AI consultancy from the engineers who will build it
We help UK companies, including small businesses and funded startups, decide where AI will pay, then make it work.
- AI readiness assessment from £4,950
- One to two weeks
AI consulting services for UK SMEs and startups
Quantum Craft's AI consultancy gives UK companies, including small businesses and funded startups, an AI readiness assessment, AI governance and technical due diligence for startups.
AI consultancy is advice on where AI will pay for itself in a business, carried through to a working system or to a written decision not to build one.
In Quantum Craft's AI consultancy, the engineers who advise you build and run AI in production, and handle UK GDPR and the EU AI Act as part of the job.
Last reviewed
The first question is usually the hardest. In DSIT's survey of UK businesses (opens in a new tab), published in January 2026 (fieldwork February to May 2025), the most common barriers to adopting AI, now or in the past, were having no identified use for it (71%) and limited skills (60%). Cost came well behind at 23%. So the first two pieces of AI consulting work are about finding the use, which is often all a small business needs before it decides what to buy or build.
AI readiness assessment
Our AI readiness assessment, which some firms call an AI opportunity assessment, is the place to start if you are not sure where AI fits. Over one to two weeks we talk to the people who do the work and go through the data you hold. You get a scored assessment and a ranked shortlist of what to build, buy or leave alone, and in what order. The fee starts at £4,950 and is fixed in writing before we begin.
Choosing an AI use case
Every candidate gets scored on the same questions: how often the task happens, what a wrong answer costs, whether the data exists, and whether the job needs an agent, a chatbot or a plain workflow. A use we recommend leaves with a baseline number, such as hours a week or days to answer a customer, so you can tell later whether it worked. It also needs a named owner in your business who wants it. Ideas without one go on a list, however good the demo looked.
Pilot to production
A pilot is only worth running if everyone agrees, before it starts, what passing looks like, measured against real cases from your own work. It goes into production once it passes and the workflow around it has changed, and once somebody has put the running cost into next year's budget. Plan on 20 to 30 per cent of the build cost a year to keep software running, plus model usage, which we measure per call from day one. We put the checks in code, because a prompt can only ask a model to behave. Anything that fails them goes to a person.
Pilot to production, as the card above describes it: everyone agrees before the pilot starts what passing looks like, the pilot is measured against real cases from your own work, and it goes into production once it passes. Highlighted station: the pass mark, agreed before the pilot starts.
- Into production: once it passes, the workflow around it has changed and somebody has put the running cost into next year's budget.
Technical due diligence for startups and investors
We do this for investors and acquirers, and for founders who would rather find the problems before an investor does. It takes one to two weeks, costs from £6,500, and ends in a written report. What a review contains, who sees the report and what moves the price are set out below.
Vibe code rescue
If a prototype built with Lovable, Bolt.new, Replit or v0 now handles money, health data or customer records, have a senior engineer read it before more customers arrive. Our AI-built app audit takes about a week, costs a fixed £3,500, and ends in a written recommendation to harden, refactor or rebuild, with the cost of each.
Fractional CTO or fractional head of AI
Some companies need senior technical judgement a few days a month and cannot justify a full-time hire yet. We make the technical and AI calls with you and check what suppliers deliver. When a board or an investor asks a technical question, we are the ones who answer it. We agree the days a month and a minimum term before we start, and decisions get written down as we go, so the knowledge stays with you when the arrangement ends.
What each use we recommend leaves with, before any pilot: an owner, a baseline and an estimate of its running cost. Highlighted station: the use we recommend.
What an AI readiness assessment hands over
| Candidate use | Order and verdict | Why | Owner and baseline |
|---|---|---|---|
| Sorting incoming customer emails into the right queue | 1. Build, as a plain workflow | It happens all day, and the team that receives a misrouted email catches it. Fixed rules do the job. | Customer service lead. Count the emails a day and the time spent sorting them before the pilot starts. |
| Writing up minutes from the weekly management meeting | 2. Buy | It happens weekly, and the people in the room catch a wrong word. Meeting software already does this, so nobody needs to build it. | Office manager. Count the time spent writing up minutes each week before you buy. |
| Approving customer refunds | Leave alone | A wrong answer pays money out and cannot be taken back. Refunds are too rare to repay the effort. | None needed. |
Each use we recommend leaves with an owner, a baseline and an estimate of its running cost before any pilot.
AI governance: the EU AI Act and UK GDPR
Governance runs through every engagement, and it can be an engagement on its own. System by system, we settle whether you are the provider or deployer under the EU AI Act and which risk tier applies, then the UK GDPR duties that follow once personal data is involved.
In practice that means a lawful basis for each use of personal data and a data protection impact assessment where the risk is high. People get a notice wherever they deal with AI, and your staff get an AI use policy they will follow, backed by the records worth keeping. The Act reaches UK companies whose AI output is used in the EU, with or without an office there.
Six dates between 2025 and 2028, drawn to scale. Highlighted: number 3, EU AI Act, Article 50 (transparency), which applies from 2 August 2026.
- EU AI Act, Article 4 (AI literacy)2 February 2025, rewritten from 27 July 2026
- UK GDPR Articles 22A to 22D5 February 2026
- EU AI Act, Article 50 (transparency)2 August 2026
- The UK regulator30 September 2026
- EU AI Act, high-risk systems (Annex III)2 December 2027
- EU AI Act, high-risk AI in regulated products (Annex I)2 August 2028
| Rule | Applies from | What it means in practice |
|---|---|---|
| EU AI Act, Article 4 (AI literacy) | 2 February 2025, rewritten from 27 July 2026 | Take measures to support your staff's AI literacy. No particular level is required. |
| UK GDPR Articles 22A to 22D | 5 February 2026 | Significant decisions made solely by software are allowed on most lawful bases, if the person affected is told and can contest the decision with a human. Special category data stays tightly restricted. |
| EU AI Act, Article 50 (transparency) | 2 August 2026 | Tell people when they are dealing with AI, and mark AI-generated content. Enforcement powers started the same day. Providers of generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty. |
| The UK regulator | 30 September 2026 | The Information Commission replaces the ICO and takes over its functions. |
| EU AI Act, high-risk systems (Annex III) | 2 December 2027 | Moved back from August 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026. |
| EU AI Act, high-risk AI in regulated products (Annex I) | 2 August 2028 | The same Omnibus moved this back a year. |
This is general information, not legal advice. Sources: Data (Use and Access) Act 2025, section 80 (opens in a new tab); Regulation (EU) 2026/1744 (opens in a new tab); the European Commission on AI Act enforcement (opens in a new tab); SI 2026/1015 (opens in a new tab).
How an AI consultancy engagement runs
After the first call, each stage is priced in writing before it starts and ends in something you keep, so you can stop after any of them or take the documents to another supplier.
The five stages of an engagement, in order: the first call, the AI readiness assessment, the specification sprint, the pilot and the production build. Highlighted: stage 2, the AI readiness assessment, the usual first step. After the first call, each stage ends in something you keep.
- Stop marks: you can stop after any stage.
- Iron mark: after the pilot, a written go or no-go.
The stages of an AI consultancy engagement
Stage
First call
- How long
- 30 minutes, free
- What you get
- Whether there is anything worth doing, and a fixed quote for the first step if there is
- Who does it
- A senior engineer
AI readiness assessment
- How long
- One to two weeks
- What you get
- A scored assessment and a ranked shortlist: build, buy or leave alone, and in what order
- Who does it
- A senior engineer, with your staff
Specification sprint
- How long
- One to two weeks
- What you get
- A written specification for the chosen use: scope, architecture, pass mark, estimate and risks
- Who does it
- Senior engineers
Pilot
- How long
- Fixed in the specification, with an end date
- What you get
- A working version on your data, tested against real cases, and a written go or no-go
- Who does it
- Senior engineers, with your users
Production build
- How long
- 6 to 12 weeks for a focused MVP; about 14 weeks' core build for a platform like BlueWave or Karu
- What you get
- The feature in daily use, with its checks, cost monitoring and handover documents
- Who does it
- Senior engineers, then your team or ours
Tell us what you are trying to decide, and a senior engineer will say which first step fits, or that none of them does.
Request a free 30-minute callHow much does AI consultancy cost in the UK?
AI consulting from Quantum Craft starts with a first step that has a published fee. An AI readiness assessment starts at £4,950 and takes one to two weeks, and technical due diligence for startups starts at £6,500. What AI consultancy costs, line by line sets other firms' published prices beside ours, and every fee on one page says what each first step includes and leaves out.
The four first steps by fee, each bar drawn from zero, lowest first. A dashed tail means the fee starts from that figure or comes in more than one size.
First-step fees
Specification sprint
£4,500 for one week on a single workflow, or £8,500 for two weeks on a platform
AI readiness assessment
From £4,950, over one to two weeks
AI-built app audit
£3,500, fixed, for about a week
Technical due diligence for startups
From £6,500, over one to two weeks
Where a fee starts from a figure, the final one depends on how much ground the question covers, so a review of one department costs less than one of the whole business. You get the exact figure in writing after the first call, fixed before the work starts. Longer work, such as a pilot or fractional leadership, is quoted in writing the same way, and any change of scope is agreed before the work changes.
If the answer is to build, a single-workflow product built to production standard typically costs £35,000 to £80,000 over 6 to 12 weeks. Our build bands cover larger shapes, and every case study publishes the band for its own.
AI consultant or AI development agency: which do you need?
Which kind of help fits depends on what you already know. This is how we would judge it on a first call, including the cases where you need neither.
Five situations and what we would tell you about each, from the table below: neither, consultancy, a build partner and wait. Two of the five point to consultancy. Highlighted station: consultancy.
- 1. Staff already use AI tools, mostly to write and summarise
- 2. You suspect AI could help, but not where or what it would be worth
- 3. You know the use, the data exists and someone owns the outcome
- 4. The process is broken, or the data is not being collected yet
- 5. An investor, buyer or regulator is asking hard questions
Which kind of help fits, by situation
If this sounds like you
Staff already use AI tools, mostly to write and summarise
- What we would tell you
- Neither. Buy business licences, and brief people on a short use policy.
- The catch
- It saves time but will not set you apart: every competitor can buy the same seats.
You suspect AI could help, but not where or what it would be worth
- What we would tell you
- Consultancy, starting with an AI readiness assessment.
- The catch
- You spend money before anything changes, and a shortlist nobody owns changes nothing.
You know the use, the data exists and someone owns the outcome
- What we would tell you
- A build partner, working from a written specification.
- The catch
- The specification adds one to two weeks before any code. That is cheap next to building the wrong thing.
The process is broken, or the data is not being collected yet
- What we would tell you
- Wait. Fix the process, or start collecting the data, first.
- The catch
- Waiting has a cost too: your staff will use AI anyway, with or without a policy.
An investor, buyer or regulator is asking hard questions
- What we would tell you
- Consultancy: tech due diligence or a governance review.
- The catch
- A report finds problems. Fixing them is separate work, by us or by anyone else.
Technical due diligence for startups
Technical due diligence for startups is an engineer's written review of a company's code, architecture, security, team risk and use of AI, with each finding ranked by what it would cost to put right. It takes one to two weeks and costs from £6,500. We cover the seven areas on the checklist investors work from.
Who commissions a technical due diligence review, and what it ends in: investors and syndicates, acquirers and founders before a raise commission an engineer's review, and the written report goes to whoever commissioned it. Highlighted station: the review.
- 1. Investors and syndicates
- 2. Acquirers
- 3. Founders before a raise
Who commissions a review
- Investors and syndicates, who want to know whether the engineering can carry the plan before the money goes in.
- Acquirers, who want to know what they would inherit: who owns the code, which licences apply, which people it depends on and what it would cost to fix.
- Founders before a raise, who would rather find the problems, then fix or explain them, before an investor's reviewer does.
What moves the price
- The number of products, repositories and cloud accounts in scope.
- Whether the product uses AI, because the models, the training data, the evaluation evidence and the running costs are further areas to read.
- The depth the deal calls for: a first cheque needs less than an acquisition, because depth follows the size of the cheque.
- A summary
- Findings by area
- Deal implications
- A fix plan
- Evidence and method
| Part of the report | What it tells you |
|---|---|
| A summary | A short summary in plain English for whoever is deciding: what we found, what it would cost to put right, which findings matter most and what could not be seen. |
| Findings by area | The seven areas on the checklist investors work from: architecture and scalability, code quality and delivery, team and key-person risk, security and compliance posture, IP and open-source licensing, data and AI exposure, and roadmap credibility. Each finding uses one fixed format. Where the product uses AI, this covers where the models and training data came from, what inference costs per customer, whether any evaluation evidence exists, and which code AI helped write and who reviewed it. |
| Deal implications | What to require before completion, what to price in and what to watch afterwards, so the findings that should move the price or the terms are plain. |
| A fix plan | Every finding to put right, ordered by what it would cost to put right, with an owner and a date, so the company knows what to do first. |
| Evidence and method | What was read, what access was given and when it ended, the dates, and the limits of the review, so anyone can check how a finding was reached. |
This is the outline of the report. It is not a client report, and nothing in it comes from a client's review.
- The seven areas an assessor works through
The page's own line: seven areas, and the checks an investor's assessor works through under each.
- Tick what you can evidence
How to use it: tick what you can evidence today, and treat the rest as your preparation backlog.
- Each area names its test and its evidence
Area 01, architecture and scalability, states the question being tested and the evidence that answers it, then the checks to tick.
Access and confidentiality: how a review runs
Confidentiality agreement first
Before anything is shared, we sign a confidentiality agreement with you and, where it is a different party, with the company being reviewed.
Read-only access
Access is read-only and ends when the report is delivered.
Working copies deleted
We delete our working copies when the report is delivered. The code and data you give us go only to the processors named in the engagement agreement.
The report goes to whoever commissioned it
A founder who commissions a review can put the report in a data room for investors to read. Anyone else who wants to rely on it needs our written agreement first.
A fee fixed in writing
The fee is fixed in writing before we start and does not change with what we find.
Fixing is separate work
Fixing what we find is separate work, by us or by anyone else. If we reviewed a company and would be the one to quote the fix, we tell whoever commissioned the review in writing before quoting it.
How a review runs, in the order the terms give: before we start, a confidentiality agreement is signed and the fee is fixed in writing; access is read-only; when the report is delivered, access ends and our working copies are deleted; fixing what we find is separate work. Highlighted station: the report delivered.
- The report: goes to whoever commissioned it.
Questions about technical due diligence
How much does technical due diligence for a startup cost?
Ours starts at £6,500 and takes one to two weeks. The exact fee is fixed in writing before we start and does not change with what we find. It depends on how many products and repositories are in scope, whether the product uses AI, and how deep the deal needs the review to go. What AI consultancy costs in the UK includes other firms' published prices for diligence, and the pricing page lists our other first steps.
Should a founder commission technical due diligence before raising?
If an investor's technical review is likely, yes. You hear about the problems first, while there is time to fix them or to explain them, and you get the seven areas an investor's assessor works through, written for you. You can put the report in the data room. The 90-day pre-raise engineering plan shows what to put in order beforehand.
How do you review a startup's code when AI helped write it?
The same way as any code, with extra attention to what unread code gets wrong. We ask who reviewed each change and whether the tests fail when the behaviour breaks. We check where any copied code and its licences came from, whether the access rules hold, and whether anyone can explain why the system is shaped as it is. Code written with AI help is not a reason to fail a company. Code that nobody has read is. Open-source licences and your IP story covers the licence side.
1 more question
Do you also fix the problems a technical due diligence review finds?
We can, and so can anyone else: the report stands whoever does the work, and fixing is separate work. If we reviewed a company and would be the one to quote the fix, we tell whoever commissioned the review in writing before quoting anything, so they can take the work elsewhere.
Evidence from production
We advise from client platforms we built and still work on. Two run AI in production, one was designed for AI we have deliberately not shipped, and one has an AI roadmap ordered by what pays first.
- The standards in the headline
The page leads with ACoP L8 and HSG274.
- A table of the standards
Each standard sits beside what it governs.
- Where the product helps
The last column says where BlueWave carries the load.
A B2B logistics marketplace: read the case study
Its assistant routes each visitor to a specialist agent, and one of six grounding guards strips any result the model presents without a matching tool call, so it cannot invent a warehouse. A classifier vets every listing before it goes live, and A/B tests and an evaluation rig decide which model answers.
Five AI features in production, with an evaluation rig
NForge: read the case study
This coaching platform generates training and nutrition programmes in four model calls, then checks each against around thirty validation gates, allergen derivatives and injury contraindications among them. A plan that cannot be repaired goes to human review instead of shipping. The model in use won a bake-off on results and cost.
AI programme generation in production, with the cost of every generation logged
Karu: read the case study
Clinical notes are stored as structured sections, so a drafting model could propose them section by section and write only to an unfinalised draft that a clinician signs. We have not shipped that layer. Its rules were written before the feature: UK or EU inference, no training on client data, a DPIA first, and AI switched off by default.
Built for UK hosting, with clinical notes kept out of the search index
BlueWave: read the case study
Every record in this water-hygiene compliance platform is typed, versioned and audit-trailed, so anything a model produces can be checked before it is stored. The AI roadmap runs in the order the economics support: map a contractor's old forms, read lab reports as they arrive, check readings at capture, then answer an auditor's questions with cited records.
An audit trail on every record, and an AI roadmap ordered by what pays first
Who this is for
Who we work with
- Owners, operations leads and finance directors at UK companies
- Funded founders, pre-seed to Series A, whose product has to survive real users and technical due diligence
- Regulated and field-heavy businesses: compliance, health, anything with records someone will audit
- Founders whose AI-built prototype now handles money, health data or customer records
- Investors and acquirers who want an engineer's read on a product, including its AI-written code
Look elsewhere for
- A slide deck for the board, with no plan to act on it
- A Big Four name on the report
- Legal advice: that needs a solicitor, and we are glad to work alongside one
- Training for hundreds of staff at once, which a specialist trainer will do better
Questions about AI consultancy
What does an AI consultant do for a small business?
A good one finds where AI would save your business time or money, and where it would not, then helps you act on it, usually by proving one use on your own data first. Sometimes the right advice is a business licence and a two-page policy, which costs far less than a project.
How much does an AI consultant cost in the UK?
Our AI readiness assessment starts at £4,950 and technical due diligence at £6,500, and each takes one to two weeks. The exact fee is fixed in writing before we start. If you then build, our build bands show what each shape of build costs.
What is an AI readiness assessment, and what does it cost?
A review of where AI would pay in your business, over one to two weeks, which some firms call an AI opportunity assessment. We interview the people doing the work, look through your data and rank each candidate use: build it, buy it or leave it alone. Ours starts at £4,950; the exact fee is agreed in writing before we begin, and the report is yours.
8 more questions
Is AI only for big businesses?
No. Size matters less than having a use for it: in DSIT's survey of UK businesses (opens in a new tab), published in January 2026, having no identified use (71%) was a far more common barrier than cost (23%). Small businesses can start with business licences and a short use policy, and build only where a use pays for itself.
What do small businesses spend on AI?
Usually little. In DSIT's survey of UK businesses with five or more staff (opens in a new tab) (fieldwork February to May 2025), 31% of firms using or planning to use AI reported spending nothing on it in 2024, and another 35% did not know what they had spent. A paid first step makes sense when a process costs real hours, the data exists and someone owns the result. If that is not you yet, we say so on the first call.
Our staff already use ChatGPT. Do we need an AI policy?
Almost certainly. Two pages is enough: which tools staff may use, which data must never go into them, who checks the output before it reaches a customer, and who approves a new tool. In a Censuswide survey for Microsoft (opens in a new tab) in October 2025, 71% of 2,003 UK employees had used unapproved consumer AI tools at work. A two-page AI use policy shows the structure.
Does the EU AI Act apply to UK companies?
It can. The Act applies where an AI system is placed on the EU market or its output is used in the EU, so a UK company can be caught with no office there. Your duties then depend on your role, provider or deployer, and on the system's risk tier. The EU AI Act for UK companies sets out the tests.
Do we need an AI consultancy or an AI development agency?
If you know what to build and the data exists, you need a builder. If you cannot yet say where AI would pay, you need advice first. We do both, and we fix the advisory fee before anyone knows what we will recommend.
We already paid for an AI strategy that went nowhere. What now?
Send it to us. We test each idea in it for an owner who wants it and data that exists today. Ideas that pass become a specification with a pass mark and a price. The rest we tell you to drop, in writing, with the reason.
Is AI safe and compliant for a regulated business?
It can be, if the rules shape the design from the start: a lawful basis, a DPIA where the risk is high, UK or EU hosting, no training on your data, and a person who can overturn a significant automated decision. Karu, a practice platform we built for UK therapists, was designed that way.
How quickly will we see results?
The written assessment arrives within one to two weeks. If it recommends building, a focused MVP takes 6 to 12 weeks and larger platforms take longer. Moving staff onto business licences under a policy can happen straight away.
Tell us what you're deciding.
Tell us where you think AI might fit and what data you already hold. On a 30-minute call we'll tell you what we would do first, even if the answer turns out not to involve AI.
What happens after you get in touch
We reply within one working day
By email, to arrange a time for the call.
A free 30-minute call
With a senior engineer, about what you are building or deciding.
The fee in writing first
If a first step is worth taking, you get its exact fee in writing before any work starts.