We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

EY (UK), Ernst & Young LLP review

Advisory firm

EY's UK firm, Ernst & Young LLP. Its advisers and lawyers offer data protection, privacy law and AI governance work alongside its audit practice.

Relevant if you need AI governance advice from a mixed team of lawyers, risk experts and data scientists

Price Not published
Indemnity cover Published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

EY scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 3/5

What EY offers, and what it publishes

EY has named people for this work: Matt Whalley, a London law partner in privacy and AI risk, and Matthew Ringelheim, AI and Data Lead for the UK and Ireland. It publishes a named case study on AI governance for Mott MacDonald, a UK engineering consultancy, using an 'AI Governance Maturity Model and Responsible AI Risk Taxonomy'.

EY does not publish a price, hourly rate or fixed fee for this work. We found no outside accreditation, such as ISO 42001, for its own advisory practice; EY CertifyPoint certifies other organisations. It does publish its registrations with the ICAEW, FCA, SRA and ICO, and names its professional indemnity insurer, Gloucester Insurance Ltd.

In July 2026 the FRC fined EY LLP £1,197,000 and issued a severe reprimand over its FY21 audit of Made.com. A separate FRC investigation into unauthorised auditor's reports, opened in July 2025, is still open, with no finding of misconduct. Both concern audit, not data protection. On Trustpilot it scores 1.7 from 179 reviews, mostly about workplace culture and recruitment.

Strengths

  • Named UK partner-level leadership in privacy and AI risk law (Matt Whalley, Partner, Law) plus a dedicated UK&I AI and Data Lead (Matthew Ringelheim) and AI Risk Intelligence Lead (Nishobika Sivakumaran).
  • Publishes a detailed, named UK client case study on AI-governance work (Mott MacDonald), naming the methodology used and the multidisciplinary team involved.
  • Discloses core regulatory credentials on its own site: ICAEW audit registration, FCA authorisation, SRA licence for its legal arm, and ICO registration.
  • Publishes its professional indemnity insurer (Gloucester Insurance Ltd) and confirms worldwide territorial coverage.
  • Dedicated UK service pages exist for data protection and privacy, AI governance and compliance, and data and cyber law, distinct from generic consulting pages.

Things to check

  • EY and an audit partner were fined £1,246,000 over the 2021 Made.com audit. This concerned financial audit work, not data protection advice.
  • The FRC opened a formal investigation (authorised 22 Jul 2025, announced 10 Dec 2025) into EY LLP and two members over the unauthorised issuance of auditor's reports to audited entities; the matter remains open.
  • No published fee rates, hourly rates, or fixed-fee packages for UK data-protection or AI-governance advisory work could be found on EY's UK service pages.

Common questions

Does EY publish its fees for this work?

No. Its UK pages for data protection and privacy, and for data and cyber law, show no fee rates, hourly rates or fixed-fee packages.

Has EY been sanctioned by a regulator?

Yes, over audit work. On 28 July 2026 the FRC fined EY LLP £1,197,000 and issued a severe reprimand over its FY21 audit of Made.com Group plc. A separate FRC investigation, opened in July 2025, remains open with no finding of misconduct.

Does EY publish its insurance?

Yes. It names its professional indemnity insurer, Gloucester Insurance Ltd, care of Aon's Professional Services, with worldwide cover.

Does EY say how it uses AI?

In part. Its UK privacy statement, last updated 26 April 2024, says AI tools such as Microsoft Copilot process personal data in meeting recordings and transcripts.

Evidence for each EY score

Show our working

Notes behind each thing to check

  • EY and an audit partner were fined £1,246,000 over the 2021 Made.com audit. This concerned financial audit work, not data protection advice. (FRC Final Settlement Decision Notice published 28 July 2026 on frc.org.uk, stating the £1,197,000 EY fine and £49,000 partner fine plus a published severe reprimand.)
  • The FRC opened a formal investigation (authorised 22 Jul 2025, announced 10 Dec 2025) into EY LLP and two members over the unauthorised issuance of auditor's reports to audited entities; the matter remains open. (FRC news release dated 10 December 2025 on frc.org.uk; the FRC's own page states opening an investigation is not itself a finding of misconduct.)
  • No published fee rates, hourly rates, or fixed-fee packages for UK data-protection or AI-governance advisory work could be found on EY's UK service pages. (Checked ey.com/en_uk/services/consulting/data-protection-privacy and ey.com/en_uk/law/data-cyber; neither page discloses pricing.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 FRC fined EY LLP £1,197,000 in July 2026 over the Made.com FY21 audit and separately opened an investigation in 2025 into unauthorised issuance of auditor's reports; a further Shell audit-rotation inquiry is also reported open.
Qualifications of the people who do the work 4/5 EY LLP is ICAEW-registered (C009126168) for audit, FCA-authorised (196203), SRA-licensed as a licensed body (no. 614947) for EY Law, and ICO-registered (Z5535234), all disclosed on ey.com.
What it publishes about fees 1/5 No fee rates, rate cards, or fixed-price packages for data-protection or AI-governance advisory work are published on EY's UK service or law pages checked.
Knowledge of your sector 4/5 Named UK privacy/AI-risk law partner (Matt Whalley), a dedicated UK&I AI and Data Lead and AI Risk Intelligence Lead, and a named UK client AI-governance case study (Mott MacDonald) evidence a real practice.
Independence from what it sells 3/5 EY is an independent advisory firm rather than a software vendor, but its AI-governance and compliance offerings are delivered partly through named alliances with ServiceNow and Microsoft Purview.
Who carries the risk if the advice is wrong 3/5 EY LLP discloses a named professional indemnity insurer with worldwide cover, but trades as an LLP and has paid FRC-imposed financial sanctions when assurance work fell short of required standards.

Sources for EY

  • Ernst & Young LLP is registered at Companies House as a limited liability partnership. (Company number OC300001, incorporated 6 April 2001, status Active) (Companies House, checked 19 September 2026)
  • EY discloses its professional indemnity insurer and cover on its own UK site. (Insurer: Gloucester Insurance Ltd c/o Aon's Professional Services, 122 Leadenhall Street, London EC3V 4AN; territorial coverage worldwide) (ey.com, checked 19 September 2026)
  • The FRC fined EY LLP over the Made.com Group plc FY21 audit. (£1,197,000 financial sanction plus a published severe reprimand, decision notice dated 28 July 2026, for breaches of International Standards on Auditing on going concern and deferred tax asset work) (frc.org.uk, checked 19 September 2026)
  • The FRC opened an investigation into EY LLP over unauthorised issuance of auditor's reports. (Investigation authorised by the FRC Conduct Committee on 22 July 2025, announced 10 December 2025, into EY LLP and two members; remains open with no findings of misconduct made) (frc.org.uk, checked 19 September 2026)
  • EY publishes a named UK client case study on its AI-governance advisory work. ("How Mott MacDonald is building confidence through responsible AI" describes EY teams using an "AI Governance Maturity Model and Responsible AI Risk Taxonomy" for UK engineering consultancy Mott MacDonald) (ey.com, checked 19 September 2026)
  • EY names a UK-based partner specialising in privacy and AI risk law. (Matt Whalley, "Partner, Law, Ernst & Young LLP", based in London on EY's own people page; his UK LinkedIn profile is titled "Privacy & AI Risk") (ey.com, checked 19 September 2026)
  • Trustpilot: EY's UK Trustpilot page (claimed August 2021) has a 1.7/5 TrustScore from 179 reviews, about 93% one-star. Reviews are mostly about workplace culture and recruitment (bullying, long hours, an unresponsive hiring/talent-acquisition team) rather than the quality of EY's advisory or data-protection work, with a smaller number of client-service complaints about slow responses on tax and visa/immigration matters. (Trustpilot, checked 20 September 2026)

ICAEW-registered for audit, reference C009126168 (stated on ey.com) FCA-authorised, reference 196203 (stated on ey.com) SRA-licensed body for EY Law, reference 614947 (stated on ey.com) ICO-registered, reference Z5535234 (stated on ey.com)

Exposed to the EU AI Act

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.