RAG development for UK teams that need cited answers.

Strong. India Standard Time is GMT+5:30, which gives roughly four to five hours of native daily overlap with UK business hours — our 1:30pm IST is your 8am GMT, our 6:30pm IST is your 1pm GMT. Daily standups, twice-weekly demos of retrieval recall and citation accuracy, and ad-hoc debugging on a missed retrieval all land inside UK business hours without late-night calls on either side. Written async updates with eval-run numbers go out daily before your standup, so you walk into the day already knowing what regressed overnight.

Yes. Engagement defaults align with UK GDPR, the Data Protection Act 2018, and ICO published guidance on AI. Every retrieval and generation call is audit-logged with query, retrieved passage IDs, citation faithfulness score, prompt version, and operator identity — exportable for ICO inspection. A Data Protection Impact Assessment (DPIA) is run for any RAG system processing personal data at scale or operating in a special-category-data context. The refusal layer is wired in week one with a measurable out-of-scope rate so the system never fabricates an answer when the corpus is silent.

Your call. We default to AWS London (eu-west-2), Azure UK South, or GCP europe-west2 for UK clients, and we will run the entire build inside your UK or EU cloud account if your DPO requires no cross-region replication and no data egress to non-UK endpoints. The vector index (pgvector, Qdrant, or Weaviate) lives where you specify. For LLM inference, we pin Claude or GPT-4o to a UK or EU region where available, or we self-host Llama 3 on vLLM inside your VPC for zero third-party inference. Embedding models can be UK-hosted for clients who refuse to send corpus passages to a third-party endpoint.

Yes. We sign UK GDPR-aligned Data Processing Agreements covering the Article 28 processor obligations: processing only on documented instructions, confidentiality of personnel, security of processing, sub-processor management, data subject rights assistance, breach notification, and deletion or return of personal data at the end of the engagement. International transfers of personal data are covered by the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK addendum. Where the corpus itself is sensitive (legal precedent, clinical content, financial filings), retrieval logs can be redacted to passage IDs only.

Either. Most repeat UK clients move to a Master Services Agreement after the first engagement so subsequent RAG builds, evaluation work, and on-call retainers ship under a per-project Statement of Work without renegotiating the umbrella terms. For a first engagement, a standalone SOW with the DPA appended is the standard pattern. Legal turnaround is usually one to two weeks depending on your DPO's review cadence; we will work from your legal team's MSA template or provide ours.

Because pure vector retrieval drops obvious keyword matches that legal, financial, and clinical users notice immediately. The classic failure is a user searching for an exact statute reference, a fund code, or a drug name — and the vector model returning a semantically similar but lexically wrong document. Hybrid retrieval (BM25 for high-precision keyword matches plus dense vectors for semantic recall, blended via reciprocal rank fusion) gives both. It is the default we ship for UK legal and financial RAG because regulated users will not accept a system that misses the literal phrase they searched for.

Most v1 RAG engagements at Aiinfox land between £20,000 and £100,000 fixed-price for a focused build — a legal research copilot, a financial RAG, a knowledge-base copilot, or a medical inquiry system. Larger multi-quarter engagements with bespoke embeddings, custom evals, and integration into a regulated platform typically reach £150,000 to £250,000. The cost difference versus a London AI consultancy lands roughly 30 to 50 percent lower on senior rates — but the headline is the engineer on your kickoff call writes your retrieval pipeline, not a junior at the consultancy's offshore arm.

Yes — takeover audits are routine. Step one is reading the ingestion code, the chunking strategy, the retrieval evaluation results (if any exist), the prompts, and the cost telemetry. Step two is shipping the smallest valuable change — usually a hybrid-retrieval upgrade or a proper citation-faithfulness eval — to prove we understand the system. Step three is the longer-term plan: incremental stabilisation, a parallel rebuild on hybrid retrieval, or shutting it down and starting over. Most takeovers we see did not need a full rewrite; they needed evals, hybrid retrieval, a refusal layer, and a senior engineer on the build.