AI small business SME audit buying process

What an AI audit is and what you should get from one

Two suppliers can both offer you an AI audit and mean completely different things by it. One is coming to check whether the AI you already run is legal, fair, and documented. The other is coming to work out what AI should do in your business and what it would cost.

Same two words. Different deliverable, different price, different reason to buy. If you don’t know which one is on the table before the call, you will end up paying for the wrong one, and it happens more often than anybody admits.

So this post sorts it out. What each type of audit actually is, which one a business your size probably needs, exactly what you should walk away holding, and what to refuse. If you’re still working out what AI does inside a company your size at all, start with the complete guide and come back. If you’re already shortlisting suppliers, pair this with how to choose an AI consultant.

The two things called an AI audit

1. The compliance audit

This one looks backwards at AI you already use. Is the personal data going into it handled properly, can you show how a decision got made, is there a person checking the output, and have you written any of this down.

There’s a real industry behind it. Frontier Economics counted 524 UK firms working in AI assurance, turning over around £1.01 billion a year and employing more than 12,500 people. Some of it is certification against ISO 42001, some is legal review, some is testing systems for bias.

The ICO publishes what it actually checks, and it’s the clearest free reading available on the subject. Its AI toolkit under the data protection audit framework covers governance, transparency, data minimisation, and human oversight, and there’s a plain guide to how an ICO AI audit runs if you want to see the questions before anyone asks them.

Who needs this now? You do if AI touches hiring, credit, insurance, health, education, or anything else where a wrong output damages a person. You also do if you sell into the EU, because the EU AI Act reaches UK companies whose systems or outputs land on the EU market. The timing shifted this summer: under the Digital Omnibus, high-risk obligations for standalone systems moved to 2 December 2027 and product-embedded ones to 2 August 2028, while the transparency duties stayed put. Deferred, not cancelled.

Who doesn’t? A 20-person business using AI to sort inbound email and draft quotes does not need a certification programme. You need a written note of what the AI touches, what a person still signs off, and where the data goes. That’s an afternoon of writing rather than a fortnight of consultancy.

2. The opportunity audit

This one looks forwards. What does your team repeat every week, what does that cost, which parts could software do instead, and in what order.

This is the one most small and medium businesses are actually shopping for when they type “AI audit” into Google. It’s also the one where quality varies wildly, because there’s no standard for what it contains. Everything below is about this second type.

Why the opportunity audit exists at all

Because adoption has run ahead of anybody counting the results. The British Chambers of Commerce found 54% of UK SMEs actively adopting AI in 2026, up from 35% a year earlier. Very few of those businesses can tell you what it gave them back.

Some of that spend isn’t even visible. Zylo’s 2026 SaaS Management Index found ChatGPT is now the single most expensed application, with expense-based software spend up 267% year on year. That’s AI arriving on staff expense claims rather than through anybody’s budget. Most owners we speak to are surprised by the total when somebody finally adds it up. And the expensed tools are the visible end of it: plenty more is running on free accounts nobody has ever claimed for, which is the subject of shadow AI and what your team is already doing with company data.

An audit is the counting exercise. It turns “we should probably do something with AI” into a specific process, a specific number, and a specific first job.

What you should get at the end

Five things. If a proposal is missing any of them, ask why before you sign.

1. A process map with hours and pounds attached

Not a list of departments. The actual repeatable work: who touches what, how often, how long it takes, and what an hour of that person’s time costs you loaded with employer NI and pension. The cost of manual work walks through the arithmetic, and you can produce a first version yourself in a few minutes with our manual work cost calculator.

This is the part most audits skip, and skipping it makes everything after it unprovable. If nobody costed the before, nobody can demonstrate the after.

2. A ranked list, with the reasoning shown

Every process the audit found, ordered by what to do first, and an explanation of the order. Volume, time per run, how much of it is identical every time, and whether the process has settled down. Which processes to automate first sets out the method we use, and there’s a ranking tool if you want to work it through yourself.

The list must include things ranked at the bottom. An audit that finds 9 good opportunities and no bad ones was a sales document.

3. One working thing, running on your data

A demo on the supplier’s tidy sample data proves nothing. A narrow proof of concept reading your actual records, with your actual formats and your actual mess in it, proves something specific: that this is possible here.

This matters because messy data is what kills these projects. Gartner expects organisations to abandon 60% of AI projects that aren’t supported by AI-ready data through 2026, and found 63% either lack the data practices for AI or don’t know whether they have them. You find that out by pointing something at your data. You don’t find it out in a workshop.

4. A costed plan for the rest

Fixed prices and timelines for the work the audit recommends, so you can put it in a budget without booking another meeting to find out what it costs. If the plan ends with “contact us to scope phase two”, you bought the first half of a sales process.

Running costs belong in here too. Model usage, hosting, the tools you’d keep paying for monthly. Typical third-party running costs for a small business system land somewhere around £150 to £400 a month, and an audit that never mentions them has left a number off your budget. How much it costs to add AI to a small business goes through every line the plan should carry.

5. A written line between the software and your people

Which decisions the AI makes on its own, and which ones route to a named person. Refunds, pricing, hiring, anything with a legal or safety edge. This is the section that keeps you out of the compliance audit above, and a supplier who won’t write it down hasn’t run one of these in production.

What to refuse

A maturity score with no money in it. “Your AI readiness is 42 out of 100” is not a finding. It cannot be actioned, budgeted, or checked a year later.

A tools list. Fourteen products with logos next to them, some of which the supplier resells. You wanted to know what to do, not what to buy.

Recommendations that all point at one product. If every path through the report ends at the thing they happen to sell, the conclusion was written before the fieldwork.

A report with no named owner per recommendation. Work with nobody’s name on it doesn’t happen. That’s most of why pilots never ship.

Anything that stops at the slide deck. Gartner predicted 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, and the pattern behind that number is nearly always the same: everyone agreed with the document, nobody was assigned to build anything.

Free audit or paid audit?

Both exist and they’re not the same product.

A free audit is a sales call. That isn’t an insult, it’s a description. It runs an hour, it’s done by someone with a quota, and it ends in a proposal for their services. You should still take one, or several. You’ll learn how each supplier thinks, what they ask about, and whether they lead with your process or their stack.

What a free audit can’t be is two weeks of engineering time. Nobody maps a 20-person business, costs every process, and builds something working on your data for nothing. If someone offers all of that free, the price is somewhere else in the deal.

The practical order: take the free calls, use them to shortlist, then pay for depth once. And check whether the fee is credited against the build. If it is, the real question isn’t whether the audit is worth it, it’s whether you trust them to do the build.

What it costs you in time

More than owners expect on access, less than they fear on meetings.

  • A kick-off with whoever actually does the work, not just whoever manages it. 90 minutes.
  • Read access to real systems and real records. This is the bit that slows audits down. Sort it in week one.
  • Two or three short check sessions to confirm the map matches reality.
  • One person who can say yes. Not a committee.

Call it 4 to 5 hours across a fortnight from your side. If a supplier wants three full days of workshops from your team, they’re building their understanding out of your time rather than their own effort.

When the honest answer is “don’t build”

Sometimes the finding is that the process changes too often to be worth automating, or that the fix is a tool you already pay for that nobody set up, or that a rule change removes the work entirely. Build vs buy for AI sets out the conditions that have to be true before building beats renting, and how often the honest answer is renting.

A good audit says so and hands you the map anyway. Most owners tell us it’s the first time they’ve seen where the hours actually go, and that’s worth having whether or not anybody writes code afterwards.

If a supplier has never once recommended against building, ask them why. Everybody who does this work for real has turned something down.

Questions to ask before you buy one

  1. What do I physically have in my hands on the last day?
  2. Will something be running on my own data, or on your sample data?
  3. Are the recommendations priced, or do I need another meeting to find out?
  4. What have you told a client not to do, and what happened?
  5. Is the fee credited against the build, and is that written in the agreement?
  6. Who is doing the work, and are they the person who’d build it afterwards?
  7. Do I own what the audit produces, and can I take it to another supplier?

Seven questions, none of them technical. The answers sort the field fast. That last one has a longer answer than it looks: who owns the code and the data goes through it properly.

How ours works

We sell this, so read the following as a description of how we do it rather than neutral advice.

Our AI audit runs two weeks on a fixed price agreed in writing before it starts. You get every repeatable process mapped and costed in hours and pounds, a ranked list of what AI should take over first with our reasoning shown, one working proof of concept built on the top item and running on your real data, and a costed plan for the rest with fixed prices so you can budget without another call. It takes about 4 to 5 hours of your side’s time. The fee comes off a build in full if you start one within 90 days, and if we conclude you shouldn’t build we hand over everything anyway.

The proof behind that: Founderise took 12 hours a week off its founder and lifted margin 3.5x, with an MVP live in 9 weeks. MidShift has served more than 20,000 professionals and moved people through career progression 92% faster.

Hold every other supplier against the same five deliverables. If one of them answers better, hire them.

The short version

An AI audit means two different products. The compliance one checks the AI you already run and matters most if you’re in a regulated area or selling into the EU. The opportunity one works out what to build and in what order, and that’s the one most businesses are shopping for.

A good opportunity audit hands you five things: a costed process map, a ranked list including what not to do, one working thing on your own data, a priced plan, and a written line between the software and your people. Anything less is a document, and documents don’t take hours out of anybody’s week.

Want to know what’s actually in your week before you buy anything?

Run the manual work cost calculator first and walk into every supplier conversation holding a number. Then book the call and bring your worst process. We’ll tell you what we’d do with it, what we wouldn’t touch, and whether you need an audit at all.

Book a free call, or read what the AI audit covers in detail.

Want to see what this looks like for your business?

Book a free architecture audit. We'll map out where the bottlenecks are and what a custom platform could look like.

Book a free audit