Insights
Field notes on AI strategy, governance, and execution.
Editorial note: Research and drafting are AI-assisted. Methodology claims, regulatory citations, and recommendations are grounded in documented research — every article includes specific source references. Daniela Piskackova — Co-founder & AI Audit Lead — is the research methodology guarantor behind our work. This transparency matches who we are: an AI-native company.
Cornerstone
AI SEO Services: What to Check Before Paying an Agency
Before buying AI SEO services, ask for tested questions, saved answers, source evidence, realistic estimates and a clear line between an audit and ongoing work.
AI visibility tool guide: what each measure really shows
Compare AI visibility tools by the event they count: Bing citations, Google AI impressions, Search clicks, ChatGPT referrals and URL inspection results.
What Is AI Watermarking Under the EU Act for US Firms?
AI watermarking under the EU AI Act: which existing US systems must mark synthetic output by 2 December 2026, what marking means, and which duties start sooner.
GDPR Article 27: when a US company needs an EU representative
Assess whether GDPR Article 27 requires your US company to appoint an EU representative, test the narrow exemption, and document the representative's role.
What Is a National Competent Authority Under the AI Act?
A plain guide to national competent authorities under the EU AI Act: who supervises, who notifies, where to find a contact and when to ask for advice.
Using AI for SEO: What Helps a Small Business Get Found?
Use AI for SEO research and editing while keeping original value. Check search eligibility, show evidence, avoid scaled content abuse and measure results.
GEO Audit Checklist: What to Check on Your Site, Step by Step
Use this GEO audit checklist to inspect access, page evidence, structured data, and AI impressions, then turn each finding into a fix with an owner.
What Is an AI Visibility Audit? Vendor Checks Explained
Learn what an AI visibility audit can verify across Google, ChatGPT and Bing: crawler access, snippet rules, citations, referrals and the limits of each metric.
ICO guidance on AI and data protection for UK firms
ICO guidance on AI and data protection asks UK firms to map data uses, choose lawful bases, assess DPIA risk, explain decisions and document vendor roles.
Law enforcement authority in the EU AI Act: who counts?
See who qualifies as a law enforcement authority under Article 3(45) of the EU AI Act, including entrusted bodies, and where the definition affects AI duties.
Standard contractual clauses: when do you use them?
Decide when EU standard contractual clauses are needed, choose the correct transfer module, assess Clause 14 and complete the annexes before signing.
AI inference: what happens and what each answer costs
AI inference is the work of producing an answer with a trained model. Learn how tokens, settings, retries and completed tasks affect the bill you actually pay.
Fundamental rights impact assessment: who must do one?
A fundamental rights impact assessment checks how covered high-risk AI may affect people. See who must assess, what to cover and when to notify an authority.
ICO registration: who pays the 2026 data protection fee?
ICO registration in 2026: check whether your UK business owes the data protection fee, which activities may be exempt, how tiers work, and when to renew.
Subject access request time limit under UK GDPR: DUAA
Calculate a UK subject access request time limit after the DUAA: when one month begins, when clarification pauses it, when it resumes, and when it extends.
Automated decision making GDPR: UK rules after DUAA
Automated decision making under the UK GDPR changed after the DUAA. Test significant decisions, lawful bases, special category data and human challenge routes.
ICO fines in 2026: recent UK cases and how amounts are set
Compare recent UK ICO fines for a water utility and unlawful marketing texts, then follow the five steps used to calculate a data protection penalty.
Data Subject Rights: How to Handle Every GDPR Request
Data subject rights explained: one-month deadlines, access copies, erasure, portability, marketing objections, refusals and a practical request log.
GDPR Certified? What GDPR and AI Act Claims Really Prove
GDPR certified and AI Act certification claims explained: scope, approval, three-year validity, continuing responsibility, conformity and CE marking.
Is a Name Personal Data? Certificates and Lists Explained
Is a name personal data? Use identity, context, content and filing tests for certificates, attendance sheets and paper lists under data protection law.
Outsourced DPO or In-House DPO: A UK Decision Guide
Outsourced DPO or in-house DPO? Test the legal trigger, expertise, independence, conflicts, resources and practical access for a UK company.
DPO's Duties: Does Your UK Company Actually Need a DPO?
DPO's duties under UK GDPR: the three appointment triggers, core tasks, independence, conflicts and the record needed when no DPO is appointed.
EU AI Act Risk Categories: Four Practical Tiers Explained
EU AI Act risk categories explained for small firms: prohibited practices, high-risk systems, transparency duties, other uses and classification steps.
GDPR Fines Explained: Amounts, Tiers and How They Are Set
GDPR fines have two statutory ceilings, but the final amount depends on the infringement, turnover and the authority's case-by-case assessment.
What Is an API and Why Does AI Integration Need One?
What is an API? Learn how machine-to-machine connections supply AI models, move data between systems and shape practical integration choices.
Cookie compliance: what a UK banner must do in 2026
Cookie compliance under PECR changed on 5 February 2026. Learn which cookies need consent, what the banner must offer and what evidence to retain.
What Is a Data Protection Impact Assessment (DPIA)?
A data protection impact assessment identifies and reduces high risks before processing starts. Learn its triggers, contents, review and consultation rules.
GDPR for WordPress: Plugins, Forms and Analytics in the UK
GDPR for WordPress means mapping data, fixing forms and notices, controlling cookies, checking processors and transfers, and maintaining site security.
Special category data: what counts and extra rules
Special category data is protected by Article 9 GDPR. Learn which data qualifies, when processing is permitted and which extra safeguards apply.
Does ChatGPT Recommend My Business? How to Measure It
Learn what a ChatGPT business recommendation means, why one answer proves little, and how to measure mentions, competitors and sources reliably.
How to Check If AI Mentions Your Brand Reliably in Practice
Learn how to check if AI mentions your brand with real buyer questions, repeated runs, captured sources and a defensible before-and-after method.
What Is Generative Engine Optimisation? A Plain Guide
Learn what generative engine optimisation means, how GEO differs from SEO, which visibility levers research supports and what it cannot guarantee.
Why AI Recommends Your Competitor Instead of Your Brand
See why AI recommends your competitor through relevance, prominence, source coverage and freshness, then diagnose the measured gap without guessing.
Can I Email Businesses Without Consent in the UK? Send or Hold
Can I email businesses without consent in the UK? See which subscribers qualify, when consent or soft opt-in is needed, and the checks to record before sending.
CCTV Monitoring Employees: UK Law and Practical Steps
CCTV monitoring employees under UK law: define the purpose, assess necessity, complete any required DPIA, inform workers and control footage and access.
Controller or Processor? A Practical EU Activity Test
Use a per-activity test to decide controller, processor or joint control, then choose the right GDPR agreement and record the reasons clearly.
Cookie Banner Requirements for UK Small Businesses
Cookie banner requirements for UK small businesses: classify cookies, block consent-required scripts, obtain real consent and test reject and withdrawal paths.
Data Processing Agreement Guide for EU Small Businesses
A practical data processing agreement for an EU small business: map the service, compare terms, use the free Commission clauses, complete annexes and test it.
Do I Have to Delete Data from Backups Under the GDPR?
Do I have to delete data from backups? Apply Article 17, separate active and recovery copies, control restores, and retain evidence for each decision.
Data Protection Officer Requirements: When Is a DPO Mandatory?
Data protection officer requirements use three GDPR tests and national law. Decide whether to appoint a DPO, then document and revisit the outcome.
Do You Need a Data Protection Officer? UK Rules Explained
Do you need a data protection officer? Apply the UK GDPR tests, compare business examples, and record a defensible answer for either outcome.
Does GDPR Apply Outside the EU? The Article 3 Test
Does GDPR apply outside the EU? Test EU establishment, targeted offers and monitoring, then decide whether an Article 27 representative is required.
Does UK GDPR Apply if Customers Are Outside the UK?
Does UK GDPR apply if customers are outside the UK? Test establishment and targeting, then assess representatives, transfers and any parallel EU GDPR scope.
GDPR Templates for Small Businesses: The Honest Minimum
GDPR templates small business teams can use: six living core records, conditional overlays, free EU clauses, and a practical test for generic packs.
How Long to Keep Personal Data in the UK: A Practical Guide
How long to keep personal data in the UK: identify the legal driver, set defensible retention periods, manage backups and delete records in practice.
How Long to Keep Personal Data Under EU GDPR: A Practical Guide
How long to keep personal data under EU GDPR: identify each legal driver, set defensible retention periods, manage backups and delete records in practice.
How to Calculate AI Payback for a Small-Business Project
Learn how to calculate AI payback with a clear cost register, measured monthly savings, a simple formula and honest no-go checks for small teams.
Is Business Contact Data Personal Data? An EU Field Test
Is business contact data personal data? Classify named work details, generic inboxes and business forms, then separate GDPR duties from marketing rules.
Is GDPR Really a Problem for a Small Business in the UK?
Is GDPR really a problem for small business? See what 99 recent ICO actions show, what usually goes wrong, and which minimum UK controls matter in practice.
Is This a Reportable Data Breach in the UK? Decide Fast
Is this a reportable data breach in the UK? Start the 72-hour clock at awareness, assess risk, record the decision and notify people if high risk.
Is This a Reportable Data Breach Under EU GDPR? A Decision Guide
Is this a reportable data breach? Start the 72-hour clock at awareness, assess risk, document the decision and notify the competent authority when required.
Legitimate Interests vs Consent in the UK: How to Choose
Legitimate interests vs consent in the UK: use the purpose, necessity and balancing tests, check PECR, and record why the chosen lawful basis fits.
Legitimate Interests vs Consent Under EU GDPR: How to Choose
Legitimate interests vs consent under EU GDPR: apply purpose, necessity and balancing tests, check ePrivacy rules, and record why the chosen basis fits.
GDPR Records of Processing Activities: Article 30 Guide
GDPR records of processing activities must follow Article 30 role-specific fields. Build a living record and test the narrow under-250 exception.
Records of Processing Activities: UK Article 30 Guide
Learn which records of processing activities UK GDPR Article 30 requires, what each record must contain, and how to build and maintain yours.
UK GDPR Small Business Guide: What to Do First in 2026
A practical UK GDPR small business guide: map personal data, choose lawful bases, write usable records, handle rights, secure data and review the system.
What Is a Lawful Basis? Seven UK GDPR Routes Explained
What is a lawful basis under UK GDPR? Compare all seven routes, avoid treating consent as the default, and record the basis that fits each purpose.
What Is a Lawful Basis? Six EU GDPR Routes Explained
What is a lawful basis under EU GDPR? Compare all six routes, avoid treating consent as the default, and record the basis that fits each purpose.
What Is a Personal Data Breach? EU GDPR Explained Clearly
What is a personal data breach under EU GDPR? Recognise confidentiality, integrity and availability failures, then take the right first-hour steps.
What Is a Subject Access Request? The UK GDPR Rules Explained
What is a subject access request under UK GDPR? Recognise one without magic words, start the one-month clock, search properly and respond lawfully.
What Is a Subject Access Request? An EU GDPR Guide
What is a subject access request under EU GDPR? Recognise one without magic words, start the one-month clock, search completely and respond lawfully.
What Must a Privacy Notice Say Under the EU GDPR Rules?
What must a privacy notice say? Compare Articles 13 and 14 GDPR, check every required field, fix timing, and retain practical evidence of delivery.
When Is a DPIA Required? The EU GDPR Article 35 Test
When is a DPIA required? Apply Article 35's mandatory cases, the WP248 risk criteria and your authority's list, then record a reasoned decision.
In-House AI Lead vs Consultancy vs Audit: How to Choose
In-house AI lead vs consultancy vs a productised audit, compared on cost, speed and who ends up owning the work, with the case each route genuinely wins.
What Is an AI Foundation Audit? A Plain Definition
What is an AI Foundation Audit? A productised opportunity assessment that scores every process on ROI, suitability and risk, then ranks your top three.
Build vs Buy AI for Small Business: Which Path Fits Your Firm?
Build vs buy AI for a small business: what each path costs in time, talent and control, when building is justified, and why most firms should buy first.
AI Literacy Under Article 4: The EU AI Act Duty in Force
The EU AI Act's Article 4 AI-literacy duty has bound providers and deployers since 2 February 2025 — what it requires and how to evidence it.
How Do You Answer an EU AI Act Vendor Questionnaire?
A customer sent an EU AI Act vendor questionnaire. State your role under Article 3, map each question to a document, and attach the evidence you hold.
EU AI Act Article 50: AI Transparency and Labelling
EU AI Act Article 50 makes you tell people when they deal with AI and mark AI-generated content from 2 August 2026 — the four duties and example wordings.
EU AI Act Compliance for Small Business: The Documentation Guide
A deployer-first EU AI Act compliance guide for a small business: the five-step path, the nine-document pack, and the corrected post-Omnibus 2026 timeline.
EU AI Act Deadlines in 2026: What the Omnibus Changed
EU AI Act deadlines after the Digital Omnibus, in force since 27 July 2026: what moved to 2027 and 2028, what already applies, and what to do now.
EU AI Act Fines and Penalties: How They Work (2026)
EU AI Act fines reach €35 million or 7% of worldwide turnover under Article 99. How the three penalty tiers work, when they apply, and what cuts exposure.
Internal AI Use Policy: What It Must Contain (2026)
An internal AI use policy is how a deployer puts the EU AI Act into effect for staff — what it must contain, who owns it, and how to keep it a living document.
Who Does the EU AI Act Apply To? US, UK, Swiss Firms
Who does the EU AI Act apply to? It binds by role and market, not location: US, UK and Swiss firms are in scope when they sell AI into the EU market.
AI Agents vs Automation Platforms: Which One Fits Your Work
AI agents vs automation platforms, for a small business: what each one suits, what each costs, how each fails, and when a hybrid beats both of them.
RPA vs AI Agents: Which Should You Use to Automate?
RPA vs AI agents for a small business: what each suits, what each costs, where each fails, and when the right move is both or fixing the process first.
GDPR Accountability: What EU Companies Must Document
GDPR accountability means proving compliance rather than claiming it. The records EU companies must hold — ROPA, DPIA, policies — and how to build the set.
The AI-Native Company: AI in Every Workflow, Governed
An AI-native company runs AI in every workflow with humans at the right checkpoints — one governed operating layer over unified data. Here is the model.
AI Customer Support Triage: How to Automate the Queue
AI customer support triage automation classifies, prioritises and routes tickets faster without new headcount. What it costs, what it saves, and when it fits.
AI for Accounts Payable Automation: A UK Small Business Guide
AI for accounts payable automation reads invoices, matches purchase orders and routes exceptions. What it realistically saves a small business.
AI for Order Processing: The Wholesaler's ROI Guide
AI for order processing cuts order-entry errors and frees ops staff. Realistic costs, savings, and how to tell whether it is the right first automation for you.
What Are AI Agents? Cost and Where a Small Business Starts
An AI agent takes multi-step actions toward a goal rather than only generating text. What that means for a small business, what it costs, and where to start.
AI Implementation Roadmap for Small Business: Pilot to Scale
An AI implementation roadmap for a small business turns a ranked top-three shortlist into phases: pilot, stabilise, expand, with oversight from day one.
AI Opportunity Assessment for Small Business: Rank Your Top 3
An AI opportunity assessment for a small business scores every repeatable process and ranks the top three by payback before any budget is committed.
How to Prioritise AI Use Cases: A Scoring Framework
How to prioritise AI use cases: inventory every process, score each on ROI, suitability and risk, combine into one number, and cut to a defensible shortlist.
Which Process to Automate First? A Decision Framework
Which process to automate with AI first? Pick the highest-suitability, lowest-risk early win over the highest-ROI one — a decision framework for a small team.
What Is the Agent Opportunity Score? The AOS Method Explained
The Agent Opportunity Score (AOS) is the 0–100 framework behind every AI Priority Map audit — ranking your processes across ROI, suitability and risk.
How to Build an AI Register in 90 Minutes (EU AI Act)
How to build an AI register in ninety minutes, before the Article 26 deployer duties begin to apply in December 2027: the five steps, the starter columns, the owner rules and the pitfalls.
Human-in-the-Loop Isn't Oversight. It's a Design Discipline.
Human-in-the-loop AI design is a threshold system, not a sign-off button: how to build fallback paths and override logs an auditor will actually accept.
Local LLM vs Cloud LLM Data Security: The Wrong Question (2026)
Local LLM vs cloud LLM data security is the wrong question: the real leak is staff pasting into personal accounts, which a local model never touches.
50 Questions to Ask Before Implementing AI: A Buyer's Guide
50 questions before implementing AI, distilled from 252 real buyer questions and grouped by the five people who ask them, each answer sourced.
Hiring an AI Engineer? Your Best One Is Already on the Payroll
Hiring an AI engineer rarely fixes the problem. The bottleneck is operational judgement, and below 500 staff the better AI lead is already on your payroll.
You Don't Need More AI Tools. You Need an AI Strategy Framework
An AI strategy framework replaces ad-hoc per-seat subscriptions with one accountable plan: audit the footprint, consolidate it, then implement in phases.
AI Governance From Day One: What Retrofitting Compliance Costs
AI regulation is converging. Firms that build AI governance in from day one avoid the GDPR-style retrofit trap that cost the last cohort several times more.
AI Implementation Framework: It's an IT Integration Project
An AI implementation framework has to budget the integration: identity, data and monitoring work is 60–70% of real cost, and no vendor quotes it.
Scale, Don't Cut: The Business Case for AI Without Layoffs
The case for AI without layoffs: scale output with the team you have. The enterprise cutting playbook targets work a smaller firm does not have enough of.