AI Responsibility Statement

Last updated: October 2026

At CSIQ, we prioritise the privacy and security of our clients’ data, ensuring compliance with all applicable UK data protection laws, including the UK GDPR and the Data Protection Act 2018. Our use of artificial intelligence (AI), including private large language models (LLMs), is conducted with the utmost care and aligns with our commitment to transparency and responsibility.

No Customer Data in Public AI Services

We categorically do not use customer data—this includes company names, staff names, or personally identifiable information (PII)—in public AI services such as ChatGPT, Claude, or any other third-party platform. Your data remains confidential and is never exposed to external systems.

Private, Secure AI Operations

To support our intelligence operations, we exclusively utilise private LLMs hosted on private servers owned and operated by CSIQ. These systems are designed to process data securely and responsibly:

Temporary Processing of PII: Any PII processed is handled temporarily and strictly on servers and graphics cards owned and controlled by our organisation.
Encryption: All data is encrypted at rest and in transit, ensuring the highest level of security against unauthorised access.
Controlled Access: Only authorised personnel have access to AI systems and data, with robust access controls overseen by our information security management system.

Compliance and Ethical Standards

The following principles guide our AI operations:

Lawful Use: Data processing is strictly compliant with the UK GDPR and Data Protection Act 2018.
Transparency: We are transparent about how AI technologies are utilised within our organisation.
Data Minimisation: We only process data necessary for specific, legitimate purposes and retain it only for as long as required.
Accountability: Our AI systems are regularly audited and assessed to ensure they remain secure and compliant, and are monitored for bias.

Use of AI in our services

Where AI is used in our investigation, intelligence and forensic work, it supports our consultants rather than replacing them. It may help us sort, search, translate or summarise large volumes of data so that relevant material is found more quickly.

AI does not reach conclusions on our behalf. Every finding, opinion and report is produced, checked and signed off by a qualified consultant, who verifies any AI-assisted output against the underlying evidence. Where AI tools have contributed to work that may be relied on in legal proceedings, we record this and will disclose it on request.

AI is not used in any part of our certification work. Cyber Essentials, Cyber Essentials Plus, Defence Cyber Certification and IASME Cyber Assurance assessments are carried out entirely by qualified assessors.