Data Analytics and AI Built on Governed, Trusted Data

The board wants an AI plan by the next meeting. The risk owner first wants to know where the data came from. Thornacre’s data analytics and AI service builds the data strategy, platform, governance and reporting that let a regulated organisation trust its numbers, then puts AI on that data.

At a glance	Detail
Who it is for	CTOs, Heads of Data, CISOs, DPOs and COOs in any regulated organisation with data spread across systems
The problem it solves	Reports that disagree, data with no owner or lineage, and a board asking for AI the data cannot yet support
What we deliver	Data strategy, a data platform and pipelines, governance and lineage, trusted and self-service reporting, and AI on that data
How we work	Agile delivery, as the GDS Service Manual describes, with AI assessed against the AI Playbook for the UK Government
Regulations and standards	UK GDPR, Information Commissioner’s Office (ICO) AI guidance, AI Cyber Security Code of Practice, NCSC Cloud Security Principles, EU AI Act for EU operations

What problem does data analytics and AI solve?

Data analytics and AI close the gap between what a board asks of its data and what its systems can prove. The data sits in a line-of-business system, a CRM and spreadsheets, each counting people differently.

Each persona sees a different part of the same problem:

• The CTO or IT Director is asked for AI while integration debt fills the roadmap.
• The Head of Data cannot reconcile three systems that give three different counts for the board report.
• The CISO finds copies of personal data in spreadsheets and public AI tools, with no named owner.
• The Compliance Lead or DPO cannot show how a figure in a regulatory return was produced.
• The COO watches staff rekey data between systems for monthly reports, then wait on analysts for every new question.

The Office for National Statistics (ONS) found that AI use in UK businesses with 10 or more employees rose from around 12% to around 35% since late 2023. Adoption stayed shallow, at around 1.6 AI technologies per adopter.

None of this is the data team’s fault. Core systems were built to run transactions, not to report outcomes. Each new service added a system with its own key. AI vendors then assume clean, joined data that does not exist.

How does Thornacre deliver data analytics and AI?

Thornacre delivers data analytics and AI in seven phases, from data strategy to handover, each ending with a checkable outcome.

1. Map the data landscape. Run workshops with operations, data and compliance staff. Outcome: a map of every system and gap, agreed by IT and the business.
2. Set the data strategy and governance. Define master data standards, quality rules, a named owner for each data set and platform priorities. Outcome: a strategy your teams can follow.
3. Build the data platform and pipelines. Ingest from APIs, databases, files and third-party systems into a warehouse or lakehouse, with validation and quality checks on every load. Outcome: one trusted data set with lineage from source to report.
4. Deliver trusted and self-service reporting. Agree one definition per measure, publish approved data sets and build dashboards, so managers can build their own views from the same data. Outcome: one set of numbers from board pack to regulatory return.
5. Assess each AI use case. Ask of every idea: does the output affect a person? Outcome: a risk-ranked backlog your risk owners see before any model is built.
6. Deliver AI with oversight. Forecasting, scoring and language models run on the governed data. Use cases that affect people get human review, a written reason and a log entry per decision; elsewhere, staff keep the final say. Outcome: models you can explain to an auditor.
7. Hand over and train. Provide training, guides and a knowledge base. Outcome: your staff run the platform.

The diagram shows the seven phases and the fork at phase 5, where AI that affects people takes the stricter path.

Data lineage is the record of where each figure came from and what changed it on the way.

What do you get from a data analytics and AI engagement?

A data analytics and AI engagement leaves you with a platform, reports, models and skills your team owns.

Deliverable	What you keep
Data strategy	A data map, master data standards, quality rules and named owners
Data platform and pipelines	Automated ingestion, validation and quality monitoring on cloud hosting
Governance and lineage	A data catalogue and lineage from source to report
Reports and self-service	Approved data sets, agreed measures, dashboards and a chart builder
AI models	Forecasting, scoring and language processing, each with human oversight and a decision log
Skills	Training, guides and a knowledge base

Which regulations does data analytics and AI help you meet?

Data analytics and AI help you meet cross-sector data standards and your sector’s rules by making every figure and decision traceable.

• UK GDPR Article 5 requires personal data to be accurate and kept up to date, and the controller to demonstrate compliance; quality rules and lineage supply that evidence. For significant automated decisions, Article 22C adds safeguards such as human intervention.
• ICO guidance: the guidance on AI and data protection expects senior accountability and data protection impact assessments (DPIAs); the platform documents data flows and model choices for yours.
• Security: the AI Cyber Security Code of Practice sets baseline security for AI components, and hosting follows the NCSC Cloud Security Principles.
• EU AI Act: the EU AI Act sets logging and human oversight duties for high-risk AI in EU operations; decision logs and human review are built in.

The ICO is clear about who owns AI risk:

“You cannot delegate these issues to data scientists or engineering teams.” (ICO guidance on AI accountability)

Each sector adds its own rules, one example each:

Sector	Regulation or framework	What it requires	How the service addresses it
Banking and payments	DORA (EU operations)	A register of contractual arrangements with ICT third-party providers	Third-party data feeds and AI components documented
Insurance	FCA PRIN 2A (Consumer Duty)	Monitor customer outcomes and report to the board at least yearly	Outcome dashboards fed by pipelines with lineage
Private healthcare	Data Security and Protection Toolkit	Data security assurance for organisations with access to NHS patient data	Data flows, access roles and logs documented as evidence
Life sciences and pharma	MHRA GxP data integrity guidance	Data integrity across the GxP record lifecycle	Validation and audit trails on every pipeline step
Energy, water and critical infrastructure	NIS Regulations 2018	Proportionate measures to manage risks to network and information systems	Pipelines and models designed to the NCSC Cyber Assessment Framework

How do you choose between system reports and a governed data platform?

Use a system’s own reports when one system answers the question. Build a governed data platform when figures cross systems or feed AI.

Criterion	Reports in each system	Governed data platform
Speed to first result	Fast	Slower; pipelines come first
One version of each figure	Each system counts its own way	One agreed definition per measure
Explaining a figure to an auditor	Manual reconciliation	Lineage from source to output
Ready for AI	Only the data one tool sees	Every source system joined
Best for	Day-to-day operational lists	Board MI, regulatory returns and AI

Apply these rules:

• If three systems give three counts, fix master data before any dashboard or model.
• If a use case never touches a decision about a person, a vendor AI tool with a DPIA may be enough.
• If the output feeds eligibility, risk or prioritisation decisions, build governed data first.

An AI pilot is only as defensible as the lineage of the data feeding it.

When is data analytics and AI not the right choice?

Data analytics and AI is the wrong choice when you need one report, or when the source systems are about to go.

• One report: a monthly report from one system is simpler in your existing BI tool.
• Core system replacement under way: plan the mapping as part of the migration itself.
• Fully autonomous decisions: Thornacre does not build AI that decides about people without a human.

The governed approach is slower to a first dashboard. Risk and data teams must agree owners early, which is often harder than the engineering.

The usual objection is “AI is too risky for a regulated business.” Use is already happening, often with no logs; a ban moves it to personal accounts. Each quarter you wait adds unlogged data flows for a future audit to find.

Frequently Asked Questions

Which AI use cases should we start with?

Start with an internal use case that never touches a decision about a person, such as summarising case notes for staff. It proves the pipelines and logging with low risk. Use cases that feed decisions about people follow once lineage and owners are in place.

Will it work with our existing data warehouse and BI tools?

Governed pipelines work with your existing data warehouse and BI tools: they feed the warehouse you have, or publish to the BI tools your analysts already know.

Can business users build their own reports?

Business users can build their own reports from approved data sets and agreed measures. Self-service analytics is the ability for non-specialist staff to answer their own questions from governed data, without waiting for an analyst. Access follows existing roles.

How do we stop staff using public AI tools with personal data?

Give staff an approved route that is easier than the workaround. Thornacre’s AI transformation service sets the policy, and the governed platform supplies a logged tool for the same tasks. The Cyber Security Breaches Survey 2025 found that only 45% of large businesses review risks from their immediate suppliers, and public AI tools are suppliers too.

Where is our data hosted and who can see it?

Thornacre builds on cloud hosting designed to the NCSC Cloud Security Principles. Hosting region and access roles are recorded for your DPIA. Read more about our cyber security service.

How do we start?

Start with a discovery workshop that maps your systems, data flows, reporting needs and AI ideas. You leave with a prioritised backlog showing what to fix first, and whether CRM and ERP integration should come before them.

---

If your reports disagree or your board wants AI on data nobody can trace, book a data and AI readiness workshop with Thornacre. Email hello@thornacre.com to arrange it.

This page is general guidance only; consult your legal or compliance teams for your specific requirements.