Your firm wants to use Copilot and other AI tools. Your regulator wants to know that your important services, your data and your suppliers stay under control when you do. We start by working out which rules actually apply to your firm, then check the evidence in the Microsoft 365, Purview and Sentinel tools you already pay for.
Which rules apply depends on your permissions and how your firm is regulated. These are typical cases, not a ruling on your firm.
Most smaller firms are not in scope of the full UK operational resilience rules. What typically matters for you:
You are likely in scope of the FCA’s operational resilience rules (SYSC 15A), and of PRA rules if you are PRA-regulated. That means important business services, impact tolerances, mapping, testing and a self-assessment. AI tools and cloud suppliers sit inside that map. From 18 March 2027 you will also need to report operational incidents that meet the FCA’s thresholds, tell the regulator about new or significantly changed material third-party arrangements, and keep a register of those arrangements and submit it each year. PRA-regulated firms have matching PRA requirements.
The operational resilience rules typically apply to your payment and e-money activity. The new incident reporting rules apply to you from 18 March 2027. Rules on notifying material third-party arrangements and submitting an annual register apply if you are an authorised payment institution or authorised e-money institution, but not if you are a small or registered firm.
DORA is EU law. It can apply directly to an EU-licensed entity in your group. If you supply technology to EU financial firms, their DORA duties usually reach you through due diligence, contract terms and audit rights. The EU AI Act may also apply where your AI system, or what it produces, is used in the EU.
If your firm is UK-only and has no EU entity, DORA does not usually apply to you directly.
For smaller firms. A quick, fixed-scope starting point: a read-only check of your Microsoft 365 security basics, with your top findings and clear next steps.
Know where AI and key suppliers sit in your operations, and what to get ready before the new UK incident and third-party reporting rules start on 18 March 2027.
A clear view of the AI tools in use, who owns them, and the controls around them.
Find out whether your logging and alerting would give you the evidence to understand and report an incident.
We assess your Microsoft 365, Purview and Sentinel controls, then fix the most important gaps with your approval.
Ongoing tuning in business hours, with a regular evidence pack for your board.
Each piece of work has a fixed fee. Ask on a 30-minute call.
A 30-minute call, then a short written scope.
Read-only access for the agreed dates, removed when the check ends. We change nothing.
A plain-English summary rated red, amber or green, and a 30/60/90-day plan your team or IT provider can act on.
Nineteen plain questions on governance, suppliers, incidents, Microsoft 365 and AI. Coming soon. Ask for the checklist on a 30-minute call.
Book a 30-minute callWe assess and advise. We don’t certify, we don’t guarantee compliance with any regulation, and this is not legal advice. We work business hours, UK-based. We don’t offer 24/7 monitoring.
We’ll tell you plainly whether we can help, and if we’re not the right fit, we’ll say so.