Cyber Essentials is the NCSC-backed certification UK clients, insurers and public-sector frameworks ask a small firm for. Its Danzell question set, in force from 26 April 2026, defines cloud services broadly, keeps them in scope whenever the firm configures or administers them, and makes multi-factor authentication mandatory on every cloud service that offers it: a service with MFA available and not enforced is an automatic fail. Claude Team, ChatGPT Business, Copilot, Gemini and any AI platform the firm administers are cloud services, so they are in scope. An AI set-up passes when every seat is on a business plan behind single sign-on with MFA, personal accounts are banned and the expensed ones cancelled, admin roles are limited and reviewed, connectors are authorised deliberately, and built systems run on accounts and infrastructure the firm controls with the same MFA, patching and access rules as everything else.
- Danzell
- From 26 April 2026
- Cloud services
- In scope; MFA mandatory where offered
- AI assistants
- Are cloud services
What changed in April 2026
The Danzell question set replaced Willow from 26 April 2026. It defines a cloud service as an on-demand, scalable service on shared infrastructure, accessed over the internet with an account, that stores or processes the organisation’s data, and it does not allow cloud services to be excluded from scope. Multi-factor authentication moved from expected to mandatory: where a cloud service offers MFA and the applicant has not enabled it, the assessment fails, regardless of whether MFA is free, bundled or a paid feature. The five control themes, firewalls, secure configuration, security update management, user access control and malware protection, are unchanged in substance.
Why your AI tools are in scope
Claude Team, ChatGPT Business, Microsoft 365 Copilot, Gemini for Workspace, an AI notetaker, a CRM’s AI agent and a low-code automation platform are all cloud services the firm administers and that process its data. Each therefore needs MFA enforced, accounts managed (joiners, leavers, admin roles), and secure configuration recorded. A personal ChatGPT account used for work is the awkward case: it is not administered by the firm, so it cannot be brought into compliance, which is one more reason the policy bans it.
RelatedShadow AI in a UK small business Claude Team plan for a UK business
How an AI set-up passes
Six things an assessor will look for on the AI services the firm lists.
- 01
Every seat on a business plan behind the firm’s single sign-on with MFA enforced; no local passwords on the AI service itself
- 02
Personal accounts banned in the policy and expensed subscriptions cancelled; a leaver process that removes AI seats with everything else
- 03
Admin roles on each AI platform limited to named people and reviewed quarterly
- 04
Connectors and integrations authorised by an administrator, least privilege, listed in the asset register
- 05
Built systems on accounts and infrastructure the firm controls: MFA on the cloud console, secrets in a vault, patching in the same cycle as other servers, malware protection where applicable
- 06
A record of each AI service with its owner, its MFA status and its data position, alongside the processor record you already keep for GDPR
RelatedAI acceptable-use policy template AI security risks for a UK small business Your data when a supplier builds your software
Cyber Essentials Plus and the questionnaire
Plus adds an assessor’s technical verification of the same controls, and clients in regulated sectors increasingly ask for it. For AI services the assessor will look at MFA enforcement and account management on the platforms the firm lists; for built systems, at the hosts and endpoints. The same folder that answers a client’s AI questionnaire, processor agreements, attestations, the twenty due-diligence answers, answers most of the assessor’s questions too, which is why we recommend keeping one folder for both.
What it does not cover
Cyber Essentials is about the firm’s own infrastructure and accounts, not about whether the AI’s output is right, whether data protection has been done, or whether an agent has been given too much authority. Those sit with the policy, the DPIA, the acceptance threshold and the controls in our security guide. A firm can hold the certificate and still have an agent with admin access to its CRM; the certificate proves the door has a lock, not that the assistant behind it is sensible.
RelatedA DPIA for AI, with a template How to check AI output before you rely on it
Common questions
Are AI tools in scope for Cyber Essentials?
Yes. Under the Danzell requirements from 26 April 2026, any cloud service the firm administers that processes its data is in scope and cannot be excluded. Claude Team, ChatGPT Business, Copilot and Gemini are cloud services.
Do we need MFA on ChatGPT and Claude for Cyber Essentials?
Yes. MFA is mandatory on every cloud service that offers it; a service with MFA available and not enforced is an automatic fail. Put the seats behind single sign-on with MFA.
Does a personal ChatGPT account break our Cyber Essentials?
It cannot be brought into scope because the firm does not administer it, and it processes firm data. Ban personal accounts in the policy and cancel the expensed ones.
Does Cyber Essentials cover a custom AI system we had built?
The infrastructure and accounts it runs on, yes: MFA on the cloud console, patching, access control. Its behaviour, data protection and authority are covered by the policy, the DPIA and the design controls, not the certificate.
What changed with Danzell in 2026?
A broad definition of cloud services that cannot be excluded from scope, and mandatory MFA on every cloud service that offers it, replacing the previous expectation.
Does Cyber Essentials prove our AI is safe?
It proves the accounts and infrastructure have basic controls. Whether the assistant’s output is checked, the data protection is done and the agent’s authority is limited are separate questions with separate evidence.