Understand AI.
No technical background needed.

1. Decide who you are for each data flow. You are a controller when you decide why and how personal data is used (your own customer records, analytics, marketing) and a processor when you handle data only on a customer's instructions (their users inside your SaaS). Most B2B software companies are both, and the duties differ: Article 28 contracts for processors, the full accountability set for controllers.
2. Place every AI feature in the AI Act's tiers. Regulation (EU) 2024/1689 prohibits a short list of practices (Article 5, applied since 2 February 2025), regulates high-risk systems (Annex III uses such as recruitment, credit scoring, education and essential services, duties from 2 December 2027; Annex I safety components from 2 August 2028), imposes transparency duties on chatbots and synthetic content (Article 50, since 2 August 2026) and leaves the rest to voluntary codes.
3. Provider or deployer? If you develop the system, or put your name on it, you are the provider and carry the conformity work. If you use someone else's system in your product, you are a deployer, with lighter duties (instructions of use, human oversight, logs). Fine-tuning or substantially modifying a system can make you the provider (Article 25). The Act applies to companies outside the EU whose output is used in the EU (Article 2).
4. If you build or fine-tune a general-purpose model, Chapter V applies: technical documentation, a training-content summary and a copyright policy for every GPAI provider (Article 53), and systemic-risk duties above 10²⁵ FLOPs (Article 55). Models already on the market before 2 August 2025 have until 2 August 2027.
5. Write the inventory down. One register, one row per system: purpose, data, role, tier, owner, review date. The ICO's AI and data protection guidance and the Commission's Navigating the AI Act pages are the two reference points.

Toto-Rex's note: a feature that quietly ranks, scores or filters people is where the legal weight sits. Find those first; the rest is bookkeeping.

1. Pick a lawful basis before you write the code. Article 6 gives six; the Data (Use and Access) Act 2025 added a seventh for the UK, recognised legitimate interests (Article 6(1)(ea), in force 5 February 2026), for listed purposes such as security and safeguarding. Consent is the weakest basis for a product that must keep working when the user withdraws it. Legitimate interests needs a written balancing test; keep it.
2. Training data is processing. Scraping, fine-tuning on customer data and keeping prompts all need a basis and a notice. The Italian authority's €15m decision against OpenAI in December 2024 turned on exactly this: no proper basis for training, no adequate notice, no age checks.
3. Special category data (health, biometrics, race, beliefs) needs an Article 9 condition as well. The AI Act now lets providers process it for bias detection in strictly limited circumstances (new Article 4a, inserted by the Digital Omnibus, Regulation (EU) 2026/1744); that is a permission, not a duty.
4. Design it in (Article 25): collect the minimum, set retention in code, pseudonymise where you can, default to private, and make deletion actually delete, including from backups and from vector stores or caches that hold user content.
5. Keep the Article 30 record of processing and the Article 13 and 14 notices in step with the product. Every new feature that touches personal data updates both. The ICO's small-organisation hub has templates that are good enough to start.

Toto-Rex's note: "we anonymise it" is a claim you will be asked to prove. If a row can be linked back to a person with data you hold, it is pseudonymised, and the law still applies.

1. Discovery: screen. A one-page screening answers whether a DPIA is required. It is mandatory under Article 35 for systematic profiling with legal or similar effects, large-scale special category data and systematic public monitoring, and the ICO's list adds innovative technology, denial of service decisions and tracking. Most AI products trigger at least one.
2. Design: do the DPIA properly. Describe the processing, assess necessity and proportionality, identify risks to people (not to the company), choose mitigations, record residual risk. If high residual risk remains, you must consult the ICO before processing (Article 36). For an Annex III system, the provider's risk management system (AI Act Article 9) is built at the same stage, as is the fundamental rights impact assessment (Article 27) owed by deployers that are public bodies, provide public services, or use credit-scoring or life and health insurance pricing systems.
3. Build: produce the evidence. Data governance for training, validation and test sets (Article 10), technical documentation (Article 11, with a simplified SME template promised by the Omnibus), automatic logging (Article 12), accuracy, robustness and cybersecurity (Article 15), and human oversight that a person can actually exercise (Article 14).
4. Launch: conformity, registration, marking. High-risk providers run the conformity assessment (Article 43), draw up the EU declaration (Article 47), affix the CE marking (Article 48) and register in the EU database (Article 49) before placing the system on the market. Most Annex III systems self-assess; biometric systems need a notified body.
5. Operate: monitor and report. Post-market monitoring (Article 72); serious incidents reported to the market surveillance authority, within 15 days as a rule and 2 days for widespread infringements (Article 73); keep logs for at least six months (Article 19). Re-run the DPIA on any material change: new data source, new model, new purpose, new country.

Toto-Rex's note: a DPIA written after launch is a confession with a date on it. Start the document on day one and let it grow with the product.

1. Say what the AI does to people. Privacy notices must disclose automated decision-making and profiling, the logic involved and the consequences (Articles 13(2)(f) and 14(2)(g)). A notice that never mentions the model is out of date the day the model ships.
2. Automated decisions in the UK changed on 5 February 2026. DUAA section 80 replaced UK GDPR Article 22 with Articles 22A–22D; commencement preserves specified earlier decisions. Significant decisions based solely on automated processing require Article 22C safeguards: information, representations, human intervention and a way to contest. Article 22B sets conditions for special-category processing; Article 22B(4) separately prohibits such decisions where processing relies even partly on Article 6(1)(ea), recognised legitimate interests. Other data-protection duties still apply. Assess EU Article 22 separately where relevant.
3. Article 50 of the AI Act applies since 2 August 2026. Chatbots must disclose that the user is talking to a machine; synthetic audio, image, video and text must be marked machine-readable by the provider; deepfakes must be labelled by the deployer. Systems already on the market before 2 August 2026 have until 2 December 2026 for the marking duty. The Commission's guidelines and Code of Practice explain the technical standard.
4. AI literacy under amended Article 4 requires in-scope providers and deployers to take measures supporting AI-literacy development for staff and others operating AI on their behalf, considering their knowledge, experience, education, training, use context and affected people. It does not require guaranteeing a particular individual level. As a practical step, record the measures and review learning needs when the system or use changes.
5. Marketing claims are regulated too. Under the Digital Markets, Competition and Consumers Act 2024 the CMA can fine up to 10% of turnover for unfair commercial practices without going to court (in force 6 April 2025). "AI-powered", "99% accurate" and "GDPR compliant" are claims you must be able to substantiate.

Toto-Rex's note: the disclosure most products forget is the simplest: "this reply was generated by software." Put it where the eye lands, not in clause 14.3.

1. Security appropriate to the risk (Article 32): encryption in transit and at rest, access control, logging, tested backups, and for AI products the specific failure modes: prompt injection, training-data extraction, model theft. The NCSC publishes practical guidance, including on agentic AI.
2. Breaches: 72 hours to the ICO (Article 33), without undue delay to the people affected where the risk is high (Article 34). Capita's £14m penalty (October 2025) and 23andMe's £2.31m (June 2025) both followed attacks on companies that could not show the basics were in place. Write the incident runbook before you need it.
3. If you sell software with digital elements into the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847) applies: actively exploited vulnerabilities and severe incidents must be reported to ENISA and the national CSIRT from 11 September 2026 (early warning within 24 hours); the full secure-by-design and CE-marking duties apply from 11 December 2027.
4. Software is now a product. The revised Product Liability Directive (Directive (EU) 2024/2853) treats software, including AI, as a product; strict liability for defects, with disclosure duties and presumptions that help claimants. Member States apply it to products placed on the market from 9 December 2026.
5. Operators of essential or important entities fall under NIS2 in the EU (Directive (EU) 2022/2555) and, in the UK, the Network and Information Systems Regulations 2018 as they stand until the Cyber Security and Resilience Bill passes. If your customers are in those sectors, their obligations arrive in your contract.

Toto-Rex's note: the first 72 hours after a breach are spent finding out what you hold and where. A current data map turns that into an afternoon.

1. Every processor needs an Article 28 contract: documented instructions, confidentiality, security, sub-processor approval, assistance with rights and breaches, deletion or return at the end, audit rights. Your cloud, your analytics, your model API and your support desk are all processors.
2. Transfers outside the UK or EU need a mechanism. UK: the IDTA or the Addendum to the EU standard contractual clauses, or an adequacy regulation; EU: the 2021 SCCs with a transfer risk assessment. The EU–US Data Privacy Framework and its UK Extension cover certified US companies; the EU–UK adequacy decision was renewed on 19 December 2025 to 27 December 2031. Meta's €1.2bn and TikTok's €530m fines were transfer cases.
3. Read the model provider's terms for three things: whether your prompts and outputs are used for training (and how to opt out), where the data is processed, and what the provider gives you to meet your own duties (the AI Act's Article 53 documentation for downstream providers, security statements, incident notice).
4. Copyright and training data. GPAI providers must publish a training-content summary and respect rights reservations (Article 53); text-and-data-mining exceptions differ between the EU (Directive 2019/790, Articles 3 and 4) and the UK, where the exception is limited to non-commercial research. If you train on scraped content, take advice before you ship.
5. Flow the duties down and up. Your customer contract should state your role, the sub-processors you use, your security commitments and the AI Act information you provide as a provider or need as a deployer. Keep the list of sub-processors public and versioned.

Toto-Rex's note: "the API provider handles compliance" is the sentence that precedes most fines. The provider handles its own duties; yours stay with you.

Find legal help for an AI decision: which expert, where to check them (55 official routes, 35 places), and a first-meeting card →
Founder's AI compliance file: what to decide and what to keep at every stage, from idea to exit →
Build and run AI with safeguards: cloud, APIs, retrieval, training, red-team and A/B tests, launch →