What an AI Safety Check finds in 10 days

The short answer

An AI Safety Check is a short, fixed review of how your team is already using AI. It finds which AI tools are in use, which accounts and plans they sit on, what kind of data goes into them, and which of those risks to close first. Ours takes 10 days and ends with a plain-English report and a ranked list of fixes.

It isn't a compliance certificate and it isn't a sales pitch for new software. It's a clear picture of what is actually happening, so you can decide what to do about it with real facts.

Why a regulated firm needs one

Most firms haven't formally rolled out AI. Their staff have anyway. People use chatbots to draft emails, summarise documents, tidy up notes and check their thinking. Some of that is on approved business accounts. A lot of it is on personal ones.

In a life sciences company, a clinic, a law firm or an accounting practice, that matters. Quality records, patient information, client files and tax data all come with obligations. If someone asked where that data went, most leadership teams couldn't answer today. An AI Safety Check gets you to the point where you can.

If you want to try a first pass yourself, our post on [finding where your team's data is going](/insights/shadow-ai-find-where-your-data-is-going) walks through a do-it-yourself version.

How the 10 days work

Kickoff

We start by learning how your team works and which rules you operate under. A clinic, a law firm and a GxP lab have very different lines in the sand, so the check is shaped around yours.

Team workshop in week one

Early in the first week, your whole team does a 60-minute "Safe AI for your team" session. Staff learn what's safe to put into AI tools and what never goes in. Each person also lists the tasks they'd hand to AI if they could.

That list is useful for two reasons. Your people know the basic rules while the check is still running, not weeks later. And it shows us where your data is likely to go next, not just where it has been.

Discovery

Then we do the looking. A short staff survey, plus a review of the tools, accounts, admin settings and connected apps you already have. We look at which AI features are switched on inside the software you pay for, and which ones were switched on by default.

We don't need to read patient, client or quality records to do this. We look at which tools are used, how they're set up and what kinds of data flow into them.

Findings walk-through

At the end, we take your leadership through the results live, risk by risk. Nothing is sent over ahead of that meeting. Findings in a regulated firm deserve a conversation, not a PDF dropped into an inbox.

Your decision

You then decide what happens next. Close the gaps yourself, or have us do it.

What it usually turns up

Every firm is different, so I won't pretend there's a standard list. But the findings tend to fall into the same handful of areas.

Personal accounts doing company work. Staff using the free or personal version of a tool for work, with no admin view and no control over how the vendor treats that data.

Plan mismatches. The firm pays for a business plan of a tool, while some of the team use the consumer version of the same tool. From the outside it looks approved. It isn't.

AI features nobody switched on deliberately. Email, document, meeting and CRM platforms keep adding AI. Some of it arrives switched on, under terms nobody on your side has read.

Notetakers and browser extensions. Easy to install, often free, and able to capture whole meetings or whatever is on screen. These are a frequent surprise.

Missing agreements. Where patient data is involved, a tool may need a Business Associate Agreement, and that agreement may only cover certain plans. The check flags where the plan in use and the paperwork don't line up.

No written rules. Either there's no AI use policy at all, or there is one and staff have never seen it.

Nobody owning it. AI often sits between IT, compliance and operations, and so nobody is responsible for it. That's usually the root of the rest.

None of this is a sign of a careless team. It's what happens when useful tools arrive faster than anyone can write rules for them.

What you walk away with

• A plain-English findings report: what's in use, what's exposed, and what's fine
• A risk-ranked list of what to close first
• A recommended list of approved tools for your type of firm
• Your team's workshop done, and their task lists captured
• A fixed-scope plan for [Safe AI Setup](/safe-ai-setup)

You keep the report whether or not you work with us afterwards.

What comes after the check

The check tells you what's wrong. It doesn't fix it. That's what [Safe AI Setup](/safe-ai-setup) is for. We put the approved tools in place, set up access controls and logging, write a clear AI use policy, and train every staff member on the approved tools before they sign off. The Safety Check fee is credited in full to Setup.

Our guarantee on Setup is simple: we keep working free until the agreed controls are in place.

After that, Managed Safe AI keeps it that way month to month, as vendors change their plans and terms, new tools appear and staff come and go.

FAQ

What is an AI safety check?

An AI safety check is a short review of how a business is already using AI. It identifies the AI tools in use, the accounts and plans they're on, what data goes into them, and which risks to close first.

How is it different from an AI readiness assessment?

A readiness assessment usually asks where AI could save you time. A safety check asks where AI is already exposing your data. For a regulated firm, the second question normally comes first.

Do you need access to our sensitive data?

No. We review tools, accounts, settings and the types of data flowing into them. We don't need to read patient, client or quality records.

How much staff time does it take?

The 60-minute workshop in week one, a short survey, and a few conversations with whoever looks after your systems and compliance. The rest is on us.

Will an AI safety check make us compliant?

No check can promise that, and the workshop isn't a certification. It shows your gaps and how to close them, so your counsel, compliance or quality lead can make decisions based on what's actually happening.

---

*This post is general information, not legal advice. Assets Digital is not a law firm and does not certify compliance. Your counsel, compliance or quality lead decides what your rules require.*