Use the stage that matches your next decision. A funding round is a planning milestone. Duties can start earlier, including when the first real record enters a pilot.
从当前要作的决定开始。融资轮次方便规划工作；法律义务可能更早出现，例如第一次把真实记录放进试用系统。
A photograph and a face template used to identify someone are different. Record the Article 6 basis and, for special-category processing, the Article 9 condition. Consider health inferences, children, dependence on a carer, an unsafe address and client secrets separately. Restrict input and access, offer a human alternative and complete a required DPIA before using live records.
普通照片与用来识别身份的面部特征模板要分别判断。处理个人数据须明确第 6 条依据；涉及特殊类别时还须符合第 9 条条件。留意健康推断、儿童、依赖照护者的人、泄露后会危及安全的地址以及客户机密。限制输入和访问，提供人工替代方案，在使用真实数据前完成依法所需的影响评估。
Stop the disclosure, preserve restricted evidence and record awareness time. A processor tells the controller without undue delay. A controller notifies the competent authority without undue delay and, where feasible, within 72 hours of awareness unless risk to people’s rights and freedoms is unlikely. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Record every personal data breach and the reasons for each decision.
制止泄露、限制证据访问并记录知悉时间。处理者须及时通知控制者，不得无故延误。除非事件不太可能对个人权利和自由构成风险，否则控制者须向主管机构报告，不得无故延误，并在可行时于知悉后 72 小时内办理。如可能造成高风险，须及时告知当事人，第 34 条另有例外。记录每宗个人数据安全事件及各项决定的理由。
A useful idea can hide an unacceptable use. The founder names the decision, affected people and forbidden uses. Hold a live trial until a possible prohibition has been resolved.
好点子也可能包含不能接受的用途。创始人写明系统辅助什么决定、谁受影响以及禁止用途。若可能涉及禁止行为，先弄清楚再做真实试验。
One-page use case and manual alternative
一页用途说明及人工替代方案
Walk through a single item from input to output. Which person can be affected, what could they lose, and who can change the outcome?
挑一条数据，从输入一路追踪到输出。谁可能受影响？可能失去什么？谁有权改变结果？
EU AI Act: do we build or market the system under our name, deploy it for work, or change its purpose? Check territorial scope, including where an output is used. Keep the reason for each role.
依《欧盟人工智能法》判断：我们是否以自身名义开发或推出系统、为业务而部署系统，或改变其用途？核查地域适用范围，包括输出在哪里使用。记下判定各项角色的理由。
Screen prohibited practices before testing with people. For example, workplace emotion inference has a narrow medical or safety exception. Escalate any possible prohibition before further use.
在让真人参与测试前，先排查是否涉及禁止行为。例如，工作场所的情绪推断仅有范围狭窄的医疗或安全例外。如用途可能受到禁止，应先提请审查，再决定能否继续。
The company may not control code, data or designs made before incorporation. Trace each contribution and secure suitable rights before promising ownership to investors.
成立公司前写的代码、取得的数据和设计，其权利未必属于公司。逐项追溯贡献者和合同，取得合适权利后才向投资人承诺拥有资产。
Contributor and rights schedule with signed evidence
贡献者与权利清单，附签署证据
Working alone? Wear several hats and record which one you used. Get a qualified second view for unfamiliar or serious decisions. With 2–10 people, separate the maker from the checker. With 11–50, name leads and deputies. These are suggested working arrangements.
独自经营时，可以一人兼任多个角色，并记录每次以什么身份作出判断。对于不熟悉或后果严重的决定，另请具备相应资格的人士复核。2–10 人的团队可让执行与检查由不同的人负责；11–50 人的团队可指定各项工作的负责人和副手。这些都是建议的分工方式。
Compare doing nothing, a manual process and an AI-assisted process. Estimate time saved after checking, cost of errors, supplier fees and exit costs.
比较维持现状、采用人工流程及采用 AI 辅助流程。估算扣除核查时间后可节省的工时、出错成本、供应商费用及退出成本。
Permission to view material may not cover training, retrieval or customer resale. Match each use to a right and check vendor reuse, subcontractors, costs and exit before uploading real records.
能浏览素材不代表能训练、检索或转售给客户。上传真实记录前，逐项核对用途权限、供应商再利用、分包商、成本及退出安排。
Permission matrix and signed supplier decision
用途授权矩阵及已签核的供应商决定
Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.
选一条数据，追踪其经历收集、提示、检索、模型处理、输出、日志、支持及删除的过程。记下来源、涉及的人、国家、接收者、保存期限、备份，以及谁能测试删除是否有效。
Supplier check: identify processors and subprocessors, training or reuse terms, support access, contract, incidents, return or deletion, change notice and exit. Save the dated terms and unresolved questions.
供应商核查应包括处理者和分处理者、训练或再利用条款、技术支持人员的访问权限、合同、事件响应、返还或删除、变更通知和退出安排。保存注明日期的条款，列出仍待解决的问题。
Locate each restricted transfer. Record the applicable adequacy decision or safeguard, assessment and extra protections. Check EU SCCs and UK IDTA or Addendum separately. Revisit overseas support and onward transfers.
找出每项受限制的跨境传输。记录适用的充分性决定或保障措施、评估及额外保护。分别核查欧盟标准合同条款（SCC）与英国国际数据传输协议（IDTA）或英国附录。重新检视境外支持及后续传输。
A model can leak another customer’s records or turn a document instruction into an action. Use synthetic test cases, separate tenants, limit permissions and test a manual override before connecting live systems.
模型可能泄露其他客户的记录，也可能把文档指令转成操作。先用合成数据，隔离客户、限制权限，测试人工阻断，再接入正式系统。
Versioned test results, access map and rollback test
有版本的测试结果、权限图及恢复测试
Engineering and data: freeze model, prompt, dataset and settings. Test typical, unusual and misleading inputs against an agreed baseline. Keep reproducible results and known limits.
工程及数据团队应固定模型、提示、数据集和设置的版本。以议定的基准测试典型、罕见及误导性输入，保存可重现的结果和已知限制。
Predeclare the test: purpose, dataset origin, expected answers, baseline, sample size, thresholds, critical failures, reviewer and retest date. Include language, disability and real operating conditions where relevant.
事先订明测试目的、数据集来源、预期答案、基准、样本量、门槛、关键失败情况、复核人及复测日期。视需要纳入语言、身心障碍及真实操作情境。
Security drill: send a harmless hostile instruction in a fictional attachment. Test a blocked export, denied permission, wrong recipient and unavailable supplier. Record what happened at each boundary.
信息安全演练：在虚构附件放入无害的模拟恶意指示。测试导出遭阻挡、权限被拒、收件人错误及供应商服务中断。在每个环节记录实际发生的情况。
A free or closed pilot can still harm a person. Screen before real data, set limits and enable meaningful review. Hold high-risk processing if a required impact assessment or prior consultation is incomplete.
免费或封闭试用同样可能伤害人。处理真实数据前先筛查、限定用途并建立有效的人工复核。所需影响评估或事前咨询未完成时，暂缓高风险处理。
Pilot protocol, DPIA decision and stop criteria
试点方案、DPIA 判断与停止条件
A DPIA examines how processing personal data could harm people and how to reduce that harm. The controller must do it before likely high-risk processing begins, including a pilot using real personal data.
DPIA 检视处理个人数据可能怎样伤害当事人，以及如何降低这些损害。若处理很可能构成高风险，控制者必须在开始前完成评估，包括使用真实个人数据的试行。
Seek the data protection officer’s advice where designated. Where appropriate seek affected people’s views. Record objections, accessibility needs, decisions and reasons for any justified departure.
如已指定数据保护官（DPO），应征询其意见。适当时也应征询受影响的人。记录异议、无障碍需求及决定，并说明有正当理由而未采纳意见的原因。
Decide whether high risk remains despite practical measures. If so, consult the competent authority before starting the processing under Article 36. Record correspondence and response. A founder’s signature cannot replace consultation.
判断采取可行措施后是否仍有高风险。如有，依第 36 条在开始处理前咨询主管机关。保存往来文件及回复。创始人签名无法取代必要的事前咨询。
Check human oversight: can the reviewer see the evidence, disagree, correct the result and stop the next action in time? Save one override trace. A second click alone proves little.
检查人工监督：复核人能否看到证据、提出异议、更正结果并及时叫停下一步？保留一条人工推翻结果的记录。多按一次确认键所能证明的很有限。
A polished demo can outrun the evidence. Test the exact public claim, check applicable disclosures and sector approvals, and name the person who can withhold release.
演示效果可能超出证据支持的范围。测试对外宣传的实际能力，核对适用的告知义务与行业批准，并指定有权阻止发布的人。
Claims-to-evidence table and dated release decision
宣传与证据对照表、附日期的发布决定
Check Article 50 by actor and output. Telling people they interact with AI, machine-readable marking and disclosing a deepfake are different duties with exceptions. Record which applies and the release-date evidence.
按行为者及输出类型核查第 50 条。告知对方正在与 AI 互动、加上机器可读标记，以及披露深度伪造内容，是不同的义务，且各有例外。记录何者适用，以及支持上线日期判断的证据。
Marketing, design and sales: substantiate claims, clear assets and check required disclosures. Save approved wording and versions. Escalate promises of exclusivity, ownership or guaranteed accuracy.
营销、设计与销售团队须为宣称提供证据、查清素材权利并检视必要披露。保存批准文案与版本。涉及专属权、所有权或准确率保证的承诺，应提交审查。
Release options: approve within stated limits, approve with controls already in force, hold pending evidence, or stop. Name unresolved issues, lawful scope, approver, effective date, expiry and rollback owner.
发布选项：在指定限制内批准、在所需控制措施已实施的条件下批准、暂缓以待证据，或停止。列出未决问题、合法范围、批准人、生效日、到期日及回退版本的负责人。
Complaints and changes in performance can reveal harm missed in testing. Give users a human route, test it, monitor errors by type and contain incidents promptly.
投诉和性能变化可能揭露测试遗漏的伤害。提供并实测人工求助渠道，分类监测错误，发生事件及时控制影响。
Monitoring log, incident owner and response record
监测记录、事件负责人及处置记录
After release: name an owner for errors, complaints, overrides, drift, security and costs. Specify sample, frequency, stop threshold and who can disable the workflow. Log changes and reapprove material ones.
上线后，为错误、申诉、人工推翻、模型表现漂移、信息安全及成本指定负责人。订明抽样、频率、停止门槛及谁能停用流程。记录变更，重大变更须重新批准。
Incident: stop unsafe actions, preserve restricted evidence, assess people affected, activate the manual route and record notification decisions. Test a clean restore and correction before reopening.
发生事故时，停止不安全操作，限制访问并保存证据，评估对相关人士的影响，启用人工流程并记录通知决定。重开前测试能否从干净版本复原及完成修正。
For UK/EU personal-data breaches, controllers notify the regulator unless risk to people’s rights is unlikely. Notify without undue delay and where feasible within 72 hours of awareness. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Processors notify controllers without undue delay.
对适用英国或欧盟数据保护规则的个人数据泄露事件，除非事件不太可能对个人权利造成风险，否则控制者须通知监管机构。应在无不当延迟的情况下通知，如可行，应在知悉后 72 小时内完成。如很可能造成高风险，须在无不当延迟的情况下告知当事人，但第 34 条规定的例外适用时除外。处理者须及时通知控制者，不得无故延迟。
Intake: keep a secure reference to the original words. Record first receipt, controller, jurisdiction, each right, owner, safe reply channel and accessibility or representative needs.
收件时，保存可安全对照请求原文的记录。记下首次收件时间、控制者、司法管辖区、各项权利、负责人、安全的回复渠道，以及无障碍或代理需求。
A new market, model, customer group or automated action can change the risk and legal role. Reassess the changed scope before switching it on.
新市场、模型、客群或自动操作都可能改变风险和法律角色。启用前重新评估变更范围。
Market and change register with fresh approval
市场与变更台账，附新批准
Check the intended purpose against Annexes I and III. Recruitment screening is a listed example. Document any claimed Article 6(3) exception and its conditions. Profiling people rules out that exception.
将预定用途与附件 I 和 III 对照。招聘筛选是列明的例子。若主张适用第 6(3) 条的例外，应记录理由及其条件。系统对个人进行画像时，不能适用该例外。
The revised dates for Chapter III sections 1–3, except Article 6(5), are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Other provisions have their own dates.
修订后，除第 6(5) 条外，第 III 章第 1–3 节对附件 III 系统的适用日期为 2027 年 12 月 2 日，对附件 I 系统则为 2028 年 8 月 2 日。其他规定各有适用日期。
UK significant solely automated decisions require an Articles 22A–22D review, including restrictions on special-category data and the recognised legitimate interests basis. In the EU start with Article 22 and its specific exceptions. Test real human power to reconsider.
在英国，对人产生重大影响且完全自动化的决定，须按第 22A–22D 条审查，包括对特殊类别数据及“获认可的正当利益”法律依据的限制。在欧盟，先查第 22 条及其特定例外。实测复核人是否真正有权重新考虑决定。
A buyer may acquire fewer rights than the pitch suggests. Separate deal-room disclosure, change of control and asset transfer. Resolve material consents and any required clearance before completion.
买方实际取得的权利可能少于路演所述。分别处理数据室披露、控制权变更及资产转让。交割前取得重要同意及必要批准。
Diligence index, exceptions, consents and closing conditions
尽调索引、例外、同意及交割条件
List the accountable organisation for each purpose. Who chooses why and how personal data are used? Who acts on instructions? Map each supplier’s own uses separately.
为每项用途列出应负责的机构。由谁决定为何以及如何使用个人数据？谁按指示处理？另行记录每家供应商为自身目的使用数据的情形。
For each risk write cause → event → harm to a person. Record likelihood, impact, affected group and evidence before controls. Name the control, tester, due date and risk remaining afterwards.
逐项写出“成因 → 事件 → 对人的损害”。记录实施控制措施前的可能性、影响、受影响群体及证据，再列出措施、测试者、期限及实施后的剩余风险。
Your decision record: workflow and version, permitted and excluded uses, evidence IDs, decision and reasons, dissent, restrictions, owner, reviewer, review date, signature and time. Keep the previous version.
在决策记录填上流程及版本、允许与排除的用途、证据编号、决定及理由、不同意见、限制、负责人、复核人、复核日期、签名及时间。保留前一版本。
Data, keys and obligations outlive a website. Assign a custodian, return or erase data as applicable, document lawful holds, revoke access and test that restored backups do not reactivate deleted records.
网站关闭后，数据、密钥和责任仍可能存在。指定保管人，按适用情形返还或删除数据，记录合法保留理由、撤销访问，并测试恢复备份不会重新启用已删除记录。
Decommissioning record, supplier evidence and remaining contact
停用记录、供应商处理凭证及后续联系人
Other rights: examine correction, erasure, restriction, portability, objection and human review separately. Record applicable conditions, exceptions, recipients to notify, and any lawful retention or dispute hold.
其他权利须分别检视，包括更正、删除、限制处理、数据可携带、反对及人工复核。记录适用条件、例外、须通知的接收者，以及法定保存或争议期间的保全要求。
Private filing: store completed forms, evidence and signatures with restricted access. Keep the public folder blank. Back up a versioned copy, keep an independently protected copy and test a restore. Set a retention period for each record.
内部存档：限制已填表单、证据及签名的访问。公开文件夹只保留空白模板。备份带有版本的副本，另存一份独立保护的副本，并实测还原。为各类记录设置保存期限。
Read the full UK and EU founder’s guide (EN)
可编辑工作手册 · Full English handbook (Word)
Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.