Uses and projects
Existing uses, experiments, live projects and planned investments: what actually serves the business, and what is still only a demonstration.
Audit engagement
AI audit for SMEs
Your teams already use AI, but do you know which uses are actually useful, which data is exposed, and which investments are worth continuing?
Mahthildis reviews your AI uses, tools, data and projects to identify risks, test whether they are relevant, and set priorities.
Paulo Castro personally steers the audit and can bring in additional expertise when the subjects under review require it.
You get a clear reading of the situation and recommendations for what to keep, improve, secure, test or stop.
Situations
Do you recognise these situations?
AI tools are used without shared rules, and leadership has little visibility.
Customer, HR, finance or contract data may be copied into external services.
Automations or agents move forward without defined human review.
A tool, vendor or AI project is already under way, without a measurable result.
The promised ROI comes from a vendor pitch rather than a real business friction.
You need to decide what to keep, frame, secure, test or stop.
Example
AI, ordinary automation, or data quality first?
Your team spends time producing a report. Do you need an AI tool, a conventional automation, or better data first?
- Compare the business need with the time actually spent on reporting.
- Review the available data, its quality and the access rights required.
- Compare the options and define success criteria for any pilot.
The audit helps you choose what to test, measure or fix before committing to a tool and a recurring cost. No quantified gain is promised.
Scope
What Mahthildis examines
The audit looks at the company’s real situation, not only individual use of an assistant. The exact scope is confirmed after the first conversation.
Tools and dependencies
Assistants, agents, automations, platforms and vendors. Terms of use, exit options and dependencies to clarify before going further.
Data and access
Sources in use, sensitivity, access rights, copies to external services, and points that may need a specialist review.
Cost and relevance
Licences, usage costs, internal time and ROI claims. Tie each option to a measurable friction rather than a trend.
Governance and human review
Who authorises a use, who reviews an output, who remains accountable. Distinguish what can continue, what needs rules, and what should be paused.
How it works
How the audit is run
The first conversation defines the scope. The audit itself is a paid engagement, taken through to a usable written outcome.
01
Frame the scope
The first conversation defines the teams involved, the tools and projects to include, the data and documents that can be reviewed, and the decision leadership must be able to take at the end.
02
Analyse the situation
The agreed uses, documents, tools, data flows and value assumptions are examined to distinguish what is useful, exposed, costly or still only experimental.
03
Speak with the people who matter
Findings and risks are checked with the people who use, buy or live with these tools, to judge how serious they are and to distinguish the official story from actual practice.
04
Report and prioritise
Conclusions are delivered to leadership: a reading of the situation, the risks, the options, the priorities and an action plan for what to keep, improve, secure, test or stop.
Deliverables
What you receive
Leadership receives a structured analysis that can be used to decide. The level of detail depends on the agreed scope.
Map of current uses
A concise view of what is already used, tested, purchased or only being considered.
Risks and points of attention
Data, access, dependencies, human review, and topics that may need a specialist adviser.
Priorities and recommendations
What to keep, improve, secure, test or stop, with the questions to ask before spending more.
Action plan
Realistic next steps, separated according to whether they belong to framing, governance or later delivery.
Responsibility
An independent audit, with the skills it needs
Paulo Castro remains your principal counterpart and steers the audit.
Mahthildis is not a staffing firm and does not sell a catalogue of consultants. Independent judgement is preserved: the audit is not designed to place a tool, a vendor or a team.
Additional expertise when the scope requires it
Depending on the subjects under review, Mahthildis can bring in complementary skills — data, cloud, security, AI or regulatory questions to identify — after their role and fees have been agreed.
Those contributions stay under Paulo Castro’s lead. They are not included automatically.
Format and fees
Quoted after the scope is understood. The first 20-minute conversation frames the request. The audit is a standalone engagement, distinct from general AI project support.
Limits of the engagement
- The audit does not automatically include designing or delivering a technical solution.
- A separate design, integration or delivery engagement can be proposed later if you want one. There is no obligation.
- The audit is not a legal, GDPR or specialist cybersecurity opinion. Points beyond the scope are identified for the relevant advisers.
FAQ
Common questions.
How long does an SME AI audit take?
Duration depends on the number of tools, teams and projects to review. It is confirmed after the first conversation, once the scope is clear. The aim remains a short, decision-oriented engagement.
What does an AI audit cost?
The audit is quoted after the scope is understood. No single package price is listed here, because the volume to review varies from one company to another.
Is the first conversation already the audit?
No. The 20-minute call is there to understand the situation and define the scope. The audit itself is a paid engagement.
Do we already need a formal AI project?
No. The audit is useful when uses are still scattered, a tool has already been bought, or you need to decide what to frame before investing further.
Does the audit replace a GDPR or security review?
No. It identifies points of attention and situations that should be checked with the relevant advisers if needed. Compliance is not promised.
What happens after the audit?
You decide. Depending on the findings, the next step may be tighter framing, governance, a project to deliver, or stopping a use. A separate engagement can be proposed, without obligation.
Do we then need another diagnostic?
No. The AI audit is a standalone engagement. It is not a mandatory step before asking Mahthildis to take on a project, and it is not a gateway to a second diagnostic.
Do you need an AI audit for your SME?
Book a first conversation or send your request. Mahthildis will confirm the useful scope before any engagement.
