AI-powered Cyber Essentials assessment: what Fig Group does differently

An AI-assisted assessment workflow can identify patterns in self-assessment evidence and prepare material for human review. Before using it with customer submissions, confirm the approved processing environment, model providers, access controls and retention terms. Fig Group’s privacy notice and subprocessor information are the starting points for processing enquiries; this illustrative workflow does not create a separate data-location or third-party-processing promise. Four useful applications are:

Submission quality, assessor capacity, clarification and remediation can all affect elapsed time. Fig Group's published six-working-hour Basic guarantee applies to a complete, compliant submission received before the stated cutoff, subject to its terms.

An illustrative workflow would route a morning submission to an assessor promptly, with possible issues already highlighted. The assessor still checks the answers and may return questions or feedback. This illustration is not a measured processing trace or a promise of a particular decision time.

Compare providers' written clocks using the same submission quality, cutoff and business-day assumptions. A market average or explanation of other providers' queues requires comparable provider records.

These are illustrative review prompts, not counts from an authenticated cohort:

1. MFA appears partial. Check every in-scope cloud-service user and the actual sign-in method.

2. Patching is described as monthly. Check release dates and whether high or critical vulnerabilities were fixed within 14 days when fixes were available.

3. BYOD is governed only by a policy. Check the technical controls and whether the chosen scope is accurate.

4. A remote worker uses a home router. Distinguish a privately owned internet-only router, normally outside scope, from an organisation-owned or managed device that may be in scope; check the endpoint firewall.

5. Cloud services are listed without their access controls. Check service and account scope, including MFA.

An assessor must verify the relevant facts and decide the result. No fixed detection time or frequency is implied.

IASME's scheme rules require that assessments are performed by named licensed assessors. Fig Group operates entirely within these rules: the AI is a tool the assessor uses, not a replacement for the assessor. Every certificate carries an IASME-licensed assessor's name. Every contentious judgement is documented by a human. The AI speeds up the parts that can be safely sped up - triage, gap detection, feedback drafting - and leaves the judgement to humans.

Any statement about IASME consultation or approval of a particular AI pipeline needs the relevant correspondence and scope. The assessor remains accountable for decisions under the applicable scheme rules.

Two specific extensions of the AI pipeline are in development in 2026:

1. Structured evidence validation. A proposed Plus workflow could organise device sampling evidence for the technical assessor. It cannot replace the specified tests or the assessor's judgement.

2. Renewal pre-population. A proposed renewal workflow could show prior answers and flag differences against the applicable account version. The customer must review the full current submission; there is no fixed 20-question renewal route.

Neither extension changes the core model: human assessor accountability, AI assistance, IASME scheme compliance.

AI-assisted triage can help an assessor prioritise complete submissions and draft useful feedback. The published Basic guarantee still depends on the stated intake conditions and a successful human assessment; this article does not claim measured queue reduction or an automatically approved certificate.

Get Cyber Essentials certified in 6 hours | Read about the 6-hour guarantee | See pricing