Founder’s first AI compliance file

UK and EU | Editorial cut-off 4 November 2026 | For teams of 1–50

The first twenty minutes

Choose one activity you can describe with a verb, an input and a consequence. “Draft a reply to a customer’s email for a person to approve” is precise enough to test. “Use AI in customer service” leaves the decision boundary hidden. Put a name against the owner, the person who can disable it and the person who answers complaints. In a one-person company those can be the same person. Arrange a qualified challenge where the consequences or law exceed your expertise.

Trace a single example from collection to deletion. Include attachments, retrieved documents, embedding stores, model providers, output, email, support access, analytics and backups. For every recipient and purpose ask who decides why data are used. A supplier may act on instructions for support and use material for its own purposes elsewhere. Write a separate answer for each purpose. EU-GDPR · UK-GDPR · ICO-CONTRACT

Record the harm a person might actually suffer, such as losing an interview, an abuser locating them or a missed urgent referral. Compare a manual route. Choose a pass condition and a stop condition before viewing test results. Approval is limited to the version, audience, use and markets named on the decision.

Ten decisions a founder has to make

01 · Would we allow the proposed use?

Founder and product lead write who is affected, whether a result informs or makes a decision, who can overrule it and who bears a mistake. Consider both where the company operates and where outputs are used. For EU deployment, screen prohibited uses before involving people. A proposal to infer staff emotions from biometric data in the workplace needs an Article 5 review, including the narrow medical or safety exception. A friendly product label cannot settle the issue. Keep an alternative such as a voluntary anonymous survey. EU-SCOPE · EU-PROHIB · EU-AIA-BASE

02 · Can the company promise what it says it owns?

Founder and finance lead trace pre-incorporation code, founder contributions, employee work, contractor assets, datasets, model licences and open-source conditions. A commissioned work can remain the creator’s copyright under UK rules unless agreed otherwise. Check signed transfers or adequate licences, permitted sublicensing, territories and change-of-control terms. List unresolved claims before fundraising. Take local advice for authors based elsewhere. At a financing round check whether a qualifying UK acquisition of control requires national-security clearance, including for certain narrowly defined AI activities. UK-IP · UK-NSI

03 · What may we bring into the system?

Procurement and the data lead record a separate permission for collection, training, fine-tuning, retrieval, displaying outputs and onward supply. Identify the relevant privacy basis as well as the contractual or IP permission. Inspect the purchased plan’s actual settings, training and support access, subprocessor list, retention, deletion, change notices and testable exit route. For an in-scope controller–processor relationship put Article 28 terms in place. Map overseas remote access and the applicable UK and EU transfer mechanisms separately. Hold real uploads if a necessary permission or safeguard is missing. EU-GDPR · UK-GDPR · ICO-CONTRACT · ICO-TRANSFER · EU-TRANSFER · EDPB-MODEL

04 · Is the prototype safe enough for a pilot?

Technical lead uses fictional multi-customer data. Seed a distinctive fake marker in customer B’s account and make customer A request it through chat, document search and export. Place a harmless instruction in an attachment to trigger a forbidden email. Access enforcement belongs on the server for every tool call and retrieval. Test deletion from search indexes, secret redaction, outage fallback and the kill switch. Archive build ID, permissions, expected result and actual output. Any cross-customer disclosure or unauthorised action blocks this pilot. NCSC · EU-GDPR

05 · May real people or records enter the pilot?

Before the first live record, document purpose, role, notice, lawful basis, other conditions, retention, risk and the relevant authority’s DPIA list. Where processing is likely to result in high risk, the controller completes a data protection impact assessment (DPIA) before processing. Consult the authority first if high residual risk cannot be reduced sufficiently. A DPIA does not authorise an otherwise unlawful activity. Seek the DPO’s advice where designated and affected people’s views where appropriate. Limit access, time and users. Test whether a person can understand, challenge and change a result in time. EU-GDPR · UK-GDPR · ICO-SCREEN · ICO-DPIA · UK-RIGHTS

06 · What exactly can we sell or promise?

Founder signs the release. Marketing ties each objective claim to a dated test on the intended population. Example: “median handling time fell by 40 seconds in 80 English support emails after human checking” states the denominator, task and limit. Claims about another language, diagnosis or autonomous accuracy need their own evidence. Give users the required notices, an accessible route to a person and accurate limits. Verify sector authorisation, safety and accessibility before using medical, employment or finance claims. For EU AI Act Article 50 assess the actor, interaction or output, exception and operative date separately. UK-ADS · EU-MARK · EU-AIA · UK-MED · EU-MED

07 · How will we know if it is failing?

Operations lead reviews complaints, overrides, urgent misses, wrong-recipient outputs and service outages. Measure by language and reasonably represented group without collecting extra sensitive attributes without justification. Give staff authority to suspend. Keep a functioning manual route and monitor it. Practise one incident when the founder is unavailable. Record rights requests separately and pass them securely to the actual controller if acting on instructions. EU-GDPR · UK-GDPR · EDPB-ACCESS · ICO-ACCESS · NCSC

08 · Does the previous approval cover the change?

Reopen the decision for a new country, user group, model, data class, supplier reuse term or automatic action. For example, changing a draft refund reply into a payment action requires a transaction limit, separate approval, fraud controls, reconciliation and a rollback procedure. In the EU, check whether a purpose change or substantial modification shifts responsibilities under Article 25. A company releasing a general-purpose model has a different assessment from a company buying an API. Check worker representation and sector rules locally. EU-SCOPE · EU-ROLE · EU-GPAI · EU-WORKS · EU-AIA

09 · What can a buyer see and acquire?

Deal lead uses three decisions. First, decide what can lawfully be shown to which bidder. Start with aggregates or redacted schedules, time-limited access and an access log. Second, in a share sale check change-of-control clauses, regulatory filings and approvals. Third, in an asset sale check individual assignments, novations, data-controller changes and notices. An NDA protects confidentiality but does not supply a missing privacy basis or permission. Trace a sample asset back to a signed right and a model version back to its data. Put missing consents, rights, remediation owners and closing conditions on the disclosure schedule. ICO-DEAL · UK-IP · UK-NSI · EU-GDPR

10 · How do we end the service safely?

Operations and legal leads agree customer exports, lawful retention, legal holds, return or deletion duties, a timetable and a contact for later rights requests. Revoke live keys and supplier access. Track prompts, indexes, fine-tunes, backups and vendor copies separately. If immediate backup erasure is infeasible, restrict use, document overwrite and reapply deletions during restoration. Request supplier evidence. Record unresolved copies or limits truthfully. Test a restore with a fictional deleted record. ICO-ERASE · ICO-CONTRACT · EDPB-MODEL · EU-GDPR

A release exercise for a four-person support company

The founder proposes drafting replies to delivery enquiries. The engineer uses fictional tickets, the support lead sets the escalation rule and a colleague tests the deployed version. Order numbers are permitted in the approved business tenancy. Health attachments, new recipients and automatically issuing refunds are outside the pilot. An agent must inspect the source and approve before sending.

In a fictional pilot, two of twenty urgent tickets are missed. Four of eighty ordinary tickets are unnecessarily escalated. The urgent miss rate is 10% and the unnecessary escalation rate is 5%. The prewritten rule allowed zero missed safety-critical tickets. Hold this release even if the average time saving is attractive. Switch to manual triage, repair the route, retest on a fresh set including accessible-language cases and record who approved the narrower use. These thresholds are company choices.

A first customer later asks to import disability accommodation requests. Treat this as a new data purpose and risk decision. The team may still decline the import after an assessment. One workable design is to keep the accommodation record with trained staff and send the AI only an ordinary delivery instruction. The next sections show how to decide.

UK and EU decision points

UK GDPR and the Data Protection Act 2018 apply according to their own scope. Check UK GDPR Articles 22A–22D for significant solely automated decisions, safeguards and conditions for restricted bases or data. In the EU examine Article 22, including the applicable exception and safeguards, and national employment law. A human signature added to an effectively predetermined decision may provide no meaningful review. Give the reviewer authority, time, source evidence and a tested means to change the outcome. UK-RIGHTS · UK-DUAA · EU-GDPR · CJEU-SCORE

For EU AI Act classification, record intended purpose, provider or deployer role, territorial scope and Article 5 first. Where relevant, test Article 6 and Annexes I and III, prepare the applicable provider or deployer controls, and check Article 27 for specified deployers. The 2026 amendment sets 2 December 2027 for the specified Chapter III sections 1–3 obligations for Annex III Article 6(2) systems and 2 August 2028 for Annex I Article 6(1) systems, except Article 6(5). Other duties follow separate dates. Recheck the operative text on the actual release date. Staff training should use role-specific examples and test whether operators can recognise a stop condition. EU-AIA-BASE · EU-AIA · EU-HIGH · EU-LIT · EU-FRIA

For a clinic, distinguish appointment administration from software intended to inform diagnosis or treatment. For hiring, distinguish drafting an advert from scoring applicants and rejecting them. For finance, distinguish summarising public material from personalised advice or credit decisions. Identify the responsible sector specialist, intended use, jurisdiction and permission to operate before trialling the higher-consequence function. UK medical-device routes can differ between Great Britain and Northern Ireland. UK-MED · EU-MED · EU-HIGH · EU-GDPR

Keep the file useful

Keep a restricted evidence folder with a versioned index. Link evidence IDs from the workbook, limit access by role, log changes and test restoration. Keep live personal data and credentials out of training material. Back up in a separate security boundary and verify user access and deletion rules after restoration. Review when a material change occurs. As an operating choice, a small team can also sample one decision and one complaint each month and run a rehearsed breach and restore each quarter. NCSC · ICO-ERASE

Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.