Understand AI.
No technical background needed.

1. Choose a structure. Most founders here want a private limited company (limited liability, investable); a sole trader setup is lighter if you are only testing the water. GOV.UK walks the choice.
2. Check the name is free on the Companies House register and not too close to a registered trade mark (step 3); the register accepting a name does not mean you can trade under it safely.
3. Verify your identity first. Since 18 November 2025, directors and people with significant control must verify with Companies House (GOV.UK One Login, free) and use the personal code at incorporation. No code, no company.
4. Register online (£50, usually within 24 hours): registered office (a formation agent's address keeps your home off the public record), SIC code, shares, directors. GOV.UK: register your company.
5. Diary the annual jobs on day one: confirmation statement (£34), annual accounts, and register for Corporation Tax within 3 months of starting to trade. Running a limited company.

Toto-Rex's note: he bought a formation package for the London address and the pre-filled forms. Worth it for the address alone; his cave is not on the way to anywhere.

1. Register the domain with a reputable registrar; switch on auto-renew and two-factor authentication the same day. A lapsed domain is the classic startup own-goal; someone else re-registers your front door.
2. Budget the renewals, not just year one. Premium country codes (like this site's .ai, run from Anguilla) cost multiples of a .co.uk and often sell in two-year terms.
3. Match the social handles now, even as placeholders; squatters move faster than lawyers.
4. Display what the law requires. A UK company must show its registered name, company number, registered office and place of registration on its website and business emails (Companies Act 2006 and the Trading Disclosures Regulations 2015); online services must also give a contact email and geographic address under the E-Commerce Regulations 2002, plus your VAT number if registered.
5. Publish the policies: a privacy notice, a cookie policy and terms of use, live before your first visitor. The ICO's free privacy-notice generator is a legitimate shortcut.

Toto-Rex's note: scroll to this page's footer; company name, number, registered office, and the three policies. That footer is this step, done.

1. Search first: identical or confusingly similar marks in your classes — search the register before you fall in love with the name.
2. Pick classes (the Nice system sorts all goods and services into 45): describe what you sell now and soon; for a project like this one, think class 9 (software), 41 (education), 42 (SaaS).
3. Apply online: £205 for one class, £60 per extra class; fees rose on 1 April 2026, the UKIPO's first standard-fee increase in decades; check the live fee table before you file. Unsure the mark will pass? The Right Start route lets you pay half up front for an examiner's opinion first. GOV.UK: how to register.
4. Then the clock: examination in a few weeks → publication in the Trade Marks Journal → a two-month opposition window (extendable by one) → registration if nobody objects. Budget about four months end to end.
5. Mind the edges: a UK mark covers the UK only; the EU needs a separate EUIPO application (from €850). It lasts 10 years, renewable (£245 + £60 per class). And ignore the official-looking "register renewal" invoices that follow every filing: pay only the IPO, EUIPO or WIPO.

Toto-Rex's note: the footer says "trade mark application pending" because he is living this step now, opposition window and all. He checks the post with feeling.

1. Assume you owe it. If your company processes personal data electronically; a customer list, a newsletter, CCTV; you almost certainly pay the annual fee unless an exemption applies. The ICO's self-assessment answers it in minutes.
2. The tiers: £52 (up to 10 staff or £632k turnover), £78 (up to 250 staff or £36m), £3,763 for the giants — £5 off by direct debit; charities sit in tier 1. Fee guide.
3. Register online — you will appear on the public register. Home-based? Give a PO box or agent address instead of your sofa.
4. Renew every year. Not paying is a fixed-penalty offence: fines run up to £4,350, plus a letter you will not enjoy. The ICO cross-checks the Companies House register, so new companies get found.
5. Name a human. Most small companies do not need a formal Data Protection Officer (the ICO has a checker), but someone should own data protection either way.

Toto-Rex's note: tier 1, direct debit, £47. The cheapest line on the whole compliance invoice, and the one the ICO letters chase hardest.

1. Map it. Write down what personal data you hold, where, why, how long, who sees it; the Article 30 record (ROPA). Mandatory in full for bigger or riskier processing; best practice for everyone, and the map makes every later step easy. ICO documentation guide.
2. Pick a lawful basis per purpose — there are six; consent is only one and often the wrong one. Document the choice; special-category data (health, biometrics…) needs an extra condition. The ICO's interactive tool takes ten minutes.
3. Tell people: a privacy notice that matches reality; no pre-ticked boxes, real consent records, and remember marketing emails also live under PECR.
4. Respect rights: subject access requests answered free within one month (Note no. 17 is the walkthrough), a retention schedule you actually run, deletion that actually deletes, and a complaints route: since 19 June 2026, section 164A of the Data Protection Act 2018 has required you to acknowledge a data-protection complaint within 30 days.
5. Secure it & be ready: MFA, updates, least privilege, encrypted laptops, tested backups — Cyber Essentials is the sane floor. Document every breach; notify the ICO within 72 hours where there's risk; run a DPIA before high-risk projects. AI screening of people counts.

Toto-Rex's note: he bought a well-known £30 GDPR template pack to save time. Decent templates; but its own contents table had the document descriptions shifted one row out of line, and its "£4,000" registration fine was a few years stale. Templates start you; the ICO's live pages finish you. Verify everything, even the things you paid for.

1. Every year: confirmation statement (£34; now carrying directors' identity codes), annual accounts (software-only filing since April 2026), Corporation Tax return and payment, the ICO fee, domain and certificate renewals, insurance.
2. Every ten years: the trade mark (£245 + £60 per class; diary it now; decade-away deadlines are how marks die).
3. UK law in motion: the Data (Use and Access) Act 2025 keeps phasing in; automated-decision rules live since 5 February 2026, an ICO code of practice on AI decisions in drafting. The Briefing (section 04) tracks it.
4. EU dates if you serve EU users: AI transparency duties from 2 August 2026; the ban on non-consensual intimate imagery tools plus legacy watermarking from 2 December 2026; high-risk system rules from 2 December 2027 (stand-alone) and 2 August 2028 (embedded in products) after the 2026 "Omnibus" deferral.
5. The rhythm: one hour a quarter; skim ICO and GOV.UK updates, re-check your vendor list, run your retention deletions, and re-read your own privacy notice as if you were a customer.

Toto-Rex's note: he keeps the whole calendar on one page taped above the desk. Compliance is not a mood; it is a recurring appointment.