When Corporate IT Blocks AI: Name an Owner and Silo a Safe Sandbox

Locked corporate IT is common in construction. Many firms run inside a closed ecosystem (think Samsung-style, or any approved-device and approved-app estate). That protects the business. It also makes it hard to keep pace with AI.

If your people cannot use non-approved tools, you are not “behind because you are lazy.” You are blocked by a real control. The risk is that competitors and clients keep moving while your team waits for a policy that never arrives.

Accendo Consultants works with construction and contracting SMEs on ISO and HSEQ systems that still have to work in the real world. The same pattern shows up with AI: security is not optional, and neither is learning. You need both.

The problem is speed versus control

Approved ecosystems are great at containing risk. They are slow at admitting new AI tools. Procurement, cyber, and information security all have good reasons to say no. Meanwhile the tools (ChatGPT, Grok, Claude, and the rest) change weekly.

So site and office teams either:

  • wait and fall behind
  • or use personal accounts on phones and create a shadow IT problem that is worse than a managed trial

Neither option is a strategy.

Accendo’s recommendation: name an AI / effectiveness owner

Someone has to own the question. Not “become the IT department.” Own effectiveness: what is worth trying, what is safe enough to trial, what should be blocked, and what top management needs to hear.

That person (or small pair) should:

  • understand how the business actually delivers work
  • sit close enough to HSEQ / quality / ops that ISO and client requirements are not an afterthought
  • translate AI experiments into plain English for directors
  • keep a short register of trials, risks, and decisions

Without an owner, AI stays hallway chat. With an owner, it becomes a controlled improvement stream.

Silo a local environment when the main estate cannot move

If the corporate network will not allow GPT, Grok, Claude, or similar tools, do not pretend the need disappears. One practical pattern Accendo recommends is a siloed local environment: a separate, tightly controlled setup outside the main production estate where named people can trial approved AI use-cases.

That sandbox is not a back door into client data. It is the opposite of chaos:

  • clear purpose and written rules
  • no live project or personal data unless deliberately allowed and logged
  • tools and accounts that are known, not random browser extensions
  • time-boxed experiments with a written outcome
  • a reporting line back to top management

Think of it like a controlled method trial on a construction site. You do not rebuild the whole programme of works to test one new approach. You fence it, supervise it, and bring the evidence upstairs.

What top management should get back

The AI / effectiveness owner should report in management language, not hype:

  • what was tried
  • what worked for estimating, method statements, toolbox talks, document control, or client packs
  • what failed or created risk
  • what would be needed to bring a use-case into the approved ecosystem
  • what must stay blocked

That gives directors a choice based on evidence, not fear or FOMO.

How this fits ISO and HSEQ thinking

ISO 9001, 14001, and 45001 already expect organisations to manage change, competence, and information. A unmanaged AI free-for-all fights those controls. A named owner plus a siloed trial environment supports them: documented decisions, risk awareness, and improvement without inventing a second paperwork factory.

UKAS-credible systems are lived systems. AI adoption should be lived the same way: proportionate, owned, and evidenced.

If your IT lock is real, start there

If this sounds like your firm, start with ownership and a safe sandbox, not with buying every tool on the market. Accendo can help you frame the role, the rules, and how the trial reports into top management, alongside the lean ISO and HSEQ work you already need for clients and certification.

Contact us today at andrew@accendo.org.uk.

Accendo Consultants: lean ISO, UKAS-credible, built for how you work.

ISO Management Review for Construction SMEs: 90 Minutes Is Enough

ISO management review for construction SMEs in about 90 minutes

Clause 9.3 of ISO 9001 (and the matching requirement in ISO 14001 and ISO 45001) asks leadership to review the management system at planned intervals. It does not ask for a three-day archaeology dig through folders nobody has opened since last year.

If you are a construction or contracting SME in Scotland or elsewhere in the UK, and an ISO consultant has left you with a management review template that takes a week to fill, that template is the problem, not the standard.

What ISO management review actually needs

Strip the folklore. At a high level, leadership needs to look at how the system is performing, what has changed, and what decisions follow. Typical inputs include:

  • Status of actions from previous reviews
  • Changes in external and internal issues that matter to the business
  • Information on performance and effectiveness (including trends on nonconformities, monitoring results, audit results, customer feedback)
  • Adequacy of resources
  • Effectiveness of actions addressing risks and opportunities
  • Opportunities for improvement

Outputs are decisions and actions: what you will change, fund, stop, or chase. Minutes that only restate the agenda are not a review. Decisions with owners and dates are.

You do not need a novel for each bullet. You need current evidence and an honest conversation.

Why reviews balloon for construction SMEs

The usual pattern:

  1. Someone copies a generic corporate template.
  2. Every clause gets its own appendix “in case the auditor asks”.
  3. Site teams are asked for data that already exists in job packs, NCR logs, or the KPI sheet, then typed again into Word.
  4. The meeting gets postponed because “the pack is not ready”.
  5. When the UKAS body is due, there is a scramble.

That is audit theatre. It is also why owners conclude ISO needs a full-time administrator. It does not. A proportionate review does.

A 90-minute shape that works on site businesses

Aim for one focused meeting, not a ceremonial conference.

Before (30 to 45 minutes of prep, ideally already digitised):

  • Pull last review actions and mark closed / open / overdue
  • Snapshot the few KPIs you actually manage (on-time delivery, rework or snags, incidents, waste or complaints, as relevant)
  • Note material changes: new sites, key hires or leavers, new high-risk subcontractors, scope shifts, significant contracts
  • Bring open NCRs, audit findings, and any client or HSE feedback that needs a decision

In the room (about 90 minutes):

  • Confirm what still matters in context (clients, regulators, principal contractors, insurers)
  • Walk performance honestly: what improved, what slipped, what the numbers do not show
  • Decide: resources, process tweaks, competence gaps, supplier issues, objectives progress
  • Assign owners and dates. Stop items that no longer earn their place

After:

  • File a short record with the decisions (not a transcript)
  • Update the action list where people will see it
  • Feed anything material into the next internal audit sample

If your review regularly needs a full day, either the system is too heavy or the prep is being done in the meeting. Fix the system and the prep, not the calendar invite.

Integrated management system, one review

If you run quality, environment, and health and safety together, you do not need three separate management reviews for ISO 9001, ISO 14001, and ISO 45001. An integrated management system can share leadership, performance evaluation, and improvement. Cover the environmental and H&S performance that is significant for your work in the same sitting. Separate meetings only when the audience or risk genuinely demands it.

That is the same proportionate logic Accendo uses when implementing systems for construction SMEs: one rhythm, not three paper stacks.

What UKAS assessors care about

A UKAS-accredited certification body wants evidence that top management is engaged with real performance and that actions happen. They are far less impressed by a 40-page pack of charts nobody discussed.

If decisions are invisible, if actions never close, or if the review only appears in the fortnight before Stage 2 or surveillance, expect questions. A lean, regular review with current data beats a once-a-year binder.

Accendo’s take

Accendo Consultants works with owner-led construction and contracting SMEs (West Lothian base, work across Scotland and the wider UK) to build ISO systems that leadership can actually run. Management review should be a short decision meeting on a living system, not homework for a quality folder.

If your current review pack feels like a second job, we can help you cut it back to what clause 9.3 and your business really need, including as part of a Lean IMS implementation or a focused sense-check before surveillance.

Ninety minutes of honest leadership time beats three days of paperwork theatre. Every time.

Accendo Consultants: lean ISO, UKAS-credible, built for how you work.
https://accendo.org.uk/