Common questions.

Moorlnd is an AI governance platform for small and medium businesses in the UK and EU, and for the managed service providers (MSPs) who support them. It combines a plain-English AI-safety course for staff, a Governance Centre for your AI registers, policy and evidence, and regular regulatory updates mapped to the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Moorlnd was previously called Attest AI. See the Governance Centre.

Moorlnd is for small and medium businesses in the UK and EU and the MSPs and IT providers who support them, usually the HR lead, IT manager, compliance lead or operations director who has to get staff trained and show that AI use is governed. Organisations are usually served through an approved Moorlnd partner; those with more than 500 staff work with us directly. Who we help.

The right choice depends on what you need, but Moorlnd is built specifically for UK and EU small and medium businesses: staff AI-safety training, AI tool, supplier, use-case and risk registers, an Acceptable Use Policy with staff sign-off, and evidence organised the way an auditor asks for it, from £490 a year excluding VAT. When comparing platforms, ask three questions: does it train your staff, does it keep records you can show an auditor or a client, and is it priced for your headcount. Compare the Moorlnd plans.

Only where the EU AI Act applies to them, which for a UK business usually means it places AI systems on the EU market or uses AI systems whose output is used in the EU (Article 2). Article 4, as replaced by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026), says providers and deployers of AI systems “shall take measures to support the development of AI literacy” of their staff, and it does not require them to guarantee any specific level for any individual. A business outside the Act's scope has no Article 4 duty, but training staff is still a sensible way to show UK GDPR accountability when people use AI with personal data. Moorlnd's course is one such measure. Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 on EUR-Lex.

AI governance is the policies, registers, risk assessments and human oversight that make sure your organisation uses AI safely, and can prove it. It covers acceptable use, data protection, supplier due diligence, incident response and reporting, aligned to the EU AI Act, ISO/IEC 42001 and the NIST AI RMF. The Standards Map shows where each rule is covered.

An AI acceptable use policy should say which AI tools staff may use and on which accounts, what information must never go into them, when a person must check AI output before it is used, who approves new tools and uses, and how to report an incident. Every member of staff should acknowledge it, and it should be reviewed regularly. In the Moorlnd Platform, publishing the policy asks every member of staff to acknowledge it, the acknowledgements are the evidence, and a review date is set three months ahead. See how the policy works.

Shadow AI is AI used at work without the organisation knowing about it or approving it: consumer chatbots on personal accounts, browser extensions, AI features switched on inside software you already use, and free tools signed up to with a work email. The risk is that company or personal data goes into a tool nobody has assessed. Moorlnd's AI Tool Register records every AI tool your people can reach, including the ones you never bought, and the Governance Dashboard counts unapproved AI. See the AI Tool Register.

Give your team three things: a short list of approved tools and accounts (a business account, not a personal one), clear rules on what never to paste, and training on checking what the AI produces before it is used. Then record it: put each tool on a register, publish an acceptable use policy and have every member of staff acknowledge it. Moorlnd's course covers what AI tools do with what you type, the never-paste list, picking the right tool and verifying output. Module 1 is free to read.

You may: UK GDPR (Article 35) requires a data protection impact assessment where processing is likely to result in a high risk to people, and the ICO lists innovative technology, including AI, among the factors that point to one. Moorlnd screens each AI use case against five questions, plus special-category data, and flags it as “may require” or “likely required”. The decision and the DPIA itself stay with you and your data protection lead; Moorlnd records the outcome and the DPIA reference. See the ICO guidance on DPIAs.

ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, risk processes and controls an organisation uses to govern AI. Moorlnd does not certify anyone; it is not a certification or accreditation body. Its training, templates and registers are mapped to the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, and help prepare you to work with an accredited certification body if you choose to pursue certification. ISO/IEC 42001 at ISO · Moorlnd Standards Map.

Moorlnd costs £490 a year for Foundation (staff training and starter governance templates) or £99 a month for the Platform (continuous governance with the training included), for organisations of 1 to 10 staff. For 11 to 25 staff it is £790 a year or £179 a month; for 26 to 50, £1,390 or £299; for 51 to 100, £2,290 or £499; for 101 to 250, £3,990 or £899. The Platform is billed annually at ten times the monthly price, £990 to £8,990 a year. More than 250 staff is quoted on headcount. All prices exclude VAT, and your band price is held for 12 months. See pricing.

Through a partner programme: an MSP or IT provider resells Moorlnd training and the governance platform alongside managed IT, cyber or Microsoft 365 services, and keeps the customer relationship. Moorlnd partners buy at a partner discount with volume rebates, register deals for 90 days of protection, get free not-for-resale licences for their own staff and demos, and use co-brandable marketing; in the partner portal a won deal becomes a set-up customer account. There is no fee to be a partner. Become a partner.

The Moorlnd Platform runs your AI governance in one place: the Governance Centre holds your AI tool, supplier, use-case, risk, controls and incident registers, each record with an approval status, an approver, a review date and an append-only change history you can export. It publishes your Acceptable Use Policy and tracks staff acknowledgement, flags use cases that may need a DPIA, and shows what needs attention on a dashboard. A seven-step setup wizard builds your first records, and Ask Moorlnd answers questions inside the portal. Try the Governance Dashboard sample.

Staff sign in to the Moorlnd portal with their work email, and every account uses an authenticator app as a second step. A manager can verify the organisation's email domain so colleagues join when they first sign in, using one of the organisation's seats, or invite people one by one or from a spreadsheet. Sign in.