DEFRA: Ask the toolkit
Answers questions about using AI at Defra, using only the Defra AI digital toolkit, with links to the guidance each answer came from.
1. Summary
1 - Name
Ask the toolkit
2 - Description
Ask the toolkit answers questions about using AI at Defra. You type a question and it gives a short answer, with links to the pages in the Defra AI digital toolkit that the answer came from. Where a rule applies, it quotes the rule word for word from the toolkit.
It only answers from the toolkit. If the toolkit does not cover a question, it says so and points you to the team. It does not make decisions about anyone.
It exists because the toolkit has about 40 pages of guidance, and people often cannot find the one rule they need, or are not sure how it applies to them. Anyone can use it, without signing in.
3 - Website URL
https://digital.defra.gov.uk/ai-toolkit/ask
4 - Contact email
AICapabilityAndEnablement@defra.gov.uk
Tier 2 - Owner and Responsibility
1.1 - Organisation or department
Department for Environment, Food and Rural Affairs (Defra)
1.2 - Team
AI Capability and Enablement team
1.3 - Senior responsible owner
Head of Cross Cutting Technical Services
1.4 - Third party involvement
Yes
1.4.1 - Third party
- Amazon Web Services (AWS), which runs the model through Amazon Bedrock
- Anthropic, which made the model (Claude Sonnet 4.6). Defra has no direct contract with Anthropic: the model is provided through Amazon Bedrock
- GOV.UK Notify, a government service run by the Government Digital Service, which sends problem reports to the team mailbox
1.4.2 - Companies House Number
- Amazon Web Services EMEA SARL, UK Branch: BR019315 (UK establishment of FC034225)
- Anthropic: N/A, not contracted directly
- GOV.UK Notify: N/A, a government service
1.4.3 - Third party role
Anthropic made the model. Amazon Bedrock runs it in the AWS London region. GOV.UK Notify sends problem reports by email. Defra built everything else: the pages, the instructions to the model, the checks and the tests.
1.4.4 - Procurement procedure type
- AWS: direct with AWS under the One Government Value Agreement (OGVA). Defra’s Core Delivery Platform provides Amazon Bedrock to Defra services
- GOV.UK Notify: N/A, used under its terms of use as a government service
1.4.5 - Third party data access terms
AWS processes the questions and answers to run the model, under Defra’s AWS contract, the AWS service terms and the Amazon Bedrock third-party model terms. According to Amazon’s documentation, model makers such as Anthropic cannot see prompts or answers sent through Bedrock.
GOV.UK Notify receives a problem report only when someone chooses to send one, and keeps its copy of the email for 7 days.
Tier 2 - Description and Rationale
2.1 - Detailed description
The Defra AI digital toolkit has about 40 pages of guidance on using AI safely at Defra. People often cannot find the one rule they need, or are not sure how it applies to them. Ask the toolkit lets them ask in their own words.
Each time someone asks a question, the service sends the question and all the toolkit pages to a large language model. The model is told to answer only from those pages. It gives:
- a short answer
- links to the pages it used
- any rule that applies, quoted exactly
The service then checks that each quote really appears on the page it names. If it cannot be found, it is not shown.
If a question is too broad, it offers 2 to 4 narrower questions to choose from. If the toolkit does not cover the question, it says so. If the question is about someone’s own project, it points them to the team.
2.2 - Benefits
- People find the rule they need faster, in words that fit their question
- Every answer shows where it came from, so people can check it
- The team learns which questions the toolkit does not answer well, so it can improve the pages
2.3 - Previous process
People browsed or searched the toolkit, or emailed the team.
2.4 - Alternatives considered
- Better search and navigation. This helps, but people still have to read several pages and work out how the rules apply to them
- Searching the pages first, then answering from the best few (retrieval). Not needed yet. The whole toolkit is small enough to send with every question, so no page is missed because a search did not find it. This may change if the toolkit grows
- An agent that can use tools or browse. Not used. The service makes a single call to the model for each question, with no tools. A second call is made only if the first reply has the wrong structure
Tier 2 - Deployment Context
3.1 - Integration into broader operational process
It is one page in the AI digital toolkit. It sits alongside the guidance pages and does not replace them. It does not approve anything, grant access to anything, or make decisions about people.
3.2 - Human review
People read the answer and decide what to do. Every answer links to its source so they can check it. The toolkit pages the model answers from are written and reviewed by people.
No one routinely reviews live answers. Before any change goes live, the team tests the answers against a fixed set of questions and conversations (see 2.4.2.7). An automated test of the main route through the page (ask, follow up, start again) can be run on demand on the development and test environments.
After launch, the team reviews problem reports that people choose to send from each answer, feedback from the “Give feedback” link, and monitoring of answer types, guardrail activity, errors and cost. Monitoring does not include the question text. Alerts go to the team’s Slack channel when answers fail, at half the daily limit and when the limit is reached.
3.3 - Frequency and scale of usage
It opened to the public on 27 October 2026, so there was no usage data when this record was written. The team has costed scenarios of 50, 500 and 5,000 questions a day. These are not forecasts.
A safety limit stops answers after 600 calls to the model in a day, across the whole service. This includes the second call made when the model’s first reply has the wrong structure.
On 22 and 23 October 2026, load tests sent 20 questions through the website at the same moment. All 20 were answered each time, with a typical answer in 4.6 and 5.2 seconds.
3.4 - Required training
No training is needed. The page tells people not to include personal or sensitive data, and that AI can make mistakes, so they should check the guidance before they act.
3.5 - Appeals and review
It makes no decisions, so there is nothing to appeal. Each answer has a “Report a problem with this answer” link, which emails the question, the answer and what was wrong to the team mailbox through GOV.UK Notify. There is also a “Get help from a person” route to the team.
Tier 2 - Tool Specification
4.1.1 - System architecture
- The toolkit website (a Node.js service on Defra’s Core Delivery Platform) shows the page and keeps the conversation in the reader’s session.
- It sends the question and up to 4 earlier questions and answers to a backend service (a Python service on the same platform). Refused questions are left out.
- The backend sends the question, the toolkit pages and fixed instructions to the model on Amazon Bedrock in the AWS London region. A Bedrock guardrail filters the question and the answer.
- The model returns an answer in a fixed structure: a status, the answer text, the pages used and any quoted rule.
- The service checks the quote against the page it names, and drops it if it does not match.
- The website shows the answer.
There are no tools, no web access and no agent loop.
4.1.2 - System-level input
A question typed by the reader, up to 500 characters, with up to 4 earlier questions and answers from the same conversation, and any options shown to them.
4.1.3 - System-level output
A status, a message and links to the toolkit pages used. The statuses are:
- answered: a short answer, its source pages and any rule quoted word for word
- need more detail: 2 to 4 narrower questions to choose from
- cannot answer: the toolkit does not cover it, or does not cover it yet
- talk to a person: the question is about the reader’s own project, so it points them to the team
- blocked: the question was refused
- error: no answer this time, try again
4.1.4 - Maintenance
The AI Capability and Enablement team maintains the service. Defra does not retrain the model. The model version is fixed, so it only changes when the team chooses to change it.
Before any change to the pages, the instructions or the model goes live, the team runs its fixed set of test questions again. The service can be stopped with a configuration change and a redeployment if something goes wrong. Software dependencies are pinned to exact versions and scanned for known vulnerabilities.
4.1.5 - Models
One model: Claude Sonnet 4.6, made by Anthropic, run through Amazon Bedrock. A Bedrock guardrail filters questions and answers for harmful content and hides some personal data.
Tier 2 - Model Specification
4.2.1. - Model name
Claude Sonnet 4.6, made by Anthropic, provided through Amazon Bedrock.
4.2.2 - Model version
anthropic.claude-sonnet-4-6 on Amazon Bedrock, AWS London region (eu-west-2), with no cross-region processing. The live service uses an inference profile managed by Defra’s Core Delivery Platform.
4.2.3 - Model task
To answer a question using only the toolkit pages it is given, and to return the answer in a fixed structure with the pages it used and any rule quoted word for word.
4.2.4 - Model input
Fixed instructions, all the toolkit pages, the current question, and up to 4 earlier questions and answers from the same conversation with any options shown.
4.2.5 - Model output
A structured answer: a status, the answer text, the pages used and any quoted rule.
4.2.6 - Model architecture
A general-purpose large language model made by Anthropic, used as it is. Defra has not trained or fine-tuned it. Its behaviour is shaped by the instructions, by sending the toolkit pages with every question, and by the Bedrock guardrail.
Anthropic’s Claude Sonnet 4.6 system card describes its capabilities, safety testing and known limitations.
4.2.7 - Model performance
The team tests the service against a fixed set of questions, marked by an AI judge against 6 pass marks.
On 19 October 2026, the current set was run 3 times on Claude Sonnet 4.6 and judged by Claude Opus 4.6. It met 4 of the 6 pass marks: - correct status: 91 to 92 of 100 (pass mark 90) - refusals held: 7 of 7 - complete answers: 62 to 65 of 71 (pass mark 61) - no made-up quotes It missed the 2 pass marks that need every answer to pass: quoting the expected rule (16 to 19 of 22) and staying grounded in the named pages (87 to 90 of 100). No run has met these 2 so far.
On 29 September 2026, 2 people agreed with 38 and 27 of 40 judge decisions, so its marks for grounded and complete answers are treated with caution. Prompt attacks tested by hand all held in round 1 (21 attacks, 3 runs each). In round 2, 16 of 17 passed: the failure was a fair question refused. The model still refuses a few fair questions and answered one wrongly. These are in the test set. There were also 2 rounds of usability research. Testing found answers that assume access to Defra systems. No formal fairness assessment has been done. Testing has not covered Welsh or a representative public sample.
4.2.8 - Datasets and their purposes
Defra did not train the model. The toolkit pages are sent with each question as the source of answers, not as training data. The fixed set of test questions is used only for testing.
2.4.3. Development Data
4.3.1 - Development data description
N/A. Defra did not train or fine-tune the model. The test questions were written by the team from the toolkit pages and contain no personal data.
4.3.2 - Data modality
N/A
4.3.3 - Data quantities
N/A
4.3.4 - Sensitive attributes
N/A
4.3.5 - Data completeness and representativeness
N/A
4.3.6 - Data cleaning
N/A
4.3.7 - Data collection
N/A
4.3.8 - Data access and storage
N/A
4.3.9 - Data sharing agreements
N/A
Tier 2 - Operational Data Specification
4.4.1 - Data sources
The question the reader types, up to 4 earlier questions and answers from the same conversation, any options shown to them, and the published pages of the Defra AI digital toolkit.
4.4.2 - Sensitive attributes
The service does not ask for personal data, and the page tells people not to include personal or sensitive data. People may still type it, for example details of an incident. The Bedrock guardrail hides some personal data, such as names and addresses, before the question reaches the model. The platform’s log keeps the question as typed, so anything the guardrail hid is still in that log (see 2.4.4.4).
4.4.3 - Data processing methods
The website keeps the conversation in the reader’s session. For each question, the backend sends the question, the recent conversation, the toolkit pages and fixed instructions to the model, then checks any quoted rule against the page it names.
The service’s own logs record only technical details, such as the length of a question, whether it was a follow-up, its status and how many tokens it used. They never record the question or the answer.
4.4.4 - Data access and storage
- The conversation is kept in the reader’s session on the toolkit website, and deleted 4 hours after their last question
- Questions and answers are logged by the platform as typed, including any personal data, in a restricted store, and kept for 30 days
- If someone reports a problem, the question, the answer and what was wrong are emailed to the team mailbox through GOV.UK Notify. The team deletes them from the mailbox by hand after 90 days. GOV.UK Notify keeps its copy of the email for 7 days
- The model runs in the AWS London region
4.4.5 - Data sharing agreements
There is no data sharing agreement. Questions and answers are processed by AWS to run the model, under Defra’s AWS contract (see 2.1.4.5).
Google Analytics runs on the toolkit website only for people who accept analytics cookies. Page titles do not include the question, so the question text is not sent to Google Analytics.
Tier 2 - Risks, Mitigations and Impact Assessments
5.1 - Impact assessments
- Data protection: Defra’s data protection officer screened Ask the toolkit out of a full data protection impact assessment (DPIA) on 22 October 2026, because it does not set out to collect personal data. Defra’s data protection team signed off the privacy notice on 23 October 2026, and it is published on the site
- Security assurance: approved by Defra security on 21 October 2026. The delivery group’s security lead confirmed on 20 October 2026 that an IT health check was not needed
- Platform readiness: passed the Core Delivery Platform readiness review on 21 October 2026
- Accessibility: automated testing against WCAG 2.2 AA on 15 October 2026 found no failures. The accessibility statement was published at launch. Defra’s accessibility team will test it with their users after launch
The privacy notice, accessibility statement and cookies page are linked from the footer of the Defra AI digital toolkit.
5.2 - Risks and mitigations
- Wrong or made-up answers, or answers that change over time. It answers only from the toolkit, links every answer to its source, and drops quotes not found on their page. The model version is fixed, and answers are retested before any change goes live
- Answers that suit Defra staff but not other organisations, for example on reporting an incident. Found in research and being added to the tests
- Trusting the answer too much. Every answer shows its sources, and the page says to check the guidance
- Personal data typed into a question. The page warns against it, and the guardrail hides some, such as names and addresses. The platform logs questions as typed for 30 days in a restricted store, as the privacy notice explains
- Questions reaching another organisation. They go to Amazon Bedrock in London, and reported ones through GOV.UK Notify. Page titles keep them out of Google Analytics
- Harmful answers or hidden instructions. The model has no tools and cannot act or browse. The guardrail filters questions and answers and refuses medical, legal and financial advice. Answers show as plain text, never HTML or links. Tested with prompt attacks
- Cost or abuse. Limits of 500 characters a question, 20 questions a conversation and 600 model calls a day. It stops if the daily count cannot be checked. The platform firewall has bot control on. No limits per person, a risk the senior responsible owner accepted on 14 October 2026