As of 13 August 2026, AI can only partly check whether your business meets Cyber Essentials requirements.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 2 hours until you can act on the result.

   How to actually do it

   1. Open the current Cyber Essentials requirements from the official certification source and save the exact version and scope that applies to your business.
   2. Gather your asset inventory, user and administrator lists, network diagram, cloud service list, security policies, patch records, malware protection settings, firewall settings, access control records and device configuration evidence.
   3. Remove passwords, private keys, personal data and unnecessary customer information, then paste the requirements and evidence into a chatbot using the prompt.
   4. Ask the chatbot to keep unknown items separate from items marked partly met, and to quote the evidence supporting every status.
   5. Compare every claim marked met with the corresponding live setting, device record or supplier evidence, asking your IT administrator or managed service provider to confirm anything you cannot inspect.
   6. Create a remediation list from the unknown and not met items, assign an owner and due date, then update the evidence after each change.
   7. Send the completed evidence pack and unresolved questions to an independent Cyber Essentials assessor before submitting any certification answers.

   Prompt

   Act as a Cyber Essentials readiness assessor, not a certifying body. Use only the current Cyber Essentials requirements and evidence I provide. Do not assume that a policy exists in practice, that a setting is enabled, or that an answer is compliant when the evidence is incomplete. For each requirement, create a table with: requirement, evidence supplied, status of met, partly met, not met or unknown, exact reason, missing evidence, a practical remediation action, and who should verify it. Separate written policy evidence from technical evidence. Flag anything that needs a live configuration check, vulnerability check, privileged access review, device inventory check or specialist judgement. Quote or reference the supplied requirement text so I can trace each conclusion. Do not invent system details, dates, products, versions or compliance claims. End with a list of unanswered questions and a short handover checklist for an independent Cyber Essentials assessor. Business context: [business type and size]. Scope: [devices, users, cloud services and networks in scope]. Current requirements: [paste the current official Cyber Essentials requirements]. Evidence: [paste policies, asset inventory, configuration exports, supplier statements and answers].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.