A proportionate, clarity-first review to establish your baseline: what is happening, what constraints are real,
and what a sensible next step looks like.
Price guide: from £2,250 ex VAT
5–7 working days15–30 mins stakeholder timeAdvice-only (no sign-off)
Method
FM Doctor’s method is built on the NIST AI Risk Management Framework, with reference to the NIST Generative AI
Profile where relevant. It is interpreted for UK regulated environments using the UK’s cross-sector AI
regulatory principles and ICO guidance, and informed by international standards including ISO/IEC 42001,
ISO/IEC 23894, and the OECD trustworthy AI principles, taking account of emerging regulatory regimes such as
the EU AI Act where relevant.
FM Doctor is advice-only and does not certify organisations. For mature organisations, support can include a
roadmap towards management system controls aligned to those standards. Implementation and any certification are
separate.
Who it is for
Early stage teams with unclear direction
Leadership pressure to do something practical
Organisations that need a proportionate first step
Not the right fit if
You already need deep cross-team evidence for board scrutiny
Your main issue is active policy breach or loss of control
You need implementation delivery rather than advisory clarity
Problems this solves
Before
Mixed messages on AI priority
Unclear constraints across data, governance, and capacity
Pressure to commit without enough context
After
Clear baseline and risk-aware view of current readiness
Practical recommendations, not generic theory
Now / Next / Later path leadership can use immediately
What is included
Short intake plus targeted pre-work questionnaire
High-level readiness and risk view
Optional readiness heatmap and scored review summary (where useful)
Practical recommendations and a Now / Next / Later path
One short call, or email-only delivery if preferred
Any heatmap or score is decision support from the review to clarify priorities and next steps, not a compliance
rating or certification outcome.
Sample output
Output preview (redacted)
A composite preview of the outputs you receive: a readiness heatmap plus a practical table of observations and minimum risk-aware next steps.
Composite previews. No client data. Click either image to view full size.
Process and timeline
Step 1: Pre-work submitted and context confirmed.
Step 2: Short stakeholder call (optional if email-only).
Step 3: Baseline and risk view produced.
Step 4: Recommendations delivered in a Now / Next / Later format.
Typical turnaround: 5-7 working days from completed pre-work.
Your time required: 15-30 mins stakeholder time plus questionnaire and key documents.
Service-specific FAQ
What is the difference between the Readiness Review and a full assessment?
The Readiness Review is a fast baseline for clarity and immediate direction. The Full Assessment is deeper, broader, and built for leadership-level scrutiny.
Can this be delivered email-only?
Yes. This service is designed to stay lightweight and can run with one short call or email-only if preferred.
How much stakeholder time is needed?
Usually 15-30 minutes plus questionnaire completion and any existing docs that explain your context.
What does the Now / Next / Later path include?
Immediate actions, near-term priorities, and later options, sequenced to keep momentum without over-committing too early.
What documents should we share?
Policy notes, process docs, known risk issues, or examples of current AI use. Redacted material is normally enough.
What framework do you use?
FM Doctor’s method is built on the NIST AI Risk Management Framework, with reference to the NIST Generative AI
Profile where relevant. It is interpreted for UK regulated environments using the UK’s cross-sector AI
regulatory principles and ICO guidance, and informed by international standards including ISO/IEC 42001,
ISO/IEC 23894, and the OECD trustworthy AI principles, taking account of emerging regulatory regimes such as
the EU AI Act where relevant.
Are you ISO certified?
No. FM Doctor is advice-only and does not certify organisations. For mature organisations, support can include
a roadmap towards management system controls aligned to those standards. Implementation and any certification
are separate.