AI compliance from idea to exit

Walk through a single item from input to output. Which person can be affected, what could they lose, and who can change the outcome?

EU AI Act: do we build or market the system under our name, deploy it for work, or change its purpose? Check territorial scope, including where an output is used. Keep the reason for each role.

Screen prohibited practices before testing with people. For example, workplace emotion inference has a narrow medical or safety exception. Escalate any possible prohibition before further use.

Working alone? Wear several hats and record which one you used. Get a qualified second view for unfamiliar or serious decisions. With 2–10 people, separate the maker from the checker. With 11–50, name leads and deputies. These are suggested working arrangements.

Compare doing nothing, a manual process and an AI-assisted process. Estimate time saved after checking, cost of errors, supplier fees and exit costs.

Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.

Supplier check: identify processors and subprocessors, training or reuse terms, support access, contract, incidents, return or deletion, change notice and exit. Save the dated terms and unresolved questions.

Locate each restricted transfer. Record the applicable adequacy decision or safeguard, assessment and extra protections. Check EU SCCs and UK IDTA or Addendum separately. Revisit overseas support and onward transfers.

Engineering and data: freeze model, prompt, dataset and settings. Test typical, unusual and misleading inputs against an agreed baseline. Keep reproducible results and known limits.

Predeclare the test: purpose, dataset origin, expected answers, baseline, sample size, thresholds, critical failures, reviewer and retest date. Include language, disability and real operating conditions where relevant.

Security drill: send a harmless hostile instruction in a fictional attachment. Test a blocked export, denied permission, wrong recipient and unavailable supplier. Record what happened at each boundary.

A DPIA examines how processing personal data could harm people and how to reduce that harm. The controller must do it before likely high-risk processing begins, including a pilot using real personal data.

Seek the data protection officer’s advice where designated. Where appropriate seek affected people’s views. Record objections, accessibility needs, decisions and reasons for any justified departure.

Decide whether high risk remains despite practical measures. If so, consult the competent authority before starting the processing under Article 36. Record correspondence and response. A founder’s signature cannot replace consultation.

Check human oversight: can the reviewer see the evidence, disagree, correct the result and stop the next action in time? Save one override trace. A second click alone proves little.

Check Article 50 by actor and output. Telling people they interact with AI, machine-readable marking and disclosing a deepfake are different duties with exceptions. Record which applies and the release-date evidence.

Marketing, design and sales: substantiate claims, clear assets and check required disclosures. Save approved wording and versions. Escalate promises of exclusivity, ownership or guaranteed accuracy.

Release options: approve within stated limits, approve with controls already in force, hold pending evidence, or stop. Name unresolved issues, lawful scope, approver, effective date, expiry and rollback owner.

After release: name an owner for errors, complaints, overrides, drift, security and costs. Specify sample, frequency, stop threshold and who can disable the workflow. Log changes and reapprove material ones.

Incident: stop unsafe actions, preserve restricted evidence, assess people affected, activate the manual route and record notification decisions. Test a clean restore and correction before reopening.

For UK/EU personal-data breaches, controllers notify the regulator unless risk to people’s rights is unlikely. Notify without undue delay and where feasible within 72 hours of awareness. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Processors notify controllers without undue delay.

Intake: keep a secure reference to the original words. Record first receipt, controller, jurisdiction, each right, owner, safe reply channel and accessibility or representative needs.

Check the intended purpose against Annexes I and III. Recruitment screening is a listed example. Document any claimed Article 6(3) exception and its conditions. Profiling people rules out that exception.

The revised dates for Chapter III sections 1–3, except Article 6(5), are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Other provisions have their own dates.

UK significant solely automated decisions require an Articles 22A–22D review, including restrictions on special-category data and the recognised legitimate interests basis. In the EU start with Article 22 and its specific exceptions. Test real human power to reconsider.

List the accountable organisation for each purpose. Who chooses why and how personal data are used? Who acts on instructions? Map each supplier’s own uses separately.

For each risk write cause → event → harm to a person. Record likelihood, impact, affected group and evidence before controls. Name the control, tester, due date and risk remaining afterwards.

Your decision record: workflow and version, permitted and excluded uses, evidence IDs, decision and reasons, dissent, restrictions, owner, reviewer, review date, signature and time. Keep the previous version.

Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.

Other rights: examine correction, erasure, restriction, portability, objection and human review separately. Record applicable conditions, exceptions, recipients to notify, and any lawful retention or dispute hold.

Private filing: store completed forms, evidence and signatures with restricted access. Keep the public folder blank. Back up a versioned copy, keep an independently protected copy and test a restore. Set a retention period for each record.