Focus areas

• Classify each AI system as prohibited, high-risk, limited-risk, GPAI, or lower-risk use.
• Identify whether the organization is a provider, deployer, importer, distributor, or product manufacturer.
• Check GDPR lawful basis, DPIA triggers, data minimization, retention, transfer, and data subject rights.
• Prepare evidence for human oversight, accuracy, cybersecurity, logging, transparency, and post-market monitoring.

Practical checkpoint

For every AI use case, keep an inventory entry, risk classification, privacy screening, vendor review, control list, owner, and review date. High-risk or employment-related systems need stronger evidence before use.

Focus areas

• Use the ICO AI and data protection guidance for personal data, explainability, fairness, accuracy, and DPIA work.
• Apply AI assurance thinking: define the claim, gather evidence, test controls, and keep records.
• Watch sector regulators where AI affects finance, health, employment, education, consumer outcomes, or safety.
• Give staff usable AI rules before deploying generative AI tools across the business.

Practical checkpoint

Treat the UK as evidence-led governance: explain why the use is appropriate, how risks were tested, who reviews outputs, and how individuals can challenge meaningful decisions.

Focus areas

• Use NIST AI RMF as the baseline operating model: Govern, Map, Measure, and Manage.
• Watch state-level AI and privacy laws, especially for hiring, profiling, automated decisions, and consumer disclosures.
• For federal customers, monitor procurement and agency AI governance expectations.
• Document accuracy, discrimination testing, security, data provenance, vendor terms, and human review.

Practical checkpoint

US governance is fragmented. A good internal record should show that the company identified the affected people, tested foreseeable harms, assigned ownership, and can explain how the system is controlled.

Focus areas

• Check legal authority, consent, necessity, proportionality, transparency, safeguards, retention, and accountability.
• Use privacy impact assessments or algorithmic impact assessments for higher-impact processing.
• Be cautious with prompts, logs, model training, sensitive data, children, and automated decisions about people.
• Track federal and provincial developments because privacy and human rights issues may arise outside one statute.

Practical checkpoint

For generative AI, document why the use is necessary, whether personal information is involved, what the vendor does with prompts and logs, and how individuals can seek human review.

Focus areas

• Use the Voluntary AI Safety Standard guardrails as a practical control checklist.
• Assess high-risk settings, including employment, health, finance, safety, biometrics, children, and vulnerable groups.
• Connect AI governance with privacy, cybersecurity, procurement, incident response, and staff training.
• Keep review evidence for model performance, data quality, bias, security, explainability, and user communication.

Practical checkpoint

Start with an AI inventory and a responsible owner. Then map each use case to data, user impact, vendor dependency, human oversight, testing, incident response, and review cadence.

Focus areas

• ISO/IEC 42001 for AI management systems and accountable operating processes.
• NIST AI RMF for risk mapping, measurement, management, and governance.
• OECD AI principles and G7 Hiroshima Process for high-level responsible AI alignment.
• OWASP guidance for LLM application security, prompt injection, data leakage, and agentic risks.

Practical checkpoint

Use frameworks to design your governance system, then localize the legal questions by market. The same inventory can support EU AI Act review, GDPR screening, NIST alignment, vendor review, and monitoring.