What data may be used?
A short classification: public, internal, personal, special category. Each class has a rule about which tools and suppliers may process it, and where it may be stored.
AI governance
AI governance for companies without a compliance department
You do not need a sixty-page framework. You need to know what data may go where, who approves what, and how you would prove it if a client, insurer or auditor asked.
AI governance has a reputation problem. It is sold as a large document produced by a consultant, filed, and never read. For a business with fifteen or fifty people, that is worse than useless: it creates an illusion of control without changing what anyone does on a Tuesday.
We write governance that fits on a few pages and is enforced by the workflow itself. If a document says customer data may not leave the UK, the integration should make that true rather than rely on people remembering. The policy explains the rule; the build enforces it; the log proves it.
The four questions
What a usable policy answers
Who is accountable?
A named owner for each AI-assisted workflow, and a named approver for consequential actions. Not a committee — a person whose job it is.
What must a human decide?
A written list of decisions that cannot be delegated: anything affecting a customer's money, legal position, employment or safety. Everything else can be assisted.
How would we prove it?
The records you would produce in a dispute: the workflow description, the supplier terms, the approval log, and the measurement that shows the system behaved as described.
Scope
What the engagement covers
- Supplier reviewWhat each AI provider does with your data, where it is processed, and what the contract actually says.
- Data boundary mapWhich systems hold personal data, which may be sent to a model, and which must never leave.
- Human approval designApproval points written into the workflow, with a named role and a fallback.
- Logging and retentionWhat is recorded, for how long, who can read it, and how it is deleted.
- Incident procedureWhat to do when an agent does something wrong — who is told, what is stopped, what is recorded.
- A one-page staff guideWhat the team may and may not do with AI tools, in language they will actually read.
An honest limit
An honest limit
- Talk to usWe are engineers, not lawyers. We build the controls and write the operational policy; your solicitor or DPO signs off the legal position. We will tell you when that step is needed.
- Read our privacy pageHow this site handles data, and the standards we apply to our own business.
Questions
The things people ask first
Does the UK GDPR apply to AI?
Yes, where personal data is involved. The model does not create an exemption. The questions are the usual ones — lawful basis, minimisation, retention, supplier terms and the rights of the person — applied to a new processing step.
Do we need an AI policy if we only use ChatGPT?
If staff paste client information into a public tool, yes. A short policy and a sanctioned alternative solve most of the risk in an afternoon. The alternative is discovering the problem during a client audit.
Is the EU AI Act relevant to a UK business?
It can be, if you place AI systems on the EU market or your customers require compliance contractually. For most UK SMEs the immediate obligations are UK GDPR and their own client contracts. We will flag where the Act is likely to bite.
Will this slow us down?
The point is to make the safe path the easy path. A sanctioned tool with the right settings is faster than a shadow tool nobody can audit. If a control adds friction without reducing risk, we remove it.
Related
Let’s find out whether technology is the answer
Tell us what you are trying to achieve. We will tell you honestly whether we can help, what it would take, and roughly what it would cost — before anyone signs anything.