AI Governance & Adoption
AI in your practice, governed properly and running where you choose
Used well, AI takes real hours out of the week: a first draft of a fee proposal, a 300-page tender reduced to the points that matter, the actions pulled out of a site meeting. The harder question is the one your client, your insurer or your next framework bid will eventually ask: where did that project information go, who can reach it and who signed it off. WIT answers both, with the discipline we have already had to document, audit and defend in our own business.
The challenge
Sound familiar?
Shadow AI is already here
Staff are pasting project information into tools nobody approved, on personal logins, because the official answer so far has been silence or simply no.
The questions have started
PQQs, framework submissions, client audits and insurance renewals are already asking how you govern AI. A shrug is not an answer that wins work.
Tools chosen by enthusiasm
Pilots begin with whatever demos well, not with where the hours actually go or where the data actually ends up.
Contracts that will not tolerate it
Some client agreements will not tolerate project information reaching a third-party model at all, which rules out the default tools entirely.
How WIT helps
Assessed, governed and deployed where you choose
Every tool goes through the same scrutiny as any other system we would put near your data: where it processes, what it retains, whether it claims training rights over your content and what the contract actually commits to. The verdict goes on a register with a named owner, so approving a tool is a decision with evidence behind it rather than a shrug.
WIT has been certified to ISO 27001 since 2018 and to ISO 9001 since 2023. We are now extending both to cover AI under ISO 42001. We will describe ourselves as certified only when certification is granted. So what you get from us is not a view on AI in general. It is governance modelled on the ISO framework we already run, which fits alongside your ISO 9001, ISO 19650 or Cyber Essentials obligations rather than sitting apart from them.
Where the work can live in your own Microsoft 365 tenant, we handle Copilot licensing, readiness and rollout, including the permissions review that has to happen first. Where project information must not leave sovereign infrastructure at all, we deploy private, open-weight models on Inevidesk, on your own premises, in your own datacentre or in a UK Level 4 datacentre.
What you gain
- A usage policy written around your practice, not a downloaded template
- A register, impact assessments and review records you can show a client or an insurer
- Straight answers on where information is processed, who can reach it and how long it is retained
- Nothing training public models on your drawings, models or correspondence
- A person always in the loop: AI drafts, your people review and sign off
Capabilities
What’s included
AI readiness and usage assessment
Finding out which tools are already in use, where the hours actually go and what your client obligations allow.
Policy, register and staff briefings
A usage policy people will actually follow, a register with named owners and short, practical briefings so the rules are understood rather than simply published.
Microsoft 365 Copilot readiness and rollout
Licensing, the permissions and sharing review that comes first, then a measured rollout inside your own tenant.
Private and self-hosted AI deployment
Open-weight models on infrastructure you control, sized, secured and maintained like any other production system.
Evidence for audits and bids
Impact assessments, review records and register extracts ready for PQQs, framework submissions, client audits and insurance renewals.
Ongoing governance and review
Periodic reviews of tools, usage and policy, run under the same management system that keeps our own certifications current.
In practice
How this plays out in AEC work
Bids and fee proposals
First drafts and tender digests produced in hours rather than days, reviewed and signed off by your people.
Meetings and admin
Actions pulled out of site meetings and the routine paperwork that piles up between deadlines.
Sensitive project work
Private models on infrastructure you control, for the projects whose agreements will not tolerate anything else.
FAQs
Common questions
Do we need a policy before we adopt any tools?
Yes, but a short one. Shadow AI thrives where the official answer is simply no, so the policy’s job is to give staff an approved route, not to forbid everything. We write it around your practice, your project types and your client obligations.
Where do the models actually run?
Wherever your obligations require. Business-grade tools inside your own Microsoft 365 tenant, UK or EU processing where contracts demand it and, where project information must not leave sovereign infrastructure at all, private models on Inevidesk: your own premises, your own datacentre or a UK Level 4 datacentre.
Is WIT certified in AI governance?
WIT is certified to ISO 27001 (since 2018) and ISO 9001 (since 2023). We are extending both to cover AI under ISO 42001, the international AI management standard. Our AI management system is built to it. We will describe it as certified only when certification is granted.
Will our data train someone else’s model?
No. We approve only tools with contractual protection against your projects, drawings and correspondence being used to train public models and a private deployment removes the question entirely.
Let’s make technology work better for your practice
Tell us about your current setup, challenges and future plans. We will help you identify the right next steps.