This is an illustrative scenario showing how our four services work together
Picture a mid-tier fintech — call it “Northbridge Finance” — with around 400 staff, regulated under UK FCA rules and handling EU customer data under GDPR. Six months ago, under pressure to keep pace with competitors, Northbridge’s product team shipped a customer-facing LLM assistant: it answers account queries, explains loan eligibility, and can pull live balance and transaction data through an internal API. It launched fast. Security and governance were meant to “catch up later.”
This is the exact starting point most of our engagements begin from. Here’s how our four services would typically work through a case like this, in sequence.
1. AI Gap Analysis — finding out what “later” actually means
Before recommending anything, we’d need to know what Northbridge actually has, not what the product roadmap says it has. A gap analysis here would map the LLM’s real data flows: what account and transaction data the model can access, how prompts and responses are logged (or aren’t), whether the model can be manipulated into revealing details about one customer’s account to another, and whether the vendor contract for the underlying model even permits this use case.
For a scenario like this, we’d typically expect to surface things like: no rate-limiting on prompt injection attempts, transaction data flowing into the model’s context window unredacted, and no clear answer to “who signed off on this going live.” That last point matters more than it sounds — it’s usually the real gap, not the technical one.
2. AI Governance — building the accountability the launch skipped
With the gaps mapped, the next step is rarely a purely technical fix. It’s building the “Corporate Constitution” — who owns AI risk decisions at Northbridge, what data classes the assistant is and isn’t allowed to touch, how customer complaints about the assistant’s advice get escalated, and how this maps to FCA Consumer Duty obligations and GDPR’s requirements around automated decision-making.
In a real engagement, this phase typically produces a policy document the board can actually sign off on — not a 40-page framework nobody reads, but a small number of clear rules: what the model can access, what it must never say, who’s accountable if it gets it wrong.
3. AI Secure Architecture — redesigning the plumbing
Governance sets the rules; architecture makes them technically true. For Northbridge’s scenario, this would likely mean re-architecting how the assistant accesses transaction data — moving from direct API access to a scoped, permissioned retrieval layer that only surfaces what’s needed for the specific query, with prompt-injection defences at the input layer and output filtering before any response reaches the customer. Data in transit and at rest would be reviewed against the same encryption standards as Northbridge’s core banking systems, since customer trust doesn’t distinguish between “the app” and “the chatbot.”
4. AI Security Roadmap — making sure this doesn’t happen again
The final piece looks past the immediate fix. Northbridge’s leadership wants to expand the assistant into loan pre-approval decisions next year — a much higher-stakes use case under FCA and EU AI Act rules. A roadmap here would sequence that expansion against milestones: independent model validation before any credit-related feature ships, a defined review cadence as regulation evolves, and a resourcing plan so security isn’t scrambling to catch up with product again.
The pattern worth noticing
What made this scenario go wrong in the first place wasn’t a lack of technical skill on Northbridge’s product team — it was sequencing. Deployment came first, governance and architecture came after. Our approach exists to flip that order: gap analysis first, so decisions are made with full visibility; governance and architecture in parallel, so accountability and technical controls reinforce each other; and a roadmap that keeps pace with what the business wants to do next, rather than reacting to it after the fact.
If your organisation’s AI deployment story sounds anything like Northbridge’s — shipped fast, secured later — get in touch to talk through where the gaps might be.