AI Agent Development Company in Bristol

Certification evidence is what separates a Bristol agent pilot from a Bristol agent programme. That splits into a scoped Bristol AI agent proof of concept over six to ten weeks, covering a use case definition workshop, an evaluation harness specification (this is the deliverable Bristol clients undervalue most often), a baseline RAG or tool-use agent on a single LLM, an ICO data protection impact assessment, and a hosted demo with deterministic regression tests, a custom production agent (aerospace maintenance routing, certification documentation retrieval, FCA Consumer Duty-aligned retail-investor support, defence supply-chain orchestration, code-assistance agent in a compiler toolchain) including LangGraph or CrewAI orchestration, a vector database with hybrid retrieval, an evaluation harness with red and green regression suites, and a UK AI Bill aligned model card, or a full multi-agent platform with on-IPU or on-Jetson edge inference, fine-tuned open-weight models, certification-grade documentation under ARP4754A or DO-178C, and integration into Airbus, Rolls-Royce, or BAE estates. We give fixed-fee proposals and flag R&D Tax Relief eligibility at scoping.

Hallucination control in Bristol aerospace and defence agent work is the difference between a contract you keep and a contract you lose. We attack it on four fronts. First, retrieval grounding — every factual claim the agent makes is tied to a citation from the retrieval index, and the system prompt refuses to answer when retrieval returns insufficient context. Second, structured output — we use OpenAI Structured Outputs, Anthropic Tool Use with strict JSON schemas, or Outlines and Instructor for self-hosted models so the agent cannot improvise outside the contract. Third, deterministic regression — the evaluation harness runs hundreds to thousands of test cases on every model update, with red lines on factual accuracy, citation recall, and refusal rate when retrieval is insufficient. Fourth, human-in-the-loop gates for high-impact decisions — anything feeding ARP4754A, DO-178C, or a DEFCON 658 deliverable requires a named engineer to approve the output, with the agent presenting evidence rather than asserting conclusions. None of these on their own is sufficient; all four together produce the audit trail Bristol clients defend in front of CAA, EASA, ECJU, or DE&S.

Yes. We develop and optimise agent inference for Graphcore Bow and Mark 2 IPU targets using the Poplar SDK and the Graphcore Hugging Face integration, build custom op kernels where the standard library is insufficient, and benchmark against NVIDIA H100 and A100 baselines so clients see honest throughput and total-cost-of-ownership numbers rather than vendor marketing. For ARM Ethos-N and Ethos-U targets we use Arm NN and the Vela compiler to deploy quantised agent components onto microcontroller-class silicon, which matters for Dyson-pattern consumer products and embedded sensor agents. For NVIDIA Jetson Orin, Drive Orin, and Thor platforms we use TensorRT-LLM, vLLM, and TGI for on-edge LLM inference. For Qualcomm AI Engine and Apple Neural Engine we ship CoreML and ONNX Runtime Mobile builds. Our compiler engineers come from a background where kernel-level performance is the deliverable, which is the standard the Graphcore-adjacent Bristol cluster expects.

The UK Artificial Intelligence (Regulation) Bill, introduced as a Private Member's Bill in the 2024 Parliamentary session and aligned with the Department for Science, Innovation and Technology White Paper response of February 2024, proposes a principles-based regime relying on existing sectoral regulators rather than a single horizontal authority. For Bristol agent clients this means delivery must satisfy whichever regulator is in scope — aviation triggers CAA and EASA, defence triggers DE&S and ECJU, financial services triggers FCA, employment triggers EHRC, and any personal data triggers ICO under UK GDPR. The ICO's specific AI guidance, the AI and Data Protection Risk Toolkit, and the joint ICO and CMA paper on foundation models set concrete expectations on explainability, accuracy, security, fairness, and accountability. Our discovery classifies the agent against these regulators, and we ship a model card, a DPIA, an evaluation harness with bias audit, a documented system prompt with the rationale for each instruction, and a prompt-injection threat model with documented mitigations. We also track the EU AI Act because most Bristol aerospace and silicon clients ship across the Channel into Toulouse, Hamburg, Munich, and beyond.

Yes. Coding agents for Bristol clients — Graphcore Poplar compiler teams, XMOS xCORE toolchain teams, Airbus Filton flight-physics engineering, Rolls-Royce digital-twin teams, and the wider Bristol fintech engineering scene — have specific requirements that public coding agents like Cursor and GitHub Copilot Workspace cannot fully meet. The codebase contains proprietary IP that cannot leave the firm. The build system is bespoke (Poplar, xCORE, internal Airbus engineering toolchains) so general-purpose code completion produces wrong answers. The agent must respect UK Strategic Export Control on the source itself. Our delivery uses self-hosted Llama 3.1 70B, Qwen 2.5 Coder, DeepSeek Coder, or fine-tuned Mistral and Codestral on UK or air-gapped GPU clusters with retrieval grounded on the client's internal codebase indexed through Sourcegraph, OpenGrep, or a pgvector index of AST embeddings. The agent uses tool-use APIs to read files, run builds, run tests, and propose diffs rather than improvising. We integrate into VS Code, JetBrains, or terminal-first workflows in the Claude Code lineage.

Bristol agent buyers are unusually conscious of the fact that swapping GPT-4 for GPT-4o, or Claude 3 Opus for Claude 3.5 Sonnet, can silently break a system that was working. Our evaluation harnesses are the deliverable that prevents this. We build deterministic regression suites with hundreds to thousands of test cases categorised by capability (retrieval accuracy, tool selection, citation faithfulness, refusal correctness, harm avoidance, latency, cost), red and green thresholds set at the time the agent is approved for production, and automated runs on every prompt change, every model version change, and every retrieval index rebuild. The harness uses LangSmith, Weights and Biases Weave, Braintrust, or Promptfoo against a versioned dataset stored in DVC or Git LFS, with human graded examples sampled into a calibration set. For agents in safety-critical or FCA-supervised scope we add adversarial test cases drawn from a continuously updated prompt-injection corpus, and we run the harness on each candidate model before production cutover rather than after.

Any agent work touching the defence supply chain in Bristol must respect the UK Strategic Export Control Lists administered by the Export Control Joint Unit (ECJU) within the Department for Business and Trade. The non-obvious point for agents is that model weights and training data are themselves potentially controlled — a model fine-tuned on a defence-classified corpus is not just software but a derived product that may attract Military List (UK ML) or dual-use Annex I (UK DU) classification. At scoping we classify the agent, training data, retrieval corpus, prompts, and model weights against the lists, determine whether an Open General Export Licence (OGEL), a Standard Individual Export Licence (SIEL), or no licence is appropriate, and assess whether US ITAR or EAR controls apply through embedded foundation models trained in the US. We staff with UK or NATO eligible engineers where contracts require, work with cleared partners for List X handling, deliver against DEFCON 658, DEFCON 705, and JSP 440, and structure model cards and technical files to satisfy DE&S contract assurance. We have not and will not work on systems that breach UK or NATO export control law.

Prompt injection is the most underestimated risk in Bristol agent deployments, especially for FCA-supervised Hargreaves Lansdown-style retail-investor agents where a successful injection could trigger unsuitable advice, and for defence agents where an injection could exfiltrate classified context. Our defence stack runs five layers. First, system prompt hardening — clear scope, explicit refusal patterns for out-of-scope requests, no embedded secrets. Second, retrieval sanitisation — content from untrusted sources is treated as data, not instruction, with structural markers and tagged provenance. Third, output filtering — Llama Guard, OpenAI Moderation, or custom regex and classifier filters on agent output before action. Fourth, tool-use sandboxing — every tool the agent can call has narrow scope, parameter validation, and a logged audit trail; destructive tools require human approval. Fifth, continuous red-teaming — we maintain a living adversarial test corpus and run it on every release. None of these is sufficient alone; the discipline is treating prompt injection as an ongoing security posture, not a one-off control.