# EY (UK), Ernst & Young LLP - **Type:** Advisory firm - **Website:** https://www.ey.com/en_uk - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) EY's UK firm, Ernst & Young LLP. Its advisers and lawyers offer data protection, privacy law and AI governance work alongside its audit practice. ## EY scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 FRC fined EY LLP £1,197,000 in July 2026 over the Made.com FY21 audit and separately opened an investigation in 2025 into unauthorised issuance of auditor's reports; a further Shell audit-rotation inquiry is also reported open. ### Qualifications of the people who do the work: 4/5 EY LLP is ICAEW-registered (C009126168) for audit, FCA-authorised (196203), SRA-licensed as a licensed body (no. 614947) for EY Law, and ICO-registered (Z5535234), all disclosed on ey.com. ### What it publishes about fees: 1/5 No fee rates, rate cards, or fixed-price packages for data-protection or AI-governance advisory work are published on EY's UK service or law pages checked. ### Knowledge of your sector: 4/5 Named UK privacy/AI-risk law partner (Matt Whalley), a dedicated UK&I AI and Data Lead and AI Risk Intelligence Lead, and a named UK client AI-governance case study (Mott MacDonald) evidence a real practice. ### Independence from what it sells: 3/5 EY is an independent advisory firm rather than a software vendor, but its AI-governance and compliance offerings are delivered partly through named alliances with ServiceNow and Microsoft Purview. ### Who carries the risk if the advice is wrong: 3/5 EY LLP discloses a named professional indemnity insurer with worldwide cover, but trades as an LLP and has paid FRC-imposed financial sanctions when assurance work fell short of required standards. ## Sources for EY Every line carries the page it was read on and the date it was checked. - Ernst & Young LLP is registered at Companies House as a limited liability partnership. - Source: https://find-and-update.company-information.service.gov.uk/company/OC300001 - Checked: 2026-09-19 - EY discloses its professional indemnity insurer and cover on its own UK site. - Source: https://www.ey.com/en_uk/legal-and-privacy/provision-of-services-regulations-2009 - Checked: 2026-09-19 - The FRC fined EY LLP over the Made.com Group plc FY21 audit. - Source: https://www.frc.org.uk/news-and-events/news/2026/07/sanctions-20260728/ - Checked: 2026-09-19 - The FRC opened an investigation into EY LLP over unauthorised issuance of auditor's reports. - Source: https://www.frc.org.uk/news-and-events/news/2025/12/investigation-regarding-the-conduct-of-two-members-and-ernst-young-llp-in-relation-to-the-issuance-of-unauthorised-auditors-reports/ - Checked: 2026-09-19 - EY publishes a named UK client case study on its AI-governance advisory work. - Source: https://www.ey.com/en_uk/insights/ai/how-mott-macdonald-is-building-confidence-through-responsible-ai - Checked: 2026-09-19 - EY names a UK-based partner specialising in privacy and AI risk law. - Source: https://www.ey.com/en_uk/people/matt-whalley - Checked: 2026-09-19 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Published ## Strengths - Named UK partner-level leadership in privacy and AI risk law (Matt Whalley, Partner, Law) plus a dedicated UK&I AI and Data Lead (Matthew Ringelheim) and AI Risk Intelligence Lead (Nishobika Sivakumaran). - Publishes a detailed, named UK client case study on AI-governance work (Mott MacDonald), naming the methodology used and the multidisciplinary team involved. - Discloses core regulatory credentials on its own site: ICAEW audit registration, FCA authorisation, SRA licence for its legal arm, and ICO registration. - Publishes its professional indemnity insurer (Gloucester Insurance Ltd) and confirms worldwide territorial coverage. - Dedicated UK service pages exist for data protection and privacy, AI governance and compliance, and data and cyber law, distinct from generic consulting pages. ## Things to check Each one carries the factual basis it rests on. - EY and an audit partner were fined £1,246,000 over the 2021 Made.com audit. This concerned financial audit work, not data protection advice. - Basis: FRC Final Settlement Decision Notice published 28 July 2026 on frc.org.uk, stating the £1,197,000 EY fine and £49,000 partner fine plus a published severe reprimand. - The FRC opened a formal investigation (authorised 22 Jul 2025, announced 10 Dec 2025) into EY LLP and two members over the unauthorised issuance of auditor's reports to audited entities; the matter remains open. - Basis: FRC news release dated 10 December 2025 on frc.org.uk; the FRC's own page states opening an investigation is not itself a finding of misconduct. - No published fee rates, hourly rates, or fixed-fee packages for UK data-protection or AI-governance advisory work could be found on EY's UK service pages. - Basis: Checked ey.com/en_uk/services/consulting/data-protection-privacy and ey.com/en_uk/law/data-cyber; neither page discloses pricing. ## Where this firm appears - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.