AI compliance from idea to exit

AI compliance fae the first idea tae sellin or shuttin doon

Use the stage that matches your next decision. A funding round is a planning milestone. Duties can start earlier, including when the first real record enters a pilot.

Stairt wi the neist decision. Duties can arise afore ye raise siller, even in a closed trial wi real records.

The English stays in sicht. Choose a second language tae read alangside it.

Which records need extra care?

Whit records need mair care?

A photograph and a face template used to identify someone are different. Record the Article 6 basis and, for special-category processing, the Article 9 condition. Consider health inferences, children, dependence on a carer, an unsafe address and client secrets separately. Restrict input and access, offer a human alternative and complete a required DPIA before using live records.

Tell a photo apairt fae a face template used tae identify a person uniquely. Write doon the Article 6 basis and, for special categories, the Article 9 condition. Think separately aboot health guesses, bairns, dependin on a carer, an address that could put somebody in danger, and client secrets. Limit inputs and access, gie fowk a human option and finish ony required impact assessment afore real data gae in.

12 detailed data decisions (EN) · ICO-SPECIAL · EU-GDPR

If a breach happens

Gin there is a personal data breach

Stop the disclosure, preserve restricted evidence and record awareness time. A processor tells the controller without undue delay. A controller notifies the competent authority without undue delay and, where feasible, within 72 hours of awareness unless risk to people’s rights and freedoms is unlikely. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Record every personal data breach and the reasons for each decision.

Stop the harm, keep evidence safe and note whan ye kent aboot the breach. A processor tells the controller withoot undue delay. The controller tells the competent authority withoot undue delay and, whaur feasible, within 72 hours o awareness, unless a risk tae fowk’s richts and freedoms is unlikely. Gin high risk is likely, tell the fowk wi nae undue delay, subject tae the exceptions in Article 34. Record ilka personal data breach and the reasons for yer decisions.

Full incident playbook and messages (EN) · ICO-REPORT · EDPB-DOORS

01 · Pre-seed · Define the use

Afore seed fundin · choose the use

A useful idea can hide an unacceptable use. The founder names the decision, affected people and forbidden uses. Hold a live trial until a possible prohibition has been resolved.

Name the decision, the fowk it affects and the uses ye rule oot. Haud back a live trial if a possible legal ban is still an open question.

Evidence or answer

One-page use case and manual alternative

Ane-page use case and a way tae dae it by hand

Source notes / practical checks

Walk through a single item from input to output. Which person can be affected, what could they lose, and who can change the outcome?

Follow ae item fae input tae output. Wha could be affected, whit could they lose, an wha can change the outcome?

EU AI Act: do we build or market the system under our name, deploy it for work, or change its purpose? Check territorial scope, including where an output is used. Keep the reason for each role.

EU AI Act: dae we build or market the system unner oor name, deploy it for wark, or change its purpose? Check territorial scope, includin whaur an output is used. Keep the reason for each role.

Screen prohibited practices before testing with people. For example, workplace emotion inference has a narrow medical or safety exception. Escalate any possible prohibition before further use.

Check for prohibited practices afore testin wi folk. For example, inferrin emotions in the workplace has a narrow medical or safety exception. Refer ony possible prohibition for review afore further use.

EU-SCOPE · EU-PROHIB

02 · Formation and seed funding

Settin up the business

The company may not control code, data or designs made before incorporation. Trace each contribution and secure suitable rights before promising ownership to investors.

Trace wha made the code, data and designs. Get the richts ye need afore ye promise ownership tae investors.

Evidence or answer

Contributor and rights schedule with signed evidence

Contributor list and signed agreements

Source notes / practical checks

Working alone? Wear several hats and record which one you used. Get a qualified second view for unfamiliar or serious decisions. With 2–10 people, separate the maker from the checker. With 11–50, name leads and deputies. These are suggested working arrangements.

Workin on yer ain? Tak on mair than ae role an record which role ye used. Get a qualified second view on unfamiliar or serious decisions. Wi 2–10 folk, hae somebody else check the maker’s wark. Wi 11–50, name leads an deputies. Thae are suggested weys o organisin the wark.

Compare doing nothing, a manual process and an AI-assisted process. Estimate time saved after checking, cost of errors, supplier fees and exit costs.

Compare daein naething, daein the task by haun an usin AI tae help. Estimate time saved efter checkin, the cost o mistakes, supplier fees an the cost o leavin.

UK-IP · UK-NSI

03 · Source data and suppliers

Data and suppliers

Permission to view material may not cover training, retrieval or customer resale. Match each use to a right and check vendor reuse, subcontractors, costs and exit before uploading real records.

Check permission for trainin, search and resale separately. Find oot if the supplier reuses records and whit happens when ye leave.

Evidence or answer

Permission matrix and signed supplier decision

Permissions table and supplier decision

Source notes / practical checks

Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.

Trace ae data item through collection, prompts, retrieval, model, output, logs, support an deletion. Name the source, folk, country, recipients, retention, backups an somebody wha can test deletion.

Supplier check: identify processors and subprocessors, training or reuse terms, support access, contract, incidents, return or deletion, change notice and exit. Save the dated terms and unresolved questions.

Check the supplier. Identify processors an subprocessors, terms for trainin or reuse, support access, contract, incidents, return or deletion, notice o change an exit. Keep the dated terms an open questions.

Locate each restricted transfer. Record the applicable adequacy decision or safeguard, assessment and extra protections. Check EU SCCs and UK IDTA or Addendum separately. Revisit overseas support and onward transfers.

Locate each restricted transfer. Record the applicable adequacy decision or safeguard, the assessment an extra protections. Check EU SCCs an the UK IDTA or Addendum separately. Revisit overseas support an onward transfers.

ICO-CONTRACT · EU-TRANSFER · ICO-TRANSFER · EDPB-MODEL

04 · Build and prototype

Biggin a prototype

A model can leak another customer’s records or turn a document instruction into an action. Use synthetic test cases, separate tenants, limit permissions and test a manual override before connecting live systems.

Test wi made-up records. Try crossin a customer's access boundary in a safe test. Show ye can stop an action.

Evidence or answer

Versioned test results, access map and rollback test

Test results and a plan tae roll back

Source notes / practical checks

Engineering and data: freeze model, prompt, dataset and settings. Test typical, unusual and misleading inputs against an agreed baseline. Keep reproducible results and known limits.

Engineering an data: fix the model, prompt, dataset an settings for the test. Test typical, unusual an misleading inputs against an agreed baseline. Keep reproducible results an kent limits.

Predeclare the test: purpose, dataset origin, expected answers, baseline, sample size, thresholds, critical failures, reviewer and retest date. Include language, disability and real operating conditions where relevant.

Set the test oot in advance: purpose, dataset origin, expected answers, baseline, sample size, thresholds, critical failures, reviewer an retest date. Include language, disability an real operating conditions whaur relevant.

Security drill: send a harmless hostile instruction in a fictional attachment. Test a blocked export, denied permission, wrong recipient and unavailable supplier. Record what happened at each boundary.

Security drill: send a harmless hostile instruction in a made-up attachment. Test a blocked export, denied permission, wrang recipient an unavailable supplier. Record whit happened at each boundary.

NCSC · EU-GDPR

05 · Pilot with real users

Trial wi real fowk

A free or closed pilot can still harm a person. Screen before real data, set limits and enable meaningful review. Hold high-risk processing if a required impact assessment or prior consultation is incomplete.

Screen risk afore real records gae in. Finish ony required impact assessment and gie fowk a way tae get a human review.

Evidence or answer

Pilot protocol, DPIA decision and stop criteria

Trial plan and rules for stoppin

Source notes / practical checks

A DPIA examines how processing personal data could harm people and how to reduce that harm. The controller must do it before likely high-risk processing begins, including a pilot using real personal data.

A DPIA examines hoo processin personal data could harm folk an hoo tae reduce that harm. The controller maun dae it afore processin likely tae create high risk begins, includin a pilot usin real personal data.

Seek the data protection officer’s advice where designated. Where appropriate seek affected people’s views. Record objections, accessibility needs, decisions and reasons for any justified departure.

Seek the data protection officer’s advice whaur ane is designated. Seek affected folk’s views whaur appropriate. Record objections, access needs, decisions an reasons for ony justified departure.

Decide whether high risk remains despite practical measures. If so, consult the competent authority before starting the processing under Article 36. Record correspondence and response. A founder’s signature cannot replace consultation.

Decide whether high risk remains despite practical measures. If it dis, consult the competent authority afore startin the processin, unner Article 36. Record correspondence an response. A founder’s signature cannae tak the place o consultation.

Check human oversight: can the reviewer see the evidence, disagree, correct the result and stop the next action in time? Save one override trace. A second click alone proves little.

Check human oversight: can the reviewer see the evidence, disagree, correct the result an stop the next action in time? Keep ae record o an override. A second click alane proves little.

ICO-DPIA · EU-GDPR · UK-GDPR

06 · Pre-launch · Decide whether to ship

Afore launch

A polished demo can outrun the evidence. Test the exact public claim, check applicable disclosures and sector approvals, and name the person who can withhold release.

Match ilka sales claim tae relevant evidence. Check notices and sector permissions.

Evidence or answer

Claims-to-evidence table and dated release decision

Dated release decision

Source notes / practical checks

Check Article 50 by actor and output. Telling people they interact with AI, machine-readable marking and disclosing a deepfake are different duties with exceptions. Record which applies and the release-date evidence.

Check Article 50 by role an output. Tellin folk they are interactin wi AI, machine-readable markin an disclosin a deepfake are different duties wi exceptions. Record which applies an the evidence at the date o release.

Marketing, design and sales: substantiate claims, clear assets and check required disclosures. Save approved wording and versions. Escalate promises of exclusivity, ownership or guaranteed accuracy.

Marketing, design an sales: back up claims wi evidence, clear the materials an check required disclosures. Keep approved wording an versions. Refer promises o exclusivity, ownership or guaranteed accuracy for review.

Release options: approve within stated limits, approve with controls already in force, hold pending evidence, or stop. Name unresolved issues, lawful scope, approver, effective date, expiry and rollback owner.

Release options: approve within stated limits, approve wi controls awready in force, haud for evidence or stop. Name open issues, lawful scope, approver, effective date, expiry an wha can roll back.

UK-ADS · EU-MARK · EU-AIA

07 · Launch and operate

Launch and day-tae-day use

Complaints and changes in performance can reveal harm missed in testing. Give users a human route, test it, monitor errors by type and contain incidents promptly.

Watch for mistakes and complaints. Gie fowk a human contact and name wha handles incidents.

Evidence or answer

Monitoring log, incident owner and response record

Monitorin and incident record

Source notes / practical checks

After release: name an owner for errors, complaints, overrides, drift, security and costs. Specify sample, frequency, stop threshold and who can disable the workflow. Log changes and reapprove material ones.

Efter release: name somebody responsible for errors, complaints, overrides, drift, security an costs. Specify sample, frequency, stop threshold an wha can disable the workflow. Log changes an get fresh approval for material anes.

Incident: stop unsafe actions, preserve restricted evidence, assess people affected, activate the manual route and record notification decisions. Test a clean restore and correction before reopening.

Incident: stop unsafe actions, preserve evidence under restricted access, assess effects on folk, activate the manual route an record notification decisions. Test a clean restore an correction afore reopening.

For UK/EU personal-data breaches, controllers notify the regulator unless risk to people’s rights is unlikely. Notify without undue delay and where feasible within 72 hours of awareness. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Processors notify controllers without undue delay.

For UK/EU personal-data breaches, controllers notify the regulator unless risk tae folk’s rights is unlikely. Notify withoot undue delay an, whaur feasible, within 72 hours o becoming aware. If high risk is likely, tell folk withoot undue delay, subject tae Article 34 exceptions. Processors notify controllers withoot undue delay.

Intake: keep a secure reference to the original words. Record first receipt, controller, jurisdiction, each right, owner, safe reply channel and accessibility or representative needs.

On receipt, keep a secure reference tae the original words. Record first receipt, controller, jurisdiction, each right, the person responsible, safe reply channel an ony accessibility or representation needs.

ICO-BGUIDE · EDPB-BREACH

08 · Scale or change the product

Growin and changin

A new market, model, customer group or automated action can change the risk and legal role. Reassess the changed scope before switching it on.

Review a new model, market, group or action. Test the change afore ye approve it.

Evidence or answer

Market and change register with fresh approval

Change register

Source notes / practical checks

Check the intended purpose against Annexes I and III. Recruitment screening is a listed example. Document any claimed Article 6(3) exception and its conditions. Profiling people rules out that exception.

Check the intended purpose against Annexes I an III. Recruitment screening is ae listed example. Record ony Article 6(3) exception ye claim an its conditions. Profilin folk rules oot that exception.

The revised dates for Chapter III sections 1–3, except Article 6(5), are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Other provisions have their own dates.

The revised dates for Chapter III sections 1–3, except Article 6(5), are 2 December 2027 for Annex III systems an 2 August 2028 for Annex I systems. Ither provisions hae their ain dates.

UK significant solely automated decisions require an Articles 22A–22D review, including restrictions on special-category data and the recognised legitimate interests basis. In the EU start with Article 22 and its specific exceptions. Test real human power to reconsider.

For significant UK decisions based solely on automated processin, review Articles 22A–22D, includin restrictions on special-category data an the recognised legitimate interests basis. In the EU, start wi Article 22 an its specific exceptions. Test whether a person really has power tae reconsider.

EU-ROLE · EU-HIGH · UK-RIGHTS · EU-AIA

09 · Fundraise again, sell or merge

Investment or sellin up

A buyer may acquire fewer rights than the pitch suggests. Separate deal-room disclosure, change of control and asset transfer. Resolve material consents and any required clearance before completion.

Check whit ye show a buyer, change o control and transfer o assets separately.

Evidence or answer

Diligence index, exceptions, consents and closing conditions

Richts schedule and closin conditions

Source notes / practical checks

List the accountable organisation for each purpose. Who chooses why and how personal data are used? Who acts on instructions? Map each supplier’s own uses separately.

List the organisation answerable for each purpose. Wha chooses why an hoo personal data are used? Wha acts on instructions? Map each supplier’s ain uses separately.

For each risk write cause → event → harm to a person. Record likelihood, impact, affected group and evidence before controls. Name the control, tester, due date and risk remaining afterwards.

For each risk write cause → event → harm tae a person. Record likelihood, impact, affected group an evidence afore controls. Name the control, tester, due date an the risk left efterwards.

Your decision record: workflow and version, permitted and excluded uses, evidence IDs, decision and reasons, dissent, restrictions, owner, reviewer, review date, signature and time. Keep the previous version.

Yer decision record: workflow an version, permitted an excluded uses, evidence IDs, decision an reasons, dissent, restrictions, person responsible, reviewer, review date, signature an time. Keep the earlier version.

ICO-DEAL · UK-IP · UK-NSI

10 · Retire or close the business

Shuttin doon

Data, keys and obligations outlive a website. Assign a custodian, return or erase data as applicable, document lawful holds, revoke access and test that restored backups do not reactivate deleted records.

Revoke access keys. Return or delete data as required. Test that a backup restore disnae bring deleted records back intae use.

Evidence or answer

Decommissioning record, supplier evidence and remaining contact

Closin record and named contact

Source notes / practical checks

Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.

Trace ae data item through collection, prompts, retrieval, model, output, logs, support an deletion. Name the source, folk, country, recipients, retention, backups an somebody wha can test deletion.

Other rights: examine correction, erasure, restriction, portability, objection and human review separately. Record applicable conditions, exceptions, recipients to notify, and any lawful retention or dispute hold.

Ither rights: examine correction, erasure, restriction, portability, objection an human review separately. Record applicable conditions, exceptions, recipients tae notify an ony lawful retention or preservation for a dispute.

Private filing: store completed forms, evidence and signatures with restricted access. Keep the public folder blank. Back up a versioned copy, keep an independently protected copy and test a restore. Set a retention period for each record.

Private filing: keep filled-in forms, evidence an signatures under restricted access. Keep the public folder blank. Back up a versioned copy, keep a separately protected copy an test restoration. Set a retention period for each record.

ICO-ERASE · ICO-CONTRACT

Read the full UK and EU founder’s guide (EN)

Workbook ye can edit · Full English handbook (Word)

Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.