AI Consulting

AI consulting for UK small businesses

I’m Mark Benewith. I help UK small businesses use AI properly — not as a ChatGPT subscription sitting on top of the work, but built into the work itself, doing real things with your real data.

I’ve been running this approach in my own business for over a year. Not pilots, not theory — actual software handling actual jobs every day. Persistent memory across conversations. AI that reads and updates the systems I already use, in environments I control and isolate properly. The kind of work most businesses are told is months and tens of thousands of pounds away. It often isn’t.

I’d build the same kind of thing for you. Three ways to work with me, depending on where you are.

Get in touch
My Services

Three ways to work with me

01

AI Workshops

half a day, in your office or remote
From £800

For teams who've heard a lot about AI but aren't sure what's actually possible for the work they do. A practical, tailored session — not a generic "intro to ChatGPT" deck.

I spend an hour or two beforehand looking at your business so the workshop is genuinely about your work, not a stock presentation. We then spend half a day going through the things AI does well right now, the things it doesn’t and where the realistic opportunities are for a business your size.

Best for: Teams who want to get genuinely up to speed before deciding whether to invest in something more substantial.

What you get

  • Pre-workshop review of your business and current tooling
  • Half-day session for up to eight people, in person or remote
  • Plain-English walkthrough of what current AI tools actually do well
  • Worked examples using your real workflows and your real data
  • A short written follow-up with the specific opportunities I'd prioritise
02

AI Assessment

proper scoping of what's worth building
£2,500–£4,000

For businesses ready to do something concrete with AI but not sure where to start, or who've tried before and want a second look.

Two to three days of structured work: I look at how your business actually runs, where the real bottlenecks are, what you’ve already tried and where AI would genuinely earn its place. You get a written report with specific recommendations — what to build, what to buy and honestly, what not to bother with.

The report is yours either way. If the right answer is “you don’t need anything custom built — here’s the £30 a month subscription that solves it,” that’s what the report will say. The point of an assessment is honest scoping, not a pre-baked sales pitch.

Best for: Businesses who want to make a proper decision before committing to a build. Particularly suited to teams who've tried an AI project before that didn't stick — getting it right the second time is a different kind of work.

What you get

  • Discovery sessions with the people who actually do the work
  • Review of your current tooling and where it sits
  • A written assessment identifying the highest-leverage opportunities
  • Clear recommendations on each: build, buy, or leave alone
  • A scoped, fixed-price quote for any implementation work that makes sense
  • One follow-up session to talk through the report
03

AI Implementation

bespoke applications, properly built
Scoped per project

For businesses who know what they want to build, or who've completed an assessment and want to move forward.

I build proper software. Not Zapier flows pretending to be applications, not no-code prototypes that fall over six months in. A real application, designed for your business, that uses AI where AI earns its place and conventional code everywhere else. Hosted where you want it, secured properly, maintained over time.

The work usually involves connecting AI to the systems you already run on — your CRM, your accounting, your job management software, your email, whatever it is. I do that using a standard called MCP (Model Context Protocol — small pieces of software that let AI tools connect to your business data and take real actions, not just answer questions). MCP is the protocol Anthropic released for this kind of work, and it’s becoming the standard way serious AI integrations are built.

Best for: Businesses with a clear operational problem and the confidence that a properly-built solution is worth the investment. Typical projects are four to eight weeks of focused work.

What you get

  • A bespoke application, built around your specific business needs
  • Integration with the tools and systems you already use
  • Persistent memory — the AI remembers what's happened, decisions made, customers served
  • Container-isolated agents with credentials vaulted separately from the agent layer
  • A dedicated environment for your business — your AI doesn't share infrastructure with anyone else
  • GDPR-considered data handling
  • Hosted on your infrastructure or mine, depending on what suits
  • Documentation and a handover so you understand what you've got
  • Ongoing maintenance available as a separate retainer
How I work

How I work — and why it matters

Most AI consulting work falls into one of two camps. Enterprise consultancies running long, expensive engagements producing strategy documents. Or no-code agencies stitching together Zapier and ChatGPT and calling it AI transformation. Neither tends to leave a small business with anything that lasts.

I do something different. I build proper software — applications written in Laravel, the same kind of framework businesses use for serious operational systems — that uses AI as a feature, not as the entire product. The AI bit is important, but it’s one part of a properly-architected application. That distinction matters more than it sounds, and it’s why this kind of work tends to last.

A few specifics about how I work:

I use Claude rather than ChatGPT.

Anthropic’s Claude has, in my experience, the strongest combination of reasoning, code generation and reliability when running as part of an automated workflow. It’s also the model with the cleanest integration story via MCP. I’d switch if a better tool appeared — I’m not religious about it — but for now, Claude is the right answer.

I build around persistent memory.

Most AI tools forget everything between conversations, which is fine for asking how to write an email but useless for anything that should compound. The applications I build remember — your customers, your projects, your decisions, your context. That single architectural choice is the difference between AI as a useful tool and AI as something that genuinely gets better at your job over time.

I keep the stack simple and maintainable.

A Laravel application doing exactly what your business needs is more reliable, more maintainable and usually cheaper over three years than a growing collection of subscriptions glued together with workflow tools. Fewer moving parts, fewer vendors, no monthly creep on the per-seat pricing.

Security and data handling are designed in, not bolted on.

UK GDPR compliance for AI systems is genuinely non-trivial when AI is processing customer data. I treat this as foundational rather than as an afterthought.

Security

How I think about security

A concern about AI agents in 2026: most of them aren’t built securely. The popular open-source agent frameworks have a track record of exposed credentials, weak isolation between agent and host.

Tens of thousands of agent instances are sitting on the public internet with no authentication.

Bespoke software, built properly, doesn’t have to work that way. A few things I do as a matter of course:

Production agents run in isolated containers.

When I build an AI agent that lives in your business — handling your data, taking actions in your systems, running scheduled jobs — it runs in its own Docker-isolated environment. The agent doesn’t have unconstrained access to the host filesystem, the network, or anything outside its sandbox. If something goes wrong inside the agent, it stays inside the agent.

Credentials are vaulted, not held.

API keys for the systems your agent connects to — your CRM, your accounting software, anything with a token — are stored separately from the agent itself, and injected at request time with per-agent rate limits and policies. The agent never sees the raw credentials. If a prompt injection attempt got through somehow, there’s nothing to exfiltrate.

Each client gets a dedicated environment.

Your application doesn’t share infrastructure with anyone else’s. No shared databases, no shared filesystems, no shared API quotas. Clean separation.

The hard problems get acknowledged, not hidden.

Prompt injection is a real, ongoing risk in any system that lets an AI act on user input. Agentic boundary control — making sure the AI does the things you want and not the things you don’t — is an active area of design work, not a solved problem. I build with these risks in mind, set up monitoring to catch unexpected behaviour, and tell you honestly what’s defensible and what’s defensible-for-now.
Example tools

What this actually looks like

A few examples from my own operation. These are real applications that I built, that I use every day and that are still running. They’re the strongest reference I can give you — they’re what I’d build for you, applied to your business instead of mine.

01

Beacon — an SEO platform built around AI.

A Laravel application I built to replace the off-the-shelf SEO tooling I was paying monthly subscriptions for. It handles rank tracking, competitor analysis, keyword research and reporting across the client sites I look after.

The interesting bit isn’t the SEO — it’s that Claude is wired into the application via MCP, so I can have a conversation with it about a client’s data and have it actually run the analysis and update the records. The same kind of workflow that would normally need a dedicated analyst is something I can do over a cup of tea, because the application and the AI work together properly.

Built over a few weeks; replaces hundreds of pounds a month in SaaS subscriptions and saves more time than I can honestly account for.

02

A persistent memory layer for the AI itself.

This is the one that I’ve found most useful.

Most AI tools forget every conversation the moment you close the tab. I built a small application that gives Claude a long-term memory — a private database that remembers what we’ve worked on, what decisions we’ve made, what’s true about each of my clients. It runs on its own server, it’s accessed via MCP, and it means every conversation with Claude builds on the last one rather than starting from zero. This is the architectural choice that takes AI from “useful tool” to “something that genuinely compounds.”

Every serious application I build for a client includes a memory layer of some sort.

03

Todoist as an operational log, not just a to-do list.

Most small businesses don’t keep proper records of what got done, when, by whom, and why — because writing it up is the kind of admin nobody has time for.

I use Todoist (an excellent task manager application) as a structured logging system: every piece of work I do gets captured automatically, tagged by project and client, with the relevant context. Claude does the capturing. I don’t fill in any forms; I just do the work, and the record exists. When I need to look back at “what did I do for this client in March?” — the answer is there, properly structured, ready to query.

The same approach works for any small business that needs operational records: client work, site visits, support calls, repairs, anything where someone normally says “I’ll write it up later” and then doesn’t.

These are real, working examples. The shape of your application would depend on your business and your bottlenecks — that’s what assessments are for. But the techniques are the same: AI integrated properly, memory designed in from the start, software that does a specific job for a specific operation.

06. What I don't do

What I don't do

Being clear about scope upfront saves both of us time. I'm not the right person for any of the following:

No-code automation builds.

I don’t set up Zapier, n8n or Make workflows as a primary deliverable. They’re fine tools and have their place, but they’re a different kind of work and there are people who specialise in that — they’ll do it better and cheaper than I would. If the right answer for your business is genuinely a Zapier setup, I’ll tell you that and point you at someone who does it well.

Generic chatbots on websites.

Customer service chatbots and lead-capture bots are a commodity now. Many off-the-shelf tools do this well at low cost. Building a custom one is rarely worth the investment.

Anything that's actually about replacing people with AI to cut costs.

I work on AI that augments people doing real work, not AI that exists to make a redundancy round defensible. If that’s the brief, I’m not the right person for it.

AI implementations using non-Claude models.

For now, I build on Claude. If you have a strong reason to use a different model — regulatory, contractual, or technical — that’s a sensible conversation, but it’s not where I’d start.

Strategy documents without implementation.

I’m a developer, not a management consultant. The closest thing I do is the assessment tier, which produces a concrete written plan. If what you want is a 50-page strategy document with no one expected to actually build anything, there are firms who do that work — I’d point you at them.

About Mark

Why me

I’ve spent over twenty years building software, mostly in PHP — first WordPress, increasingly Laravel and over the past year, Laravel applications that integrate AI as a core part of how they work.

That background matters more than it might seem. Most AI consultants are from a strategy or research background — they can explain AI well, but they can’t ship working software. Most developers haven’t spent a year actually using AI as part of their daily operation, so they’re guessing at what works. The combination of “operator who’s been doing this for real” and “developer who can actually build it” is what tends to be missing.

For day-to-day continuity, I work with a trusted network of vetted specialists for capacity and cover. The work itself stays with me.

Common questions

FAQ

How is this different from hiring an AI consultancy?

Most AI consultancies sell strategy and PowerPoint presentations. I build software. The assessment tier produces a written plan, but the implementation tier produces a working application that does a specific job for your business. If what you need is the strategy and someone else will build it, I’m probably not the right fit. If what you need is something working, I am.

How is this different from buying ChatGPT Team or Microsoft Copilot?

ChatGPT Team and Copilot are general-purpose tools — useful for individual productivity, less useful for connecting AI to your specific business systems and processes. The work I do is the bit those tools don’t cover: AI integrated into your data, your workflows, your business logic. Many of my clients have ChatGPT Team or Copilot already and use them daily. The bespoke work is for the things those tools don’t do well.

Why Claude and not ChatGPT?

Three reasons. The reasoning is consistently stronger for the kind of multi-step work my applications need to do. The code generation is significantly more reliable when AI is writing or editing code as part of a workflow. And the ecosystem around it — Anthropic’s MCP standard, Claude Code, the developer tooling — is more mature for serious application development. ChatGPT is a very good consumer product. Claude is a better foundation for building business applications.

Why Laravel and not another framework?

Laravel is the right tool for the job: a mature, well-maintained PHP framework with strong authentication, testing and structure built in. It’s the framework I’m most fluent in, having used it for serious application work for years. Anthropic and the Laravel team have been co-developing first-class AI tooling — Laravel MCP, Laravel AI SDK, Laravel Boost — which means the integration story is excellent. If a different framework would be a better fit for a specific project, that’s a conversation worth having, but Laravel is my default and where most of my work lives.

Can you work with our existing systems?

Almost certainly. If your CRM, accounting software, or operational tools have an API — and most do — I can build integrations with them. The MCP standard makes this cleaner than it used to be, but even where MCP isn’t available, conventional API integration is well-understood territory. Part of an assessment is checking exactly what’s possible with your specific stack.

What about data privacy and GDPR?

Treated as a foundational consideration, not an afterthought. Anthropic’s API has clear data handling commitments — your data isn’t used for model training. For client projects involving personal data, I design with UK GDPR in mind from the outset: appropriate data minimisation, retention controls, processing transparency and the right contractual position with Anthropic and any other processors involved. The assessment phase always includes thinking through what data the application will handle and what that means for compliance.

What about agent security? I've read about AI agents being a security risk.

You’re right to ask, and the concern is valid. The popular open-source agent frameworks have a track record of weak isolation, exposed credentials and architectural choices that prioritise convenience over safety — and tens of thousands of instances are sitting on the public internet unprotected. That’s a real story.

I build differently. Agents run in isolated containers, credentials are stored separately and injected at request time rather than held by the agent, and each client gets a dedicated environment that doesn’t share infrastructure with anyone else’s. Prompt injection and agentic boundary control are real ongoing risks I can’t fully eliminate, but I design with them in mind from the start and monitor for unexpected behaviour. If you’ve been reading about agent security and it’s made you cautious, that’s exactly the right reaction — and exactly why bespoke software, built properly, is a different proposition from the public-internet agent frameworks.

Where will my application be hosted?

Whichever makes sense. Some clients prefer their application hosted on their own infrastructure for full control. Others prefer me to handle it on the same UK-based infrastructure I use for managed WordPress hosting. Both work. We’ll talk through the trade-offs as part of the project setup.

How long does an implementation take?

Most projects are four to eight weeks of focused work, depending on scope. I take a small number of implementation projects at a time so they get proper attention rather than competing for capacity with a larger client list. If you get in touch and I’m at capacity, I’ll tell you that and give you a realistic start date.

What does ongoing support look like?

Bespoke applications need ongoing maintenance — model updates, framework updates, occasional adjustments as your business evolves. This is handled as a separate retainer arrangement, scoped to your specific application. It’s similar in approach to my WordPress care plans: a sensible monthly arrangement to keep the system running properly, not a surprise invoice when something breaks.

Can I see examples of work?

Many of the projects I work on involve commercially sensitive business systems, so case studies are anonymised or shared privately on request. The most concrete reference is my own operation — the agentic systems I run for my own business are the same kind of thing I’d build for clients, and I’m happy to walk through what they do and how they work in a discovery conversation.

Get in touch

Describe the problem.

You don't need a detailed brief. Tell us what you're trying to achieve and we'll tell you honestly if we can help.

Start a conversation

Tell me about your business

If you’ve got a specific operational problem and you’re wondering whether AI fits — or whether it’s worth the investment — get in touch with a brief description. You don’t need a full brief. A plain account of what you’re dealing with is enough to start a conversation.

I’ll come back to you honestly about whether it’s something I can help with, what I’d suggest and what the next step looks like.