Articles
The ICO's agentic AI timetable moved. The design work remains. Future agentic AI guidance does not remove current design responsibilities. Define the processing purpose, permitted tool access and routes for people to challenge significant automated decisions, while tracking the ICO’s publication status. Check citation as well as publication of an AI Act standard Publication of a European standard and citation in the Official Journal are separate events. Check the applicable legal status and begin keeping the process records needed to assess a high-risk provider’s quality management system. Review transparency duties alongside the amended AI Act dates The 2026 amendments changed high-risk application dates without moving all transparency duties. Review Article 50 by system function, organisational role and applicable exceptions, alongside the intended-use classification. Not every AI system needs the same governance Match internal AI review to the consequences, scope and recovery paths of the use. Begin with consequence and reversibility, alongside legal classification and other material risks. Someone else's capital cycle is your renewal risk AI operating costs depend on supplier prices, capacity and the work a model must complete. Test the business case against plausible changes and price the options for switching before accepting the dependency. Publish evidence that readers and retrieval systems can use Clear, accessible and well-sourced publishing gives retrieval systems usable material. Improve those inputs for readers and automated access, while recognising that they cannot guarantee selection or citation. Where your training data came from is now a balance sheet question Data acquisition, training and publication can raise different rights questions. Record corpus provenance and assess supplier continuity, contract protection and output use against the relevant jurisdiction and facts. Establish the statistical baseline before you buy a GPU Compare a proposed model with a simple method and the existing process before committing budget. A fair evaluation shows whether the extra capability earns its cost and which limits come from the data or workflow. Read the benchmark weights before procuring the model A composite model score reflects its selected tasks and weights. Use the Intelligence Index v4.1 as a worked example of why procurement still needs evaluation against the buyer’s workload, costs and failure conditions. Who is the provider? The question that decides your obligations Determine the organisation’s AI Act role from the system, intended use and changes it makes. Branding, substantial modification or a new high-risk purpose can require reassessment, with the applicable conditions checked by legal advisers. Two governance blocs, one supplier list International AI initiatives do not create one uniform rulebook. Record where a service operates, whom it serves and which obligations apply, then review supplier evidence and portability against that deployment. Prepare for the ICO code against current duties The ICO is required to prepare a statutory AI and automated decision-making code. Existing data-protection duties continue while it is developed. Assess live systems now and distinguish current obligations from anticipated guidance.
Bring us the question
Something here already on your desk?
That is the conversation we are best at. Thirty minutes, a written summary, no obligation.