Free PDF · No signup · UK
Download the PDF. Print it. Bring it to your next leadership-team meeting.
What's inside
- Identity and access. MFA, SSO, RBAC, privileged-account carve-outs, offboarding hygiene, service-account scopes.
- Data protection. Sensitivity classification, encryption in transit and at rest, DLP for AI inputs/outputs, data residency, retention, backup.
- Network and infrastructure. Network segmentation, API gateway, logging, rate limiting, DR, capacity.
- Vendor and supply chain. Third-party register, DPAs, SOC2/ISO27001 evidence, sub-processor disclosure, right-to-audit, incident notification SLAs.
- Monitoring, IR, and audit. Audit log retention, AI-specific IR playbooks, anomaly detection, AI pen-testing scope, annual security review, audit-ready evidence pack.
Who this is for
UK security teams adopting or scaling AI tooling. Also useful for CTOs, IT directors, and Heads of Risk where security is part of the AI governance conversation. Particularly relevant in regulated sectors and businesses with ISO 27001 obligations.
How to use this
Tick what you can evidence today. For everything you can't, that's the security work that should happen before AI moves from pilot to production. Use the result to brief the security committee, the AI programme owner, and (where required) the board.
Frequently asked
Is this checklist enough for ISO 27001 certification?
No — it's narrower and AI-specific. ISO 27001 covers the broader information security management system; this checklist focuses on AI-specific controls that sit on top. They complement, not substitute.
How does this map to NCSC guidance?
The checklist aligns with NCSC's general security principles plus their specific AI guidance (where published). NCSC's 'secure design and development' framing is reflected in the network/infrastructure and monitoring sections.
Is pen testing AI integrations different from regular pen testing?
Yes — AI integrations introduce new attack surfaces (prompt injection, training data poisoning where applicable, output manipulation) that traditional pen testing doesn't cover. Ensure scope explicitly includes AI when commissioning testing.
What's the most common gap UK businesses have on this checklist?
Three patterns: (1) AI-specific IR scenarios not in the IR plan, (2) vendor sub-processor disclosure not refreshed since AI vendors were added, (3) DLP policies that operate on file movement but not on AI prompts/outputs.
How often should we re-run this checklist?
Quarterly during active AI rollout; annually thereafter; plus on any major vendor change or significant incident.
Related Arx Certa services
If the gaps this resource surfaces for your business need outside help to close:
- AI services — implementation reviews, AI policy work, vendor due diligence, and pilot scoping.
- Cybersecurity — security overlay for AI use, UK GDPR / NCSC alignment, vendor risk assessment.
- Database — data foundations work AI projects depend on.
- Infrastructure — cloud, identity, network and integration foundations.
Score your AI readiness in 4 minutes
The Arx Certa AI Readiness Scorecard quantifies the foundations this resource describes — across governance, data, infrastructure, security and use case. Free, 12 questions, personalised report.
Get your AI readiness score →