Skip to content

Engineering, cloud and support

+44 20 4604 8374
Hexploits

Applied AI

AI readiness assessment for SMEs and enterprises

AI readiness is a business’s ability to adopt AI safely, lawfully and profitably. An AI readiness assessment establishes where you stand on the five things that decide it: regulatory exposure under the EU AI Act and GDPR, the state of your data, security and access control, staff policy and AI literacy, and whether there is a use case with a measurable return. Hexploits delivers it as fixed-price discovery, ending in a prioritised roadmap your board can act on, and builds what the roadmap calls for if you want us to.

Request a proposalTalk to an engineer

A named engineer replies within one working day. A written scope and an indicative price within two.

Who this is for

  • SMEs whose staff are already using AI tools and who need a policy, an inventory and a first use case worth building.
  • Enterprises with AI being adopted in several business units at once and no single register of what is running.
  • IT and operations directors asked to "get the business ready for AI" without a definition of ready.
  • Compliance and data protection leads who need the facts about AI systems before they can sign them off.
  • UK businesses selling into the EU who are unsure whether the EU AI Act applies to them.

What you get

Deliverables, not slogans. Each one appears in the statement of work.

  • An inventory of every AI system and AI feature in use, bought or built, including the tools staff use on their own initiative, each with an owner.
  • A classification of each system under the EU AI Act risk tiers, with provider or deployer role and the reasoning written down.
  • A GDPR review of the AI systems that touch personal data: lawful basis, DPIA need, automated decision-making and international transfers.
  • A data review for your priority use cases: where the data lives, who owns it, who can see it, and what has to be centralised, cleaned or re-permissioned first.
  • An AI security review covering data leakage, prompt injection and over-privileged access.
  • An approved-tools policy and AI-literacy material for staff.
  • A prioritised roadmap: what to stop, what to fix and what to build, in order, with indicative costs and the first use case scoped with a baseline.

Our engineers work across the major languages, frameworks and cloud platforms. We build on the stack you already run, with technology choices explained in writing before work begins.

How it is delivered

The same four stages as every Hexploits engagement, applied to this capability.

  1. Stage 1

    Inventory

    One to two weeks. Interviews with the people using AI and the people who own the data, plus a review of the software estate for AI features that arrived with an update. Output: the AI system register.

  2. Stage 2

    Classify and review

    Each system is classified under the EU AI Act and reviewed against GDPR; the data behind the priority use cases is mapped; security and permissions are checked. Two to four weeks for an SME, longer for an enterprise, usually run one business unit at a time.

  3. Stage 3

    Roadmap

    Findings are prioritised by exposure and by value, and written up as a roadmap with indicative costs, presented to the people who will fund it.

  4. Stage 4

    Build

    Optional. We fix the data foundations, build the controls and deliver the first use case, or hand the roadmap to your team or another supplier with everything they need.

The reference guide

AI readiness for SMEs and enterprises

Our guide to what readiness means in practice: the EU AI Act deadlines that apply now, how GDPR governs every AI system that touches personal data, and why centralising and organising your data decides whether AI works at all.

Read the AI readiness guide

How success is measured

Every engagement agrees its measures and the measurement period in writing before work starts.

  • Every AI system in use listed, owned and classified, with nothing prohibited still running.
  • A dated plan for any high-risk system ahead of the December 2027 deadline.
  • The data gaps blocking each priority use case identified and costed.
  • A first use case scoped with a baseline, a target and a measurement period.

Proof

Case studies with numbers, and reviews linked to Google where they were left there.

9Services in production

swarmd.ai · Software vendor

Policy on every agent call and nine services in production: an enterprise AI control plane for a UK software vendor

4+ agent protocols supported · Every call policy-enforced and audited
99.7%Of PII items fully redacted

PII Purge · Data protection

99.7% of personal data redacted and nothing retained: GDPR document redaction for CVs, subject access requests and AI pipelines

Zero document content stored or used for training · 10 types of personal data detected

  • Director, JobVantage

    “Working with Hexploits has genuinely been a pleasure, and I see them as my scaling partner for the foreseeable future as JobVantage grows. If you’re looking for a development team who combine strong AI/engineering capability with honesty, flexibility and a real interest in your business, I’d strongly recommend them.”

    Brandon BowdenDirector, JobVantageRead the review

  • Director, IO Solutions

    “Fantastic to work with. High level of attention to detail and flawless communication throughout. Would recommend to anyone looking to develop or improve a software product.”

    Christian LorzaDirector, IO SolutionsRead the review

Questions we get asked

What is an AI readiness assessment?
A fixed-scope review of whether your business can adopt AI safely, lawfully and profitably: what AI is already in use, how it is classified under the EU AI Act, its GDPR position, the state of the data your use cases need, security, staff policy, and a prioritised roadmap of what to fix and build.
How long does it take?
Typically two to four weeks for an SME and four to eight weeks for an enterprise, often run one business unit at a time so findings arrive early.
What does it cost?
It is a discovery engagement, from £4,000 fixed for an SME. The proposal carries a fixed figure for the agreed scope before anything starts.
Is it different for an SME and an enterprise?
The questions are the same; the scale is not. An SME usually needs an inventory, a usage policy and one use case built on organised data. An enterprise needs the same foundations plus a register across business units, governance mapped to ISO 42001 and controls built into a shared platform.
Do we need to have chosen an AI use case first?
No. Part of the assessment is finding the use cases worth doing and checking the data behind them, so the first thing you build has a measurable return.
Is this legal advice?
No. It is the technical and operational assessment. It gives your legal counsel or data protection officer the facts they need to sign off the legal position.

Related

Sectors where this is most often needed

Reading

More in applied ai

Applied AI overview

Next step

Request a proposal.

Tell us about the system and the sector. A named engineer replies within one working day. A written scope and an indicative price within two working days of a short scoping call.

Request a proposalTalk to an engineer