As of 13 August 2026, AI can prepare your business for Cyber Essentials.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 2 hours until you can act on the result.

   How to actually do it

   1. Open the current Cyber Essentials guidance on GOV.UK and save or copy the relevant pages into a working document.
   2. Gather your current device, operating system, software, cloud service, network, account and remote-access inventories from your IT administrator or managed service provider.
   3. Collect the security policies, update records, firewall information, administrator-account details and other evidence your business already holds, removing unnecessary personal data.
   4. Paste the guidance and business information into a chatbot with the supplied prompt, then ask it to produce the checklist, missing-information list and remediation plan.
   5. Send each unanswered technical question to the person who manages that system, and replace assumptions in the AI output with their confirmed answers.
   6. Compare every proposed answer and evidence item against the current GOV.UK guidance and the live configuration, then have a responsible IT colleague approve the preparation pack before using it for a Cyber Essentials assessment.

   Prompt

   Help me prepare my UK business for Cyber Essentials. Use only the current official Cyber Essentials guidance and the business information I provide. If you cannot confirm a requirement from the supplied guidance, mark it as unknown rather than guessing. Do not claim that the business is compliant or certified.
   
   Business details:
   - Business name: [business name]
   - Industry and size: [description]
   - People and working locations: [description]
   - Devices, operating systems and servers: [inventory]
   - Cloud services, websites and email services: [list]
   - Network equipment and remote access: [description]
   - Software and applications: [list]
   - User accounts, administrator accounts and authentication: [description]
   - Updates, malware protection, firewalls and backups: [description]
   - Existing security policies and procedures: [paste or summarise]
   
   Create:
   1. A plain-English preparation checklist grouped by topic.
   2. A list of missing facts and documents, with the person who should provide each item.
   3. A table mapping each proposed action to the relevant official guidance, quoting or linking the source where available.
   4. A risk-ranked remediation plan that separates urgent technical work from documentation work.
   5. Questions that an IT administrator or managed service provider must answer.
   6. A final list of statements that must not be submitted until a responsible person has checked them against the real systems.
   
   Do not invent devices, settings, suppliers, dates, evidence or compliance claims. Clearly label assumptions, contradictions and items that require an IT professional to inspect the systems.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.