UK business and governance5 May 202613 min read
UK GDPR and AI, the three ICO-flagged risks every SMB ignores until they’re audited
The Information Commissioner's Office has been flagging the same three AI-and-data-protection risks for two years, and most UK small and mid-sized businesses still treat them as a future problem. After 120 AI projects across 15 industries, the pattern is depressingly consistent. The audit arrives, the risks were known, and the remediation cost is three times what a 30-person firm would have spent fixing them in advance. Here are the three risks, the four-step audit any SMB can run this month, and the FAQ on what counts and what doesn't.
UK business and governance5 May 202611 min read
The 1-page UK AI policy template that keeps the ICO off your back
Most UK AI policy templates are eight pages of legalese nobody reads. After 120+ AI projects across 15+ industries, I've watched companies fail audits because the policy lived in a SharePoint folder no employee opened. This is the 1-page version that actually works. It anchors in ICO guidance and UK GDPR, covers scope, prohibited uses, data classes, human oversight, vendor approval and incident reporting. You get the working template, the clauses to copy, and the four ICO principles every policy needs to reference.
