Terms of engagement

1) Scope. Every engagement is defined by a written order form stating deliverables, exclusions, acceptance criteria and price. Where an order form conflicts with these terms, the order form governs for that engagement. Work outside the agreed scope is a change request, agreed and priced before it proceeds.

2) Timing. Delivery windows begin when the scope AND the required inputs are accepted. Client-side delays pause the clock and are rescheduled by agreement. For the Defenders' Window Assessment the published 72-hour window runs from accepted inputs.

3) Payment. Fees exclude VAT, which is added on invoices. Deposits reserve a delivery window. If you cancel more than 14 days before the window, the deposit is refunded in full less any reasonable costs already incurred. If you cancel within 14 days of the window, the deposit is retained in full. Where a service was 100% prepaid (for example the Defenders' Window Assessment) and you cancel within 14 days, 50% of the fee is retained and the balance is refunded. Balances fall due on accepted deliverables (14-day terms unless the order form states otherwise). The Continuous AI-Risk Monitor runs monthly in advance with a 30-day exit; the final month is not refunded part-way through a started month.

4) Acceptance. Deliverables are accepted in writing, or deemed accepted if no written issues are raised within 10 working days of delivery. One round of corrections of errors against the agreed scope is included.

5) Diagnostic outcomes. A stop or do-not-build recommendation is a successful completion of a diagnostic engagement.

6) What we do not provide. No legal advice, accredited audit or certification is provided; framework mappings (NIST AI RMF, ISO/IEC 42001) are informational. Client material is processed per the agreed data-handling note; no live personal data enters AI tools before arrangements are signed.

7) Liability. Our liability for an engagement is limited to the fees paid or payable for that engagement. Nothing in these terms limits liability for fraud, or for death or personal injury caused by negligence.

8) Law. Governing law is England and Wales. Contractor status (IR35) is determined per engagement.

Last updated: 30 September 2026.