AI memory audit and AI readiness check

A list of the AI tools your people use, what each one stores, who can see it and what rules apply. For a small firm it is a practical check of accounts, plans and settings, plus written rules and a staff briefing. It is not a technical penetration test or a certification.

Some people call the result their business brain: one place that records what your tools know about your firm.

A readiness assessment looks forward: is the firm ready to use AI safely, with the right tools, rules and people. A memory audit looks at what is already stored. We do both in one piece of work: first what is held now, then what the firm needs before it goes further.

Since the 10 April 2025 update, ChatGPT memory has two parts: saved memories and chat history. Users can turn off either in settings and Temporary Chat neither uses nor updates memory. OpenAI says it may use content you provide, including memories, to improve its models for personal accounts. In business workspaces each user's chats are private to them by default. We found nothing on OpenAI's pages that says whether an admin can read an individual's saved memories, so we check the live settings in the audit.

Copilot: Microsoft says memories are stored in the user's Exchange mailbox in a hidden folder, that admins can search users' memory through Purview eDiscovery or Content Search, that Purview retention policies and labels do not apply to Copilot memory and that memory and personalization actions do not generate audit log entries. Admins cannot restrict what type of information is added to memory.

Claude: Claude organisation owners can turn memory off for their organisation. An Anthropic help article says memory is retained and exportable by admins under existing enterprise chat retention policies, but it is undated, so we check it at audit. We did not find an Anthropic page saying whether admins can read individual members' memories.

Gemini: Google says Gemini conversation history in Workspace is separate for each app. We did not find a Google page that says whether admins can read individual chats.

ChatGPT: Enterprise account owners can turn memory off for the organisation. Claude: Claude organisation owners can turn memory off for their organisation and Anthropic made memory on by default for most Team and Enterprise organisations created on or after 31 October 2026. Microsoft 365 Copilot: an admin can turn off enhanced personalization, and users then cannot turn on their own custom instructions, saved memories or chat history. Gemini in Workspace: history controls are per app and admins can set auto-deletion of inactive chats after three months, 18 months or three years, available from 25 February 2026. Menus change, so we record the setting with a date.

It varies by vendor and plan. Microsoft says that if the admin-level control is off or the user turns chat history off, details from chat history are deleted after 30 days and that deleting a chat does not delete saved memories made from it. Google says that with Gemini conversation history off, new chats are kept in user accounts for up to 72 hours. Anthropic's personal plans keep data for five years if training is allowed and 30 days if not. Check your own plan.

No. ISO/IEC 42001 is an AI management system standard that organisations can be certified against. Our audit is a practical review for small firms. It draws on ISO 42001, the NIST AI Risk Management Framework and the ICO's AI and data protection risk toolkit as reference points. It does not certify you and it does not mean you comply with any of them.

We quote each audit in writing after a short call, so the price matches the number of tools, people and accounts. We do not publish competitor prices because we have not verified them. If you want a quicker, smaller start, the 45-minute AI Memory Review is £750.

AI Memory Review