AI Governance
We map your AI tool stack, identify lawful basis for every data process, and give you a documented governance framework your board can stand behind.
EU AI Act & ICO ComplianceYou’re using AI in your business.
That makes you responsible for every piece of data it touches.
Most UK companies using AI tools are processing personal data without a lawful basis, without a record, and without telling their clients. That's not a gap in best practice. That's an ICO investigation.
Not ready to book? Take the AI Compliance Checklist — 12 questions that tell you exactly where your exposure is. Free, no email required.
ICO Registered
C1893446
256-bit Encrypted
Client data secured
Six Sigma Qualified
Process excellence
LLM — Durham University
International commercial law
UK GDPR Compliant
Data Protection Act 2018
EORI Registered
GB046800133000
What We Do
Three ways we make your AI use legally sound
Fixed-fee engagements. No hourly billing. No surprises. Every scope is agreed upfront.
Data Protection
GDPR compliance end to end. Privacy notices, data processing records, third-party vendor reviews, and ICO registration handled properly so you're not exposed.
UK GDPR / PECR / ICORegulatory Strategy
Contract audits, AI clause drafting, and a forward-looking strategy that anticipates regulatory change so you don't have to rebuild your compliance every 18 months.
Contracts / Strategy / Risk
Results
Work that made a difference
Real outcomes for UK businesses operating in regulated environments.
NHS Supply Chain Partner
A digital health supplier was using three AI tools to process patient-adjacent data without documented lawful basis or a DPIA. An ICO inquiry was 30 days away. We mapped every data flow, established lawful basis under Article 9, produced a compliant DPIA and updated all supplier agreements within three weeks.
Discuss a similar situationDigital Marketing Agency
A 12-person agency was passing client data to four AI platforms under clauses that gave those platforms broad rights to use data for model training. Their client contracts said nothing about this. We rewrote the DPA, inserted appropriate AI restrictions into client contracts, and gave them a vendor assessment process they could repeat independently.
Discuss a similar situationE-commerce Founder
A solo founder using AI-powered personalisation and email automation had no privacy notice covering AI processing, no record of processing activities, and was sending marketing to contacts who had never given explicit consent. We produced compliant documentation, a lawful basis audit, and a consent capture process that converted above industry average.
Discuss a similar situation
What founders say
"We had an ICO inquiry lined up. Naz mapped every data flow, established lawful basis, and produced a compliant DPIA in three weeks. No enforcement action."
ICO-ready in 21 days"Four of our AI vendors had model training clauses we had no idea about. Our client contracts said nothing. Naz fixed both sides. Client trust is intact."
All vendor DPAs renegotiated"Zero compliant processes on the audit. Full ROPA, privacy notice, lawful basis framework, and ICO registration update — delivered in 10 days. No tradeoff with conversions."
Fully documented in 10 days
Insights
What you need to know right now
Practical UK compliance guidance for founders using AI tools in their businesses.
AI Governance
AI in your business: what you're actually responsible for
If your business uses any AI tool that touches personal data, you have obligations under UK GDPR that most founders have never been told about.
Read article UK GDPRThe six lawful bases explained — and which one your AI process actually uses
Legitimate interest is not a free pass. Most AI use cases require either consent or contract. Here is how to tell the difference.
Read article EU AI ActThe EU AI Act is in force. Here is what UK businesses actually have to do
Despite Brexit, UK companies with EU customers, partners or data flows have real exposure. This is a plain-English breakdown of what applies to you.
Read articleReady to know where you stand?
Book a free 30-minute clarity session. No sales pitch. A direct conversation about your actual exposure and what fixing it involves.