AI compliance from idea to exit

Cydymffurfio wrth ddefnyddio deallusrwydd artiffisial, o’r syniad i’r ymadael

Use the stage that matches your next decision. A funding round is a planning milestone. Duties can start earlier, including when the first real record enters a pilot.

Dechreuwch gyda’r penderfyniad nesaf. Gall dyletswyddau godi cyn codi arian, hyd yn oed mewn prawf caeedig.

Mae’r Saesneg yn aros yn weladwy. Dewiswch ail iaith ddarllen.

Which records need extra care?

Pa ddata sydd angen mwy o ddiogelwch?

A photograph and a face template used to identify someone are different. Record the Article 6 basis and, for special-category processing, the Article 9 condition. Consider health inferences, children, dependence on a carer, an unsafe address and client secrets separately. Restrict input and access, offer a human alternative and complete a required DPIA before using live records.

Gwahaniaethwch rhwng llun a thempled wyneb a ddefnyddir i adnabod unigolyn yn unigryw. Cofnodwch sail Erthygl 6 ac amod Erthygl 9 ar gyfer categorïau arbennig. Ystyriwch gasgliadau am iechyd, plant, dibyniaeth ar ofalwr, cyfeiriad a allai roi rhywun mewn perygl, a chyfrinachau cleientiaid ar wahân. Cyfyngwch ar fynediad, cynigiwch gymorth dynol a chwblhewch unrhyw asesiad effaith gofynnol cyn defnyddio data go iawn.

12 detailed data decisions (EN) · ICO-SPECIAL · EU-GDPR

If a breach happens

Os bydd achos o dor diogelwch data personol

Stop the disclosure, preserve restricted evidence and record awareness time. A processor tells the controller without undue delay. A controller notifies the competent authority without undue delay and, where feasible, within 72 hours of awareness unless risk to people’s rights and freedoms is unlikely. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Record every personal data breach and the reasons for each decision.

Cyfyngwch ar y niwed, cadwch dystiolaeth a nodwch amser dod yn ymwybodol. Mae’r prosesydd yn hysbysu’r rheolydd heb oedi gormodol. Mae’r rheolydd yn hysbysu’r awdurdod cymwys heb oedi gormodol ac o fewn 72 awr os yw’n ymarferol, oni bai bod risg i hawliau a rhyddid pobl yn annhebygol. Os yw risg uchel yn debygol, hysbyswch y bobl heb oedi gormodol, yn ddarostyngedig i eithriadau Erthygl 34. Cofnodwch bob achos a rhesymau’r penderfyniadau.

Full incident playbook and messages (EN) · ICO-REPORT · EDPB-DOORS

01 · Pre-seed · Define the use

Cyn buddsoddi · dewis y defnydd

A useful idea can hide an unacceptable use. The founder names the decision, affected people and forbidden uses. Hold a live trial until a possible prohibition has been resolved.

Enwch y bobl yr effeithir arnynt, y penderfyniad a’r defnyddiau sydd wedi’u gwahardd. Daliwch y prawf yn ôl os oes amheuaeth ynghylch gwaharddiad.

Tystiolaeth neu ateb

One-page use case and manual alternative

Disgrifiad byr a dewis heb AI

Nodiadau ar y ffynonellau / practical checks

Walk through a single item from input to output. Which person can be affected, what could they lose, and who can change the outcome?

Dilynwch un eitem o’r mewnbwn i’r allbwn. Ar bwy y gellid effeithio, beth allent ei golli, a phwy all newid y canlyniad?

EU AI Act: do we build or market the system under our name, deploy it for work, or change its purpose? Check territorial scope, including where an output is used. Keep the reason for each role.

O dan Ddeddf AI yr UE, a ydym yn adeiladu neu’n marchnata’r system dan ein henw, yn ei defnyddio ar gyfer gwaith, neu’n newid ei diben? Gwiriwch y cwmpas tiriogaethol, gan gynnwys ble y defnyddir allbwn. Cadwch y rheswm dros bob rôl.

Screen prohibited practices before testing with people. For example, workplace emotion inference has a narrow medical or safety exception. Escalate any possible prohibition before further use.

Sgriniwch arferion gwaharddedig cyn profi gyda phobl. Er enghraifft, mae eithriad meddygol neu ddiogelwch cul i’r gwaharddiad ar ddod i gasgliadau am emosiynau pobl yn y gweithle. Cyfeiriwch unrhyw waharddiad posibl i’w adolygu cyn parhau i ddefnyddio’r system.

EU-SCOPE · EU-PROHIB

02 · Formation and seed funding

Sefydlu’r cwmni

The company may not control code, data or designs made before incorporation. Trace each contribution and secure suitable rights before promising ownership to investors.

Olrheiniwch waith pob cyfrannwr. Sicrhewch yr hawliau priodol cyn addo perchnogaeth i fuddsoddwyr.

Tystiolaeth neu ateb

Contributor and rights schedule with signed evidence

Cofnod o gyfraniadau a chytundebau

Nodiadau ar y ffynonellau / practical checks

Working alone? Wear several hats and record which one you used. Get a qualified second view for unfamiliar or serious decisions. With 2–10 people, separate the maker from the checker. With 11–50, name leads and deputies. These are suggested working arrangements.

Gweithio ar eich pen eich hun? Cymerwch sawl rôl a chofnodwch pa un yr oeddech yn ei chyflawni. Mynnwch ail farn gymwys ar benderfyniadau anghyfarwydd neu ddifrifol. Gyda 2–10 o bobl, gwahanwch y sawl sy’n gwneud y gwaith oddi wrth y gwiriwr. Gyda 11–50, enwch arweinwyr a dirprwyon. Trefniadau gwaith a awgrymir yw’r rhain.

Compare doing nothing, a manual process and an AI-assisted process. Estimate time saved after checking, cost of errors, supplier fees and exit costs.

Cymharwch wneud dim, proses â llaw a phroses gyda chymorth AI. Amcangyfrifwch yr amser a arbedir ar ôl gwirio, cost gwallau, ffioedd cyflenwyr a chostau gadael y gwasanaeth.

UK-IP · UK-NSI

03 · Source data and suppliers

Data a chyflenwyr

Permission to view material may not cover training, retrieval or customer resale. Match each use to a right and check vendor reuse, subcontractors, costs and exit before uploading real records.

Gwiriwch yr hawl i hyfforddi, chwilio a rhannu ar wahân. Edrychwch ar ailddefnyddio data gan y cyflenwr a’r telerau ymadael.

Tystiolaeth neu ateb

Permission matrix and signed supplier decision

Tabl caniatâd a phenderfyniad ar y cyflenwr

Nodiadau ar y ffynonellau / practical checks

Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.

Olrheiniwch un eitem ddata drwy gasglu, ysgogiadau i’r model, adalw, y model, allbwn, logiau, cymorth a dileu. Enwch y ffynhonnell, pobl, gwlad, derbynwyr, cyfnod cadw, copïau wrth gefn a rhywun sy’n gallu profi dileu.

Supplier check: identify processors and subprocessors, training or reuse terms, support access, contract, incidents, return or deletion, change notice and exit. Save the dated terms and unresolved questions.

Gwiriwch y cyflenwr. Nodwch broseswyr ac is-broseswyr, telerau hyfforddi neu ailddefnyddio, mynediad gan staff cymorth, y contract, digwyddiadau, dychwelyd neu ddileu, hysbysu am newid ac ymadael. Cadwch y telerau gyda’u dyddiad ac unrhyw gwestiynau heb eu hateb.

Locate each restricted transfer. Record the applicable adequacy decision or safeguard, assessment and extra protections. Check EU SCCs and UK IDTA or Addendum separately. Revisit overseas support and onward transfers.

Nodwch ble y mae pob trosglwyddiad cyfyngedig yn digwydd. Cofnodwch y penderfyniad digonolrwydd neu’r mesur diogelu perthnasol, yr asesiad a’r amddiffyniadau ychwanegol. Gwiriwch SCCs yr UE ac IDTA neu Atodiad y DU ar wahân. Ailedrychwch ar gymorth o dramor a throsglwyddiadau dilynol.

ICO-CONTRACT · EU-TRANSFER · ICO-TRANSFER · EDPB-MODEL

04 · Build and prototype

Adeiladu prototeip

A model can leak another customer’s records or turn a document instruction into an action. Use synthetic test cases, separate tenants, limit permissions and test a manual override before connecting live systems.

Profwch â data ffug. Ceisiwch groesi ffiniau mynediad mewn prawf diogel. Profwch y ffordd i atal gweithred.

Tystiolaeth neu ateb

Versioned test results, access map and rollback test

Canlyniadau profion a chynllun dychwelyd

Nodiadau ar y ffynonellau / practical checks

Engineering and data: freeze model, prompt, dataset and settings. Test typical, unusual and misleading inputs against an agreed baseline. Keep reproducible results and known limits.

Peirianneg a data: pennwch y model, yr ysgogiad, y set ddata a’r gosodiadau i’w cadw’n sefydlog. Profwch fewnbynnau nodweddiadol, anarferol a chamarweiniol yn erbyn llinell sylfaen gytunedig. Cadwch ganlyniadau y gellir eu hailgynhyrchu a chyfyngiadau hysbys.

Predeclare the test: purpose, dataset origin, expected answers, baseline, sample size, thresholds, critical failures, reviewer and retest date. Include language, disability and real operating conditions where relevant.

Pennwch y prawf ymlaen llaw: diben, tarddiad y set ddata, atebion disgwyliedig, llinell sylfaen, maint sampl, trothwyon, methiannau critigol, adolygydd a dyddiad ailbrofi. Dylech gynnwys iaith, anabledd ac amodau gweithredu go iawn lle bo’n berthnasol.

Security drill: send a harmless hostile instruction in a fictional attachment. Test a blocked export, denied permission, wrong recipient and unavailable supplier. Record what happened at each boundary.

Ymarfer diogelwch: anfonwch gyfarwyddyd gelyniaethus ond diniwed mewn atodiad ffuglennol. Profwch allforiad sydd wedi’i rwystro, caniatâd a wrthodwyd, derbynnydd anghywir a chyflenwr nad yw ar gael. Cofnodwch beth ddigwyddodd wrth bob ffin.

NCSC · EU-GDPR

05 · Pilot with real users

Peilot gyda phobl

A free or closed pilot can still harm a person. Screen before real data, set limits and enable meaningful review. Hold high-risk processing if a required impact assessment or prior consultation is incomplete.

Sgriniwch y risg cyn defnyddio cofnodion go iawn. Cwblhewch unrhyw asesiad effaith gofynnol a rhowch ffordd i bobl gael adolygiad.

Tystiolaeth neu ateb

Pilot protocol, DPIA decision and stop criteria

Cynllun peilot a meini prawf atal

Nodiadau ar y ffynonellau / practical checks

A DPIA examines how processing personal data could harm people and how to reduce that harm. The controller must do it before likely high-risk processing begins, including a pilot using real personal data.

Mae DPIA yn edrych ar sut y gallai prosesu data personol niweidio pobl a sut i leihau’r niwed hwnnw. Rhaid i’r rheolydd ei wneud cyn dechrau prosesu sy’n debygol o arwain at risg uchel, gan gynnwys peilot sy’n defnyddio data personol go iawn.

Seek the data protection officer’s advice where designated. Where appropriate seek affected people’s views. Record objections, accessibility needs, decisions and reasons for any justified departure.

Ceisiwch gyngor y swyddog diogelu data os oes un wedi’i ddynodi. Lle bo’n briodol, ceisiwch farn pobl yr effeithir arnynt. Cofnodwch wrthwynebiadau, anghenion hygyrchedd, penderfyniadau a rhesymau dros unrhyw wyriad y gellir ei gyfiawnhau.

Decide whether high risk remains despite practical measures. If so, consult the competent authority before starting the processing under Article 36. Record correspondence and response. A founder’s signature cannot replace consultation.

Penderfynwch a oes risg uchel yn parhau er gwaethaf mesurau ymarferol. Os felly, ymgynghorwch â’r awdurdod cymwys cyn dechrau’r prosesu o dan Erthygl 36. Cofnodwch yr ohebiaeth a’r ymateb. Ni all llofnod sylfaenydd gymryd lle ymgynghori.

Check human oversight: can the reviewer see the evidence, disagree, correct the result and stop the next action in time? Save one override trace. A second click alone proves little.

Gwiriwch oruchwyliaeth ddynol: a all yr adolygydd weld y dystiolaeth, anghytuno, cywiro’r canlyniad ac atal y weithred nesaf mewn pryd? Cadwch un cofnod o wrthdroi penderfyniad. Ychydig y mae ail glic ar ei ben ei hun yn ei brofi.

ICO-DPIA · EU-GDPR · UK-GDPR

06 · Pre-launch · Decide whether to ship

Cyn lansio

A polished demo can outrun the evidence. Test the exact public claim, check applicable disclosures and sector approvals, and name the person who can withhold release.

Cysylltwch bob honiad gwerthu â thystiolaeth berthnasol. Gwiriwch hysbysiadau a chaniatâd y sector.

Tystiolaeth neu ateb

Claims-to-evidence table and dated release decision

Cofnod penderfyniad lansio

Nodiadau ar y ffynonellau / practical checks

Check Article 50 by actor and output. Telling people they interact with AI, machine-readable marking and disclosing a deepfake are different duties with exceptions. Record which applies and the release-date evidence.

Gwiriwch Erthygl 50 yn ôl rôl ac allbwn. Mae dweud wrth bobl eu bod yn rhyngweithio ag AI, marcio mewn ffurf y gall peiriant ei darllen a datgelu bod cynnwys yn ffugiad dwfn yn ddyletswyddau gwahanol sydd ag eithriadau. Cofnodwch pa un sy’n gymwys a’r dystiolaeth ar ddyddiad rhyddhau.

Marketing, design and sales: substantiate claims, clear assets and check required disclosures. Save approved wording and versions. Escalate promises of exclusivity, ownership or guaranteed accuracy.

Marchnata, dylunio a gwerthu: cadarnhewch honiadau â thystiolaeth, sicrhewch hawliau i’r deunyddiau a gwiriwch y datgeliadau gofynnol. Cadwch y geiriad a’r fersiynau cymeradwy. Cyfeiriwch addewidion o unigrywiaeth, perchnogaeth neu gywirdeb gwarantedig i’w hadolygu.

Release options: approve within stated limits, approve with controls already in force, hold pending evidence, or stop. Name unresolved issues, lawful scope, approver, effective date, expiry and rollback owner.

Opsiynau rhyddhau: cymeradwyo o fewn terfynau penodol, cymeradwyo gyda rheolaethau sydd eisoes mewn grym, gohirio nes cael tystiolaeth, neu atal. Enwch faterion sydd heb eu datrys, y cwmpas cyfreithlon, y cymeradwywr, y dyddiad dod i rym, y dyddiad dod i ben a’r sawl sy’n gyfrifol am ddychwelyd i’r fersiwn flaenorol.

UK-ADS · EU-MARK · EU-AIA

07 · Launch and operate

Lansio a gweithredu

Complaints and changes in performance can reveal harm missed in testing. Give users a human route, test it, monitor errors by type and contain incidents promptly.

Monitrwch gwynion a gwallau. Trefnwch lwybr at berson a pherchennog ar gyfer digwyddiadau.

Tystiolaeth neu ateb

Monitoring log, incident owner and response record

Cofnod monitro ac ymateb

Nodiadau ar y ffynonellau / practical checks

After release: name an owner for errors, complaints, overrides, drift, security and costs. Specify sample, frequency, stop threshold and who can disable the workflow. Log changes and reapprove material ones.

Ar ôl rhyddhau: enwch berson cyfrifol am wallau, cwynion, gwrthdroi penderfyniadau, gwyriad dros amser, diogelwch a chostau. Pennwch y sampl, yr amlder, y trothwy atal a phwy all analluogi’r llif gwaith. Cofnodwch newidiadau a cheisiwch gymeradwyaeth newydd ar gyfer rhai sylweddol.

Incident: stop unsafe actions, preserve restricted evidence, assess people affected, activate the manual route and record notification decisions. Test a clean restore and correction before reopening.

Digwyddiad: ataliwch weithredoedd anniogel, diogelwch y dystiolaeth gyda mynediad cyfyngedig, aseswch yr effaith ar bobl, gweithredwch y llwybr â llaw a chofnodwch benderfyniadau hysbysu. Profwch adferiad glân a chywiriad cyn ailagor.

For UK/EU personal-data breaches, controllers notify the regulator unless risk to people’s rights is unlikely. Notify without undue delay and where feasible within 72 hours of awareness. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Processors notify controllers without undue delay.

Ar gyfer achosion o dorri diogelwch data personol yn y DU neu’r UE, mae rheolwyr yn hysbysu’r rheoleiddiwr oni bai bod risg i hawliau pobl yn annhebygol. Hysbyswch heb oedi gormodol a, lle bo’n ymarferol, o fewn 72 awr i ddod yn ymwybodol. Os yw risg uchel yn debygol, hysbyswch y bobl heb oedi gormodol, yn ddarostyngedig i eithriadau Erthygl 34. Mae proseswyr yn hysbysu rheolwyr heb oedi gormodol.

Intake: keep a secure reference to the original words. Record first receipt, controller, jurisdiction, each right, owner, safe reply channel and accessibility or representative needs.

Wrth dderbyn cais, cadwch gyfeirnod diogel at y geiriau gwreiddiol. Cofnodwch pryd y’i derbyniwyd gyntaf, y rheolydd, yr awdurdodaeth, pob hawl, y person cyfrifol, sianel ymateb ddiogel ac anghenion hygyrchedd neu gynrychiolaeth.

ICO-BGUIDE · EDPB-BREACH

08 · Scale or change the product

Tyfu a newid

A new market, model, customer group or automated action can change the risk and legal role. Reassess the changed scope before switching it on.

Ailaseswch ar gyfer model, marchnad, grŵp neu weithred newydd. Profwch y newid cyn ei gymeradwyo.

Tystiolaeth neu ateb

Market and change register with fresh approval

Cofrestr newidiadau

Nodiadau ar y ffynonellau / practical checks

Check the intended purpose against Annexes I and III. Recruitment screening is a listed example. Document any claimed Article 6(3) exception and its conditions. Profiling people rules out that exception.

Gwiriwch y diben bwriadedig yn erbyn Atodiadau I a III. Mae sgrinio ymgeiswyr wrth recriwtio yn un o’r enghreifftiau a restrir. Cofnodwch unrhyw eithriad a hawlir o dan Erthygl 6(3) a’i amodau. Ni ellir hawlio’r eithriad hwnnw wrth broffilio pobl.

The revised dates for Chapter III sections 1–3, except Article 6(5), are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Other provisions have their own dates.

Y dyddiadau diwygiedig ar gyfer adrannau 1–3 o Bennod III, ac eithrio Erthygl 6(5), yw 2 Rhagfyr 2027 ar gyfer systemau Atodiad III a 2 Awst 2028 ar gyfer systemau Atodiad I. Mae gan ddarpariaethau eraill eu dyddiadau eu hunain.

UK significant solely automated decisions require an Articles 22A–22D review, including restrictions on special-category data and the recognised legitimate interests basis. In the EU start with Article 22 and its specific exceptions. Test real human power to reconsider.

Ar gyfer penderfyniadau arwyddocaol yn y DU sy’n gwbl awtomataidd, rhaid adolygu Erthyglau 22A–22D, gan gynnwys y cyfyngiadau ar ddata categori arbennig ac ar sail buddiannau dilys cydnabyddedig. Yn yr UE, dechreuwch gydag Erthygl 22 a’i heithriadau penodol. Profwch fod gan berson bŵer gwirioneddol i ailystyried.

EU-ROLE · EU-HIGH · UK-RIGHTS · EU-AIA

09 · Fundraise again, sell or merge

Buddsoddi neu werthu

A buyer may acquire fewer rights than the pitch suggests. Separate deal-room disclosure, change of control and asset transfer. Resolve material consents and any required clearance before completion.

Gwiriwch ddatgelu yn yr ystafell ddata, newid rheolaeth a throsglwyddo asedau ar wahân.

Tystiolaeth neu ateb

Diligence index, exceptions, consents and closing conditions

Rhestr hawliau ac amodau cwblhau

Nodiadau ar y ffynonellau / practical checks

List the accountable organisation for each purpose. Who chooses why and how personal data are used? Who acts on instructions? Map each supplier’s own uses separately.

Nodwch y sefydliad sy’n atebol am bob diben. Pwy sy’n dewis pam a sut y defnyddir data personol? Pwy sy’n gweithredu ar gyfarwyddyd? Mapiwch ddefnydd pob cyflenwr at ei ddibenion ei hun ar wahân.

For each risk write cause → event → harm to a person. Record likelihood, impact, affected group and evidence before controls. Name the control, tester, due date and risk remaining afterwards.

Ar gyfer pob risg, ysgrifennwch achos → digwyddiad → niwed i berson. Cofnodwch y tebygolrwydd, yr effaith, y grŵp yr effeithir arno a’r dystiolaeth cyn rhoi rheolaethau ar waith. Enwch y rheolaeth, y profwr, y dyddiad cau a’r risg sy’n weddill wedi hynny.

Your decision record: workflow and version, permitted and excluded uses, evidence IDs, decision and reasons, dissent, restrictions, owner, reviewer, review date, signature and time. Keep the previous version.

Eich cofnod penderfyniad: llif gwaith a fersiwn, defnyddiau a ganiateir ac a eithrir, dynodwyr tystiolaeth, penderfyniad a rhesymau, anghytundeb, cyfyngiadau, person cyfrifol, adolygydd, dyddiad adolygu, llofnod ac amser. Cadwch y fersiwn flaenorol.

ICO-DEAL · UK-IP · UK-NSI

10 · Retire or close the business

Cau’r gwasanaeth

Data, keys and obligations outlive a website. Assign a custodian, return or erase data as applicable, document lawful holds, revoke access and test that restored backups do not reactivate deleted records.

Dirymwch allweddi mynediad. Dychwelwch neu dilëwch ddata fel sy’n ofynnol. Profwch adfer copi wrth gefn heb adfywio cofnodion wedi’u dileu.

Tystiolaeth neu ateb

Decommissioning record, supplier evidence and remaining contact

Cofnod cau a chyswllt ar ôl cau

Nodiadau ar y ffynonellau / practical checks

Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.

Other rights: examine correction, erasure, restriction, portability, objection and human review separately. Record applicable conditions, exceptions, recipients to notify, and any lawful retention or dispute hold.

Hawliau eraill: archwiliwch gywiro, dileu, cyfyngu, cludadwyedd, gwrthwynebu ac adolygiad gan berson ar wahân. Cofnodwch amodau ac eithriadau cymwys, derbynwyr i’w hysbysu ac unrhyw gadw cyfreithlon neu ofyniad i ddiogelu tystiolaeth mewn anghydfod.

Private filing: store completed forms, evidence and signatures with restricted access. Keep the public folder blank. Back up a versioned copy, keep an independently protected copy and test a restore. Set a retention period for each record.

Ffeilio preifat: cadwch ffurflenni gorffenedig, tystiolaeth a llofnodion gyda mynediad cyfyngedig. Cadwch y ffolder gyhoeddus yn wag. Gwnewch gopi wrth gefn â rhif fersiwn, cadwch gopi wedi’i ddiogelu’n annibynnol a phrofwch ei adfer. Pennwch gyfnod cadw ar gyfer pob cofnod.

ICO-ERASE · ICO-CONTRACT

Read the full UK and EU founder’s guide (EN)

Llyfr gwaith y gellir ei olygu · Full English handbook (Word)

Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.