Use the stage that matches your next decision. A funding round is a planning milestone. Duties can start earlier, including when the first real record enters a pilot.
從眼前要做的決定開始。融資輪次方便安排工作；法律義務可能更早出現，例如第一次把真實紀錄放進試用系統。
A photograph and a face template used to identify someone are different. Record the Article 6 basis and, for special-category processing, the Article 9 condition. Consider health inferences, children, dependence on a carer, an unsafe address and client secrets separately. Restrict input and access, offer a human alternative and complete a required DPIA before using live records.
普通照片與用於識別身分的臉部特徵模板要分開判斷。處理個人資料須確定第 6 條依據；涉及特殊類別時，另須符合第 9 條條件。留意健康推斷、兒童、依賴照顧者的人、洩露後會危及安全的地址，以及客戶機密。限制輸入與存取，提供人工替代方案，在使用真實資料前完成依法所需的影響評估。
Stop the disclosure, preserve restricted evidence and record awareness time. A processor tells the controller without undue delay. A controller notifies the competent authority without undue delay and, where feasible, within 72 hours of awareness unless risk to people’s rights and freedoms is unlikely. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Record every personal data breach and the reasons for each decision.
制止洩露、限制證據存取，記下知悉時間。處理者知悉後須通知控制者，不得無故延誤。除非事件不太可能對人的權利與自由構成風險，控制者須通知主管機關，不得無故延誤，並在可行時於知悉後 72 小時內辦理。如可能造成高度風險，除第 34 條例外情形外，須儘速通知當事人，不得無故延誤。每宗個人資料侵害及各項決定理由均須記錄。
A useful idea can hide an unacceptable use. The founder names the decision, affected people and forbidden uses. Hold a live trial until a possible prohibition has been resolved.
好點子也可能包含不能接受的用途。創辦人要寫明系統協助甚麼決定、誰受影響及禁止用途。若可能涉及禁止行為，先釐清才做真實試驗。
One-page use case and manual alternative
一頁用途說明及人工替代方案
Walk through a single item from input to output. Which person can be affected, what could they lose, and who can change the outcome?
挑一筆資料，從輸入一路追蹤到輸出。誰可能受影響？可能失去甚麼？誰有權改變結果？
EU AI Act: do we build or market the system under our name, deploy it for work, or change its purpose? Check territorial scope, including where an output is used. Keep the reason for each role.
依《歐盟人工智慧法》判斷：我們是否以自身名義開發或推出系統、為業務而部署系統，或改變其用途？查核地域適用範圍，包括輸出在哪裡使用。記下判定各項角色的理由。
Screen prohibited practices before testing with people. For example, workplace emotion inference has a narrow medical or safety exception. Escalate any possible prohibition before further use.
在讓真人參與測試前，先排查是否涉及禁止行為。例如，工作場所的情緒推斷僅有範圍狹窄的醫療或安全例外。如用途可能受到禁止，應先提請審查，再決定能否繼續。
The company may not control code, data or designs made before incorporation. Trace each contribution and secure suitable rights before promising ownership to investors.
成立公司前寫的程式、取得的資料和設計，權利未必屬於公司。逐項追查貢獻者及合約，取得合適權利後才向投資人承諾擁有資產。
Contributor and rights schedule with signed evidence
貢獻者與權利表，附簽署證據
Working alone? Wear several hats and record which one you used. Get a qualified second view for unfamiliar or serious decisions. With 2–10 people, separate the maker from the checker. With 11–50, name leads and deputies. These are suggested working arrangements.
如果獨自工作，可以兼任不同角色，並記下每次以甚麼身分作出判斷。面對不熟悉或後果重大的決定，應另請具備相應資格的人士提供意見。2–10 人的團隊可將執行與查核分工；11–50 人則可指定各項工作的主要負責人及代理人。這些是建議的工作安排。
Compare doing nothing, a manual process and an AI-assisted process. Estimate time saved after checking, cost of errors, supplier fees and exit costs.
比較維持現狀、採用人工流程及採用 AI 輔助流程。估算扣除查核時間後可節省的工時、出錯成本、供應商費用及退出成本。
Permission to view material may not cover training, retrieval or customer resale. Match each use to a right and check vendor reuse, subcontractors, costs and exit before uploading real records.
可瀏覽素材未必可訓練、檢索或轉售給客戶。上傳真實紀錄前，逐項釐清用途權限、供應商再利用、分包、成本及退出安排。
Permission matrix and signed supplier decision
用途授權矩陣及已簽核的供應商決定
Trace one data item through collection, prompts, retrieval, model, output, logs, support and deletion. Name source, people, country, recipients, retention, backups and someone who can test deletion.
選一筆資料，追蹤其經歷收集、提示、檢索、模型處理、輸出、日誌、支援及刪除的過程。記下來源、涉及的人、國家、接收者、保存期限、備份，以及誰能測試刪除是否有效。
Supplier check: identify processors and subprocessors, training or reuse terms, support access, contract, incidents, return or deletion, change notice and exit. Save the dated terms and unresolved questions.
審查供應商時，確認處理者與次處理者、訓練或重用條款、支援人員的存取權、合約、事故安排、歸還或刪除、變更通知及退出安排。保存附日期的條款與未決問題。
Locate each restricted transfer. Record the applicable adequacy decision or safeguard, assessment and extra protections. Check EU SCCs and UK IDTA or Addendum separately. Revisit overseas support and onward transfers.
找出每項受限制的跨境傳輸。記錄適用的充分性決定或保障措施、評估及額外保護。分別查核歐盟標準合約條款（SCC）與英國國際資料傳輸協議（IDTA）或英國附錄。重新檢視境外支援及後續轉傳。
A model can leak another customer’s records or turn a document instruction into an action. Use synthetic test cases, separate tenants, limit permissions and test a manual override before connecting live systems.
模型可能洩漏其他客戶的紀錄，也可能把文件中的指令當作行動。先用合成資料，隔離客戶、限制權限，測試人工攔截，再接正式系統。
Versioned test results, access map and rollback test
有版本的測試結果、權限圖及復原測試
Engineering and data: freeze model, prompt, dataset and settings. Test typical, unusual and misleading inputs against an agreed baseline. Keep reproducible results and known limits.
工程及資料團隊應固定模型、提示、資料集和設定的版本。以議定的基準測試典型、罕見及誤導性輸入，保存可重現的結果和已知限制。
Predeclare the test: purpose, dataset origin, expected answers, baseline, sample size, thresholds, critical failures, reviewer and retest date. Include language, disability and real operating conditions where relevant.
事先訂明測試目的、資料集來源、預期答案、基準、樣本量、門檻、關鍵失敗情況、覆核人及複測日期。視需要納入語言、身心障礙及真實操作情境。
Security drill: send a harmless hostile instruction in a fictional attachment. Test a blocked export, denied permission, wrong recipient and unavailable supplier. Record what happened at each boundary.
資安演練：在虛構附件放入無害的模擬惡意指示。測試匯出遭阻擋、權限遭拒、收件人錯誤及供應商服務中斷。在每個環節記錄實際發生的情況。
A free or closed pilot can still harm a person. Screen before real data, set limits and enable meaningful review. Hold high-risk processing if a required impact assessment or prior consultation is incomplete.
免費或封閉試用同樣可能傷害人。使用真實資料前先篩查、限制用途並建立有效的人工覆核。所需的影響評估或事前諮詢未完成，應暫緩高風險處理。
Pilot protocol, DPIA decision and stop criteria
試點方案、DPIA 判斷及停止條件
A DPIA examines how processing personal data could harm people and how to reduce that harm. The controller must do it before likely high-risk processing begins, including a pilot using real personal data.
DPIA 檢視處理個人資料可能怎樣傷害當事人，以及如何減低這些損害。若處理很可能構成高風險，控制者必須在開始前完成評估，包括使用真實個人資料的試行。
Seek the data protection officer’s advice where designated. Where appropriate seek affected people’s views. Record objections, accessibility needs, decisions and reasons for any justified departure.
如已指定資料保護主任（DPO），應徵詢其意見。適當時也應徵詢受影響人士。記錄異議、無障礙需求及決定，並說明有正當理由而未採納意見的原因。
Decide whether high risk remains despite practical measures. If so, consult the competent authority before starting the processing under Article 36. Record correspondence and response. A founder’s signature cannot replace consultation.
判斷採取可行措施後是否仍有高風險。如有，依第 36 條在開始處理前諮詢主管機關。保存往來文件及回覆。創辦人簽名無法取代必要的事前諮詢。
Check human oversight: can the reviewer see the evidence, disagree, correct the result and stop the next action in time? Save one override trace. A second click alone proves little.
檢查人工監督：覆核人能否看到證據、提出異議、更正結果並及時叫停下一步？保留一筆人工推翻結果的紀錄。多按一次確認鍵所能證明的很有限。
A polished demo can outrun the evidence. Test the exact public claim, check applicable disclosures and sector approvals, and name the person who can withhold release.
漂亮的示範可能超出證據所能支持的範圍。測試對外宣稱的實際能力，確認適用的告知義務與行業批准，指定有權暫緩發布的人。
Claims-to-evidence table and dated release decision
宣稱與證據對照表、附日期的發布決定
Check Article 50 by actor and output. Telling people they interact with AI, machine-readable marking and disclosing a deepfake are different duties with exceptions. Record which applies and the release-date evidence.
按行為者及輸出類型查核第 50 條。告知對方正在與 AI 互動、加上機器可讀標記，以及揭露深度偽造內容，是不同的義務，且各有例外。記錄何者適用，以及支持上線日期判斷的證據。
Marketing, design and sales: substantiate claims, clear assets and check required disclosures. Save approved wording and versions. Escalate promises of exclusivity, ownership or guaranteed accuracy.
行銷、設計與銷售團隊須為宣稱提供證據、查清素材權利並檢視必要揭露。保存核准文案與版本。涉及專屬權、所有權或準確率保證的承諾，應提交審查。
Release options: approve within stated limits, approve with controls already in force, hold pending evidence, or stop. Name unresolved issues, lawful scope, approver, effective date, expiry and rollback owner.
發布選項：在指定限制內核准、在所需控制措施已實施的條件下核准、暫緩以待證據，或停止。列出未決問題、合法範圍、批准人、生效日、到期日及回復舊版的負責人。
Complaints and changes in performance can reveal harm missed in testing. Give users a human route, test it, monitor errors by type and contain incidents promptly.
投訴及表現改變可能揭露測試時漏掉的傷害。提供並實測人工求助渠道，按類別監察錯誤，發生事故立即控制影響。
Monitoring log, incident owner and response record
監察紀錄、事故負責人及應變紀錄
After release: name an owner for errors, complaints, overrides, drift, security and costs. Specify sample, frequency, stop threshold and who can disable the workflow. Log changes and reapprove material ones.
上線後，為錯誤、申訴、人工推翻、模型表現漂移、資安及成本指定負責人。訂明抽樣、頻率、停止門檻及誰能停用流程。記錄變更，重大變更須重新核准。
Incident: stop unsafe actions, preserve restricted evidence, assess people affected, activate the manual route and record notification decisions. Test a clean restore and correction before reopening.
發生事故時，停止不安全操作，限制存取並保存證據，評估對相關人士的影響，啟用人工流程並記錄通知決定。重開前測試能否從乾淨版本復原及完成修正。
For UK/EU personal-data breaches, controllers notify the regulator unless risk to people’s rights is unlikely. Notify without undue delay and where feasible within 72 hours of awareness. If high risk is likely, tell people without undue delay, subject to Article 34 exceptions. Processors notify controllers without undue delay.
發生英國或歐盟個人資料安全受侵害事故時，除非事故不太可能對當事人權利造成風險，否則控制者須通知監管機關。不得無故延誤，可行時應在知悉後 72 小時內通知。如很可能造成高風險，須在無不當延誤下通知當事人，但適用第 34 條例外者除外。處理者須在無不當延誤下通知控制者。
Intake: keep a secure reference to the original words. Record first receipt, controller, jurisdiction, each right, owner, safe reply channel and accessibility or representative needs.
收件時，保存可安全對照請求原文的紀錄。記下首次收件時間、控制者、司法管轄區、各項權利、負責人、安全回覆渠道，以及無障礙或代理需求。
A new market, model, customer group or automated action can change the risk and legal role. Reassess the changed scope before switching it on.
新市場、模型、客群或自動執行功能，都可能改變風險和法律角色。啟用前重新評估變更範圍。
Market and change register with fresh approval
市場與變更登記冊，附新批准
Check the intended purpose against Annexes I and III. Recruitment screening is a listed example. Document any claimed Article 6(3) exception and its conditions. Profiling people rules out that exception.
將預定用途與附件 I 及 III 對照。招聘篩選是列明的例子。若主張適用第 6(3) 條的例外，記錄理由及條件。若系統對自然人進行剖析，則不能適用該例外。
The revised dates for Chapter III sections 1–3, except Article 6(5), are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Other provisions have their own dates.
修訂後，除第 6(5) 條外，第 III 章第 1–3 節對附件 III 系統的適用日期為 2027 年 12 月 2 日，對附件 I 系統則為 2028 年 8 月 2 日。其他規定各有適用日期。
UK significant solely automated decisions require an Articles 22A–22D review, including restrictions on special-category data and the recognised legitimate interests basis. In the EU start with Article 22 and its specific exceptions. Test real human power to reconsider.
在英國，對人產生重大影響且完全自動化的決定，須按第 22A–22D 條審查，包括對特殊類別資料及「獲認可的正當利益」法律依據的限制。在歐盟，先查第 22 條及其特定例外。實測覆核人是否真正有權重新考慮決定。
A buyer may acquire fewer rights than the pitch suggests. Separate deal-room disclosure, change of control and asset transfer. Resolve material consents and any required clearance before completion.
買方實際取得的權利可能少於簡報所述。分開處理資料室披露、控制權變更及資產移轉。成交前解決重大同意事項及必要批准。
Diligence index, exceptions, consents and closing conditions
盡職調查索引、例外、同意及交割條件
List the accountable organisation for each purpose. Who chooses why and how personal data are used? Who acts on instructions? Map each supplier’s own uses separately.
為每項用途列出應負責的機構。由誰決定為何以及如何使用個人資料？誰按指示處理？另行記錄每家供應商為自身目的使用資料的情形。
For each risk write cause → event → harm to a person. Record likelihood, impact, affected group and evidence before controls. Name the control, tester, due date and risk remaining afterwards.
逐項寫出「成因 → 事件 → 對人的損害」。記錄實施控制措施前的可能性、影響、受影響群體及證據，再列出措施、測試者、期限及實施後的剩餘風險。
Your decision record: workflow and version, permitted and excluded uses, evidence IDs, decision and reasons, dissent, restrictions, owner, reviewer, review date, signature and time. Keep the previous version.
在決策紀錄填上流程及版本、允許與排除的用途、證據編號、決定及理由、不同意見、限制、負責人、覆核人、覆核日期、簽名及時間。保留前一版本。
Data, keys and obligations outlive a website. Assign a custodian, return or erase data as applicable, document lawful holds, revoke access and test that restored backups do not reactivate deleted records.
網站關閉後，資料、金鑰及責任仍可能存在。指定保管人，按適用情況返還或刪除資料，記錄合法保留理由、撤銷存取，並測試還原備份不會復活已刪紀錄。
Decommissioning record, supplier evidence and remaining contact
停用紀錄、供應商處置證據及後續聯絡人
Other rights: examine correction, erasure, restriction, portability, objection and human review separately. Record applicable conditions, exceptions, recipients to notify, and any lawful retention or dispute hold.
其他權利須分別檢視，包括更正、刪除、限制處理、資料可攜、反對及人工覆核。記錄適用條件、例外、須通知的接收者，以及法定保存或爭議期間的保全要求。
Private filing: store completed forms, evidence and signatures with restricted access. Keep the public folder blank. Back up a versioned copy, keep an independently protected copy and test a restore. Set a retention period for each record.
內部存檔：限制已填表單、證據及簽名的存取。公開資料夾只保留空白範本。備份帶有版本的副本，另存一份獨立保護的副本，並實測還原。為各類紀錄設定保存期限。
Read the full UK and EU founder’s guide (EN)
可編輯工作手冊 · Full English handbook (Word)
Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.