TOTO-REX   /   FOUNDER’S FIRST AI LITERACY FOLDER

Sources and verification notes

Start with the legislation for the legal test, then use the regulator’s guidance or form. Technical controls, sample thresholds and operating timetables in this guide are examples. Verify current law, local requirements and regulator routes when a business acts.

CJEU-SCORE · Court of Justice of the EU

Judgment · C-634/21, SCHUFA Holding

Credit score with determining influence in the facts before the Court.

EDPB-ACCESS · European Data Protection Board

Supervisory guidance · Guidelines 01/2022 v2.1, especially paragraphs 158–166

EU access, qualification of timing and search. National exceptions can matter.

EDPB-BREACH · European Data Protection Board

Final supervisory guidance · Guidelines 9/2022 v2.0, awareness, roles, risk and non-EEA establishment

Interpretation of GDPR Articles 33–34 and cross-border notification.

EDPB-DOORS · European Data Protection Board and national authorities

Reporting directory · How to notify a data breach to your DPA

Country-specific regulator forms and reporting languages. Submit to the competent authority.

EDPB-EX · European Data Protection Board

Final worked guidance · Guidelines 01/2021 on examples regarding personal data breach notification

Examples for ransomware, loss, mitigation and separate risk assessments.

EDPB-MODEL · European Data Protection Board

Opinion · 28/2024, anonymity and legitimate interests

Model assessment is case-specific. Consider extraction and query risks.

EU-AIA · EU legislature

Amending law · Regulation 2026/1744, Article 1(5), (39)–(40) and amended Articles 111 and 113

Use the operative amendment for literacy and scoped phase-ins. Consult the final text for the particular use.

EU-AIA-BASE · EU legislature

Legislation · Regulation (EU) 2024/1689, especially Articles 2, 4–6, 25–27, 50

Read with Regulation 2026/1744 for the amended text and commencement.

EU-DORA · EU legislature

Legislation · Regulation 2022/2554, especially Articles 2 and 17–19

Financial-sector ICT incident route, subject to covered entity, classification and related standards.

EU-FRIA · European Commission AI Act Service Desk

Legislative text service · AI Act Article 27

Specified deployers and activities, notification and relationship with a DPIA.

EU-GDPR · EU legislature

Law · Articles 3–10, 12, 15–22, 25, 28 and 32–36, 44–49, recitals 26 and 51

EU processing, rights, impact assessment, breaches and transfers. Indexed official text and article extracts. Check local implementation and exemptions.

EU-GPAI · European Commission

Regulatory guidance · Obligations for providers of general-purpose AI models

Model-provider roles and obligations require a separate assessment.

EU-HIGH · European Commission AI Act Service Desk

Legislative text service · AI Act Article 6 and Annex III

Classification, narrow exceptions and profiling. Check current law and intended purpose.

EU-LIT · European Commission

Regulator explanation · AI literacy questions and answers

Interprets the literacy obligation. Training design remains context-specific.

EU-MARK · European Commission AI Act Service Desk

Legislative text service · AI Act Article 50

Separate provider and deployer obligations. Read with transition and exceptions.

EU-MED · EU legislature

Legislation · Regulation 2017/745, Article 2 and Annex VIII Rule 11

For qualifying medical device software. Check current consolidated text and classification rules.

EU-NIS2 · EU legislature

Directive · Directive 2022/2555, Articles 2–3 and 23

Check national implementation, entity scope, significant incident and applicable clock.

EU-PROHIB · European Commission

Guidance · Navigating the AI Act, prohibitions

An overview. Exceptions and operative dates require the underlying regulation.

EU-ROLE · European Commission AI Act Service Desk

Official article text · Article 25, responsibilities along the AI value chain

Check the specific high-risk fact pattern before attributing provider status to a customer.

EU-SCOPE · European Commission AI Act Service Desk

Legislative text service · AI Act Article 2

Territorial scope. Cross-check operative legislation.

EU-SECRET · EU legislature

Directive · Directive 2016/943, Articles 2–4

Trade secrets, reasonable steps and unlawful use or disclosure. Read national implementation.

EU-SENS · European Commission

Official explanation · Legal grounds and additional conditions for special categories

Read with EU GDPR Articles 6, 9 and relevant Member State law.

EU-TRANSFER · European Commission

Guidance · Standard contractual clauses

Check correct module, scope, onward access, local laws and supplementary measures.

EU-WORKS · Germany, Federal Ministry of Justice

Law · BetrVG section 87(1)(6)

German works council co-determination under the applicable conditions.

ICO-ACCESS · UK Information Commissioner

Guidance · Responding to a subject access request

UK timing and scope. Keep the date calculation with the file.

ICO-BGUIDE · UK Information Commissioner

Regulator guidance · Personal data breaches, a guide

UK awareness, reporting, records, people and sector exceptions.

ICO-BIO · UK Information Commissioner

Regulator guidance · How do we process biometric data lawfully?

Recognition, specific lawful basis, special-category condition and safeguards.

ICO-CHILD · UK Information Commissioner

Statutory code · Age appropriate design code for online services

Best interests, data minimisation and default settings for in-scope services.

ICO-CHLAW · UK Information Commissioner

Regulator guidance · How do the lawful bases apply to children’s information?

The online consent threshold is purpose-specific.

ICO-CONTRACT · UK Information Commissioner

Guidance · Processor contract content

Check actual roles, subprocessing, audit and exit.

ICO-DEAL · UK Information Commissioner

Statutory code guidance · Data sharing code, due diligence

UK merger, acquisition and organisational changes involving personal information.

ICO-DPIA · UK Information Commissioner

Guidance · How do we do a DPIA?, steps 1–7

Practical UK method, consultation and residual risk. Recheck updates.

ICO-ERASE · UK Information Commissioner

Regulator guidance · Right to erasure, backups and exceptions

Distinguish inaccessible backup data and routine use, and check retention exceptions.

ICO-REPORT · UK Information Commissioner

Reporting route · Report a UK GDPR personal data breach

Official start page for organisations, including the current reporting form.

ICO-ROUTES · UK Information Commissioner

Reporting routes · Report a breach, scheme selector

Select applicable UK reporting regime for the service.

ICO-SCREEN · UK Information Commissioner

Guidance · When do we need to do a DPIA?

UK trigger/list criteria. Guidance carries a DUAA review notice.

ICO-SPECIAL · UK Information Commissioner

Regulator guidance · What is special category data?, including inferences

Technical processing, purpose, inferred characteristics and separate criminal-offence rules.

ICO-TRANSFER · UK Information Commissioner

Guidance · Completing a transfer risk assessment

UK data protection test. Assess the specific overseas access.

NCSC · UK National Cyber Security Centre

Technical guidance · Secure AI system development lifecycle

Security design, development, deployment and operation. Apply to the actual system.

SRA-CONF · Solicitors Regulation Authority

Professional standards guidance · Confidentiality of client information

England and Wales regulated practice. Check relevant profession and jurisdiction elsewhere.

UK-ADS · Committee of Advertising Practice

Advertising code · Non-broadcast code, section 3, especially rule 3.7

UK scope. Hold documentary support for objective claims before publication.

UK-CHILD · UK Parliament

Legislation · DPA 2018 section 9

Child consent for direct information society services and exception for preventive or counselling services.

UK-CRIME · UK Parliament

Legislation · DPA 2018 section 11, including allegations and proceedings

Read with UK GDPR Article 10, section 10 and Schedule 1.

UK-DUAA · UK Parliament

Law · Sections 76, 78 and 80

Read with commencement and savings. The search and timing changes have different dates.

UK-GDPR · UK legislation

Law · Chapter IV, especially Articles 28 and 32–36

UK-specific point-in-time text checked against ICO guidance. Selected provisions.

UK-IP · UK Intellectual Property Office

Guidance · Ownership of copyright works, employment and commissioning

Use for UK chain of title. National laws and the actual agreement matter.

UK-MED · MHRA

Regulator guidance · Software and AI as a medical device, intended use

Screen intended clinical purpose and applicable territorial route.

UK-NSI · UK Cabinet Office

Official statutory guidance · Notifiable acquisitions and defined AI activities

Check target activities, control thresholds, sector definitions and clearance before completion.

UK-RIGHTS · UK legislation

Law · Chapter III, Articles 12A, 15 and 22A–22D

UK rights, deadlines and significant decisions. Selected official text, including indexed passages.

UK-SCHED · UK Parliament

Legislation · DPA 2018 Schedule 1, parts 1–4

Certain UK conditions and appropriate policy document requirements. Read with sections 10–11.

Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.