 · −1 d | £58,400 | Done | |
| Payroll upload block (R-15) | HR Director | 1 d | £300 | £300 · 1 d | £300 · 1 d | 0 | risk | Done | |
| Collections letters via Comms agent | Head of Collections | 18 d | £11,600 | £14,000 · 25 d | — | on track | £96,000 | In progress | |
| KYC document checks | Head of Onboarding | 9 d | £5,100 | £9,000 · 15 d | — | on track | £61,000 | In progress | |
| Contact-centre adviser assist | Head of CS | 26 d | £19,800 | £16,000 · 20 d | — | +£3,800 · +6 d | £142,000 | At risk · vendor delay |
Effort, cost and return are recorded against each job as it happens. Done means the job is solved in production with its owner’s sign-off, not that a licence was bought.
From this sector.
Our engineers will resist a gateway.
It is one endpoint change and it gives them model choice, budgets and a record. Most prefer it to a spend freeze.
Where does our data go?
Nowhere new. Everything runs inside your own cloud account. Nothing routes through GenWA's infrastructure. Sensitive data is removed before a request leaves your environment.
Find out where your AI stands. Then decide.
Under a minute, an upload, or a visit. Something for the board either way.