ICS.AI LTD

SMART: Data - Central Government - Foundation

Data visibility for central government. Dashboards for demand, workload, and performance. Data ingestion from channels and departmental systems, interaction tagging by intent, exportable reports. Applications: Casework Management, Correspondence, Service Performance, FOI & SAR. OLM grounded with governance.

Features

• Dashboards for demand, workload, and performance metrics
• Data ingestion from channels and departmental systems
• Interaction tagging by intent, outcome, and service area
• Exportable reports for governance reviews and compliance
• Prioritisation views by age, risk, and status
• Configurable filters by departmental service and time period
• Role-based access controls for dashboard access
• Privacy controls for sensitive departmental data fields
• Scheduled reporting for regular governance reviews
• Audit-ready exports for compliance and governance

Benefits

• Improves visibility of departmental demand drivers
• Reduces manual reporting workload for analysts
• Supports evidence-based departmental decisions and planning
• Provides prioritisation insight for resource allocation
• Reveals patterns and service failure points for improvement
• Enables consistent reporting across directorates
• Supports compliance with role-based access controls
• Frees analysts from manual data compilation
• Provides data for governance and assurance
• Enables faster response to emerging departmental issues

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@ics.ai. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

333461407237033

Contact

Andrew smith
01256 403800
info@ics.ai

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  • Search and knowledge discovery

  AI software services

  • Conversational AI Software Services
  • Generative AI Software Services
  • Personalize AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: SMART: TOM
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: N/a
• System requirements:
  • Microsoft Azure subscription - UK or EU hosted
  • Microsoft Azure SQL database
  • Microsoft Azure Key Vault Microsoft Teams
  • Microsoft Power Automate Microsoft Entra ID
  • Microsoft Bing Services Microsoft Azure Cosmos DB
  • Microsoft Azure & Cognitive Services
  • Windows Server 2022+ SQL Server (Std/Enterprise) 2022

User support

• Email or online ticketing support: Yes
• Support response times: The Support levels are as follows and the SLA for an Urgent issue is a response in 1 hour and a fix or workaround within 24 hours or 72 hours, dependent on contract
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The Support levels are as follows and the SLA for an Urgent issue is a fix or workaround within 24 hours or 72 hours, dependent on contract; 1.Urgent - System not responding or critical function loss that affects all users; 2. High - A function loss that causes significant disruption to business and users; 3. Normal - Function loss that affects some users but will not stop them from being able to do other tasks; 4. Low - A cosmetic issue or a minor function loss that affects some users; This service, up to an agreed number of hours per month is included in the cost of the Licence for the Citizen Services bot. Additional support hours can be purchased if required.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Our onboarding services ensure successful deployment and adoption of SMART: AI products across your organisation. We deliver a complete journey from initial onboarding to full transformation, leveraging familiar interfaces that require minimal training—if users can use ChatGPT, they can immediately use our SMART: platform. The service focuses on rapid time-to-value with deployment typically completing within weeks rather than months. The program includes comprehensive documentation, testing guides, and best-practice templates covering over 1,800 pre-built AI adoption scenarios. We establish internal communities of practice and digital networks for AI champions, creating adoption storytelling for stakeholder engagement and enabling knowledge sharing and continuous improvement. We deliver tiered learning paths that progress from basic AI literacy to advanced domain-specific capabilities. Our support extends beyond initial deployment with hypercare periods, ongoing technical assistance, and structured feedback sessions. The service includes usage analytics and adoption monitoring to track progress against success criteria, with regular reporting on key performance indicators through our customer success team. We facilitate collaborative evaluation sessions, capture detailed user feedback, and continuously optimize the deployment based on real-world usage patterns. Post-deployment support includes access to designated support channels based on your service agreement level.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Customers are required to backup their databases and keep them securely.
• End-of-contract process: Our offboarding services ensure smooth transition and complete data sovereignty when concluding SMART: AI services. As the platform operates within your tenant environment, you maintain continuous access to your organizational data throughout the service lifecycle. The offboarding process validates data completeness, ensures all user-generated content, configurations, and operational data remain accessible in standard formats for future use or migration. We provide comprehensive documentation, export procedures, and verification checklists to confirm successful data retention. The service includes removal of ICS.AI proprietary intellectual property including specialised algorithms, pre-built templates, domain-specific models, and platform-specific components while preserving your organisational knowledge and customisations. We conduct validation sessions to verify data integrity and accessibility post-separation. We include knowledge transfer sessions covering data management best practices, architectural documentation for any retained components, and guidance on maintaining compliance requirements. We provide a structured timeline typically spanning 30-60 days, with clear milestones and sign-off procedures. The process includes final usage reports, audit trails, and compliance certificates. ICS.AI maintains the right to charge for this service based on the clients needs. All offboarding activities maintain security protocols and data protection standards throughout the transition.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: TBC
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Users can consume the service in real-time from their web browser, a mobile native app, telephone and a wearable device. User can also send and receive messages to and from the service via email and SMS.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The service has undergone independent accessibility testing by Digital Accessibility Centre Limited, a specialist accessibility testing organisation. Testing was carried out against WCAG 2.2 AA criteria, including assessment of compatibility with common assistive technologies and accessibility features. Findings were addressed as part of the development process, and the service achieved WCAG 2.2 AA compliance. Accessibility testing is repeated as the service evolves.
• API: Yes
• What users can and can't do using the API: The platform is designed with an API-first architecture and may expose governed, read-only or controlled APIs for functions such as user provisioning, governance reporting, and value-realisation use cases. Customers cannot programmatically create, modify, or invoke AI services, agents, or workflows via an API at this time. Any future APIs will enforce the same security, policy, and audit controls as the user interface and will not provide unrestricted access to models, prompts, or customer data.
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: The platform is designed so that it can be customised by ICS.AI to provide customer-oriented look and feel with knowledge and responses grounded by the customer's content. The platform can be customised by authorised users through its secure web-based management interface. Administrators can configure organisational structures, user roles and permissions and enable or disable platform capabilities by group/role. Specific AI skills can be customised by changing system prompts for guardrails and other behavioural requirements as well as changing model selection and parameters. End users cannot modify governance controls or platform-level settings. The platform can be extended by authorised users to create agents, workflows and orchestrations using a web-based development toolset. Deployment of these extensions always requires administrators to review, test and approve before they are available to end-users.

Scaling

• Independence of resources: The service is deployed as a dedicated instance within each customer’s Microsoft Azure tenant. Customers do not share infrastructure or resources with other organisations, ensuring that demand from other users cannot affect service performance. Capacity and performance are managed using Microsoft Azure-native controls within the customer’s own environment.

Analytics

• Service usage metrics: Yes
• Metrics types: Chat logs for all users are available including conversation data, searches and user selections.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Access to data at rest is restricted using role-based access control and least-privilege principles within the customer’s Microsoft Azure environment. Application logs are designed to avoid the storage of personal data, and any incidental PII is redacted before being written to log storage. Where PII is required for transaction processing, it is protected using application-level symmetric encryption in addition to Microsoft Azure-managed encryption at rest. Access to decrypted data is restricted to authorised application components operating under least-privilege controls, further reducing the risk of unauthorised access.
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: End users do not export data directly from the service. Data associated with user activity, such as transaction records, is owned by the customer organisation and can be exported by authorised customer administrators or by the supplier on request in commonly used formats as part of reporting or offboarding. User preference data is stored to support service usability and is typically deleted rather than exported, unless otherwise requested by the customer.
• Data export formats: Other
• Data import formats: Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: TBC

Availability and resilience

• Guaranteed availability: SMART: AI does not operate as a multi-tenant SaaS service and does not provide a standalone availability SLA. The service is deployed into the customer’s own Microsoft Azure tenant, and overall availability is dependent on the customer’s Microsoft Azure configuration and the availability commitments provided by Microsoft Azure for the underlying services used (for example, Azure SQL, Storage, and compute services).
• Approach to resilience: ICS.AI does not operate its own datacentres. The service is deployed into the customer’s Microsoft Azure tenant, and datacentre resilience is provided by Microsoft Azure. Microsoft Azure datacentres are designed for high availability and resilience, including geographically distributed regions, redundant power, cooling, and networking, and fault-tolerant infrastructure.
• Outage reporting: Service outages are reported through agreed customer communication channels. Where an incident affects SMART: components managed by the supplier, the supplier will notify the customer in line with the agreed support and incident management process.; ; As SMART: is deployed within the customer’s Microsoft Azure tenant, customers can also monitor service health and availability directly using Microsoft Azure-native monitoring and alerting tools. Where outages are caused by underlying Microsoft Azure services, status information is available through Microsoft Azure Service Health. Incident updates and post-incident information are provided to customers as appropriate

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted using role-based access control and least-privilege principles within the customer’s Microsoft Azure tenant. Administrative access is limited to authorised personnel and protected using strong authentication mechanisms.; ; Supplier access to customer environments is controlled by the customer. Support channels are restricted to named customer contacts, and sensitive information is shared only through secure, authenticated communication channels.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Other
• Description of management access authentication: Management access to the service is authenticated using Azure-native identity services within the customer’s Microsoft Azure tenant. Administrative access is granted only to authorised users and protected using strong authentication, including multi-factor authentication where enabled by the customer. Supplier personnel access customer environments only with explicit approval and using customer-managed identities, and is removed when no longer required.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: No
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials Plus
• Information security policies and processes: ICS.AI follows a defined set of information security policies and processes aligned to recognised good practice and public sector expectations. These include policies covering access control, data protection, incident management, vulnerability management, secure development, logging and monitoring, and supplier access management.; ; Responsibility for information security is assigned within the management structure, with oversight of policy definition, implementation, and compliance. Policies are communicated to relevant staff and contractors, and compliance is enforced through role-based access controls, documented operational procedures, and technical controls within the service.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Service components are tracked throughout their lifecycle using version-controlled configuration artefacts and deployment records for each customer environment. Changes are requested, assessed, and approved through a defined change process that considers functional impact, security risk, and customer impact. Security implications are reviewed as part of change assessment, including access controls, data handling, and dependency changes. Changes are tested prior to deployment and implemented in a controlled manner, with rollback procedures available where appropriate. Configuration and change records are retained to support audit and incident investigation.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are assessed through a combination of third-party penetration testing, review of security advisories, and ongoing evaluation of changes to the threat landscape. Identified threats are assessed for likelihood and impact, including effects on data security and service availability. Information about potential threats is obtained from penetration testing providers, Microsoft Azure security advisories, and relevant industry sources. Security patches and mitigations are prioritised based on risk and deployed through controlled change management process, with urgent security fixes applied as soon as practicable.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Potential compromises are identified through Microsoft Azure-native monitoring and logging within the customer’s Microsoft Azure tenant, supported by supplier review of relevant application and security events. Where suspicious activity is reported, ICS.AI investigates in line with its incident management process and works with the customer to confirm scope and impact. Response actions, including containment and remediation, are initiated promptly in co-ordination with the customer. Incidents are triaged on discovery and responded to as soon as practicable, with priority given to events affecting data security or service availability. Customer notification follows agreed support arrangements.
• Incident management type: Supplier-defined controls
• Incident management approach: The product support team follow defined processes around logging, assigning, escalating and resolving issues. Nominated service users can report issues via a dedicated web portal, email address or telephone number and are regularly informed of incident progress. Incident report updates are available via the web portal or by contacting the support team.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 56618072-53c4-4aba-91dc-19c2775e3d91
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@ics.ai. Tell them what format you need. It will help if you say what assistive technology you use.