Ethical Tech & Compliance
EU-first tooling, AI Act readiness and Cyber Essentials certification for small practices, taken from first audit through to the evidence pack.
EU AI Act · Cyber Essentials · GDPR review · Data residency
Sophie's Bureau helps small consultancies, coaching practices and values-led businesses in the UK and EU choose tools they can stand behind, prepare for the EU AI Act, and pass Cyber Essentials. The work runs from the first audit through to the evidence pack.
Most small practices assembled their tool stack one subscription at a time, and nobody ever asked where the data went. That was fine until it wasn't. In 2026 a consultancy that sends client notes through a US-hosted AI tool, keeps its CRM on a platform with no EU data residency and has never written down which AI tools it uses has three separate problems: a GDPR exposure, an AI Act gap, and a supplier-questionnaire it cannot answer. This practice exists to close those, in that order of urgency for whichever one is pressing.
EU-first tooling
I start with an audit: every tool you run, what it holds, where the company is registered, where the data is hosted, and what the contract says about training and transfers. Then a shortlist of European or self-hostable alternatives for the tools that need replacing, with the catch behind each option written down, because there always is one. Then a staged migration. Typical moves are Airtable to SeaTable, Zapier to Make or to a small Cloudflare Worker, Google Analytics to Simple Analytics, forms to Tally, and a Squarespace site to a hand-built one you own. Some US tools stay, and I say so when they should. The reasoning is in the ethical, EU-first tech stack for small businesses and building an EU-residency AI stack for a small consultancy.
EU AI Act readiness
For a small practice the Act comes down to three artefacts: an AI use policy in plain language, an inventory of the AI tools you use with where each stores data and whether it trains on your inputs, and evidence that the people using AI on your behalf understand what it can and cannot do. I help you decide what is in scope, draft the policy properly and work out what to tell clients. If you would rather begin alone, the free AI use policy and inventory templates are the starting point I use, and the plain-language guide to the Act for small consultancies explains what applies and when.
Cyber Essentials
Cyber Essentials is the certification that NHS, public-sector and corporate clients increasingly require from suppliers, and it is achievable for a business with no IT department. I run the process end to end: the self-assessment, access audits, device and BYOD checks across an associate team, the fixes that come out of them, and the evidence pack that backs each answer, then a check-in rhythm so the standard holds after the certificate arrives. I took a leadership consultancy with an associate network through it; the account is in supporting a client's Cyber Essentials journey, and the BYOD Cyber Security Check-In Toolkit came out of that work.
Who this is for
Consultants, coaches and small consultancies with up to around ten people, usually with an associate network rather than employees, who have clients that ask questions about data and want answers they can give with a straight face. If you are a larger organisation with an IT function, this is not the right fit, and I will say so on the call.
How it is priced
Sprints and projects start from €1,450 ex-VAT and are quoted on scope. Ongoing tooling and compliance oversight fits inside the monthly retainers. The FAQs cover the questions people usually ask first.
Questions people ask before this kind of work
- Does the EU AI Act apply to a solo consultant or a five-person firm?
Yes. The Article 4 duty on AI literacy has applied to any business using AI in its work since February 2025, and further obligations came into force in August 2026. Proportionate compliance for a small practice is a short written AI use policy, an inventory of the AI tools in use and where each stores data, and a record that the people using them understand the limits.
- Can a business with no IT department get Cyber Essentials?
Yes. Cyber Essentials is a UK government-backed certification that NHS, public-sector and many corporate clients ask their suppliers for, and it is designed to be achievable by small organisations. The work is a self-assessment, the fixes it surfaces (access, devices, updates, passwords), and the evidence to back the answers up.
- What does moving off American platforms actually involve?
An audit of what you run and where each tool stores its data, a shortlist of European or self-hostable alternatives with the trade-offs written down, and a staged migration so nothing stops working part-way. Not everything needs to move; the point is to know what you depend on and to have chosen it.
- How long does this take, and what does it cost?
An AI Act policy and inventory is a short sprint. A tooling audit and migration depends on how many systems are involved. Cyber Essentials takes as long as the fixes the assessment surfaces. Sprints start from €1,450 ex-VAT and are quoted on scope.