Insights
Field notes on AI strategy, governance, and execution.
Editorial note: Research and drafting are AI-assisted. Methodology claims, regulatory citations, and recommendations are grounded in documented research — every article includes specific source references. Daniela Piskackova — Co-founder & AI Audit Lead — is the research methodology guarantor behind our work. This transparency matches who we are: an AI-native company.
Cornerstone
Does ChatGPT Recommend My Business? How to Measure It
Learn what a ChatGPT business recommendation means, why one answer proves little, and how to measure mentions, competitors and sources reliably.
How to Check If AI Mentions Your Brand Reliably in Practice
Learn how to check if AI mentions your brand with real buyer questions, repeated runs, captured sources and a defensible before-and-after method.
What Is Generative Engine Optimisation? A Plain Guide
Learn what generative engine optimisation means, how GEO differs from SEO, which visibility levers research supports and what it cannot guarantee.
Why AI Recommends Your Competitor Instead of Your Brand
See why AI recommends your competitor through relevance, prominence, source coverage and freshness, then diagnose the measured gap without guessing.
Can I Email Other Businesses Without Consent in the UK?
Can I email businesses without consent in the UK? Classify each subscriber, test the soft opt-in and record a defensible send or hold decision.
CCTV Monitoring Employees: UK Law and Practical Steps
CCTV monitoring employees under UK law: define the purpose, assess necessity, complete any required DPIA, inform workers and control footage and access.
Controller or Processor? A Practical EU Activity Test
Use a per-activity test to decide controller, processor or joint control, then choose the right GDPR agreement and record the reasons clearly.
Cookie Banner Requirements for UK Small Businesses
Cookie banner requirements for UK small businesses: classify cookies, block consent-required scripts, obtain real consent and test reject and withdrawal paths.
Data Processing Agreement Guide for EU Small Businesses
A practical data processing agreement for an EU small business: map the service, compare terms, use the free Commission clauses, complete annexes and test it.
Do I Have to Delete Data from Backups Under the GDPR?
Do I have to delete data from backups? Apply Article 17, separate active and recovery copies, control restores, and retain evidence for each decision.
Data Protection Officer Requirements: When Is a DPO Mandatory?
Data protection officer requirements use three GDPR tests and national law. Decide whether to appoint a DPO, then document and revisit the outcome.
Do You Need a Data Protection Officer? UK Rules Explained
Do you need a data protection officer? Apply the UK GDPR tests, compare business examples, and record a defensible answer for either outcome.
Does GDPR Apply Outside the EU? The Article 3 Test
Does GDPR apply outside the EU? Test EU establishment, targeted offers and monitoring, then decide whether an Article 27 representative is required.
Does UK GDPR Apply if Customers Are Outside the UK?
Does UK GDPR apply if customers are outside the UK? Test establishment and targeting, then assess representatives, transfers and any parallel EU GDPR scope.
GDPR Templates for Small Businesses: The Honest Minimum
GDPR templates small business teams can use: six living core records, conditional overlays, free EU clauses, and a practical test for generic packs.
How Long to Keep Personal Data in the UK: A Practical Guide
How long to keep personal data in the UK: identify the legal driver, set defensible retention periods, manage backups and delete records in practice.
How Long to Keep Personal Data Under EU GDPR: A Practical Guide
How long to keep personal data under EU GDPR: identify each legal driver, set defensible retention periods, manage backups and delete records in practice.
How to Calculate AI Payback for a Small-Business Project
Learn how to calculate AI payback with a clear cost register, measured monthly savings, a simple formula and honest no-go checks for small teams.
Is Business Contact Data Personal Data? An EU Field Test
Is business contact data personal data? Classify named work details, generic inboxes and business forms, then separate GDPR duties from marketing rules.
Is GDPR Really a Problem for a Small Business in the UK?
Is GDPR really a problem for small business? See what 99 recent ICO actions show, what usually goes wrong, and which minimum UK controls matter in practice.
Is This a Reportable Data Breach in the UK? Decide Fast
Is this a reportable data breach in the UK? Start the 72-hour clock at awareness, assess risk, record the decision and notify people if high risk.
Is This a Reportable Data Breach Under EU GDPR? A Decision Guide
Is this a reportable data breach? Start the 72-hour clock at awareness, assess risk, document the decision and notify the competent authority when required.
Legitimate Interests vs Consent in the UK: How to Choose
Legitimate interests vs consent in the UK: use the purpose, necessity and balancing tests, check PECR, and record why the chosen lawful basis fits.
Legitimate Interests vs Consent Under EU GDPR: How to Choose
Legitimate interests vs consent under EU GDPR: apply purpose, necessity and balancing tests, check ePrivacy rules, and record why the chosen basis fits.
GDPR Records of Processing Activities: Article 30 Guide
GDPR records of processing activities must follow Article 30 role-specific fields. Build a living record and test the narrow under-250 exception.
Records of Processing Activities: UK Article 30 Guide
Learn which records of processing activities UK GDPR Article 30 requires, what each record must contain, and how to build and maintain yours.
UK GDPR Small Business Guide: What to Do First in 2026
A practical UK GDPR small business guide: map personal data, choose lawful bases, write usable records, handle rights, secure data and review the system.
What Is a Lawful Basis? Seven UK GDPR Routes Explained
What is a lawful basis under UK GDPR? Compare all seven routes, avoid treating consent as the default, and record the basis that fits each purpose.
What Is a Lawful Basis? Six EU GDPR Routes Explained
What is a lawful basis under EU GDPR? Compare all six routes, avoid treating consent as the default, and record the basis that fits each purpose.
What Is a Personal Data Breach? EU GDPR Explained Clearly
What is a personal data breach under EU GDPR? Recognise confidentiality, integrity and availability failures, then take the right first-hour steps.
What Is a Subject Access Request? The UK GDPR Rules Explained
What is a subject access request under UK GDPR? Recognise one without magic words, start the one-month clock, search properly and respond lawfully.
What Is a Subject Access Request? An EU GDPR Guide
What is a subject access request under EU GDPR? Recognise one without magic words, start the one-month clock, search completely and respond lawfully.
What Must a Privacy Notice Say Under the EU GDPR Rules?
What must a privacy notice say? Compare Articles 13 and 14 GDPR, check every required field, fix timing, and retain practical evidence of delivery.
When Is a DPIA Required? The EU GDPR Article 35 Test
When is a DPIA required? Apply Article 35's mandatory cases, the WP248 risk criteria and your authority's list, then record a reasoned decision.
In-House AI Lead vs Consultancy vs Audit: How to Choose
In-house AI lead vs consultancy vs a productised audit, compared on cost, speed and who ends up owning the work, with the case each route genuinely wins.
What Is an AI Foundation Audit? A Plain Definition
What is an AI Foundation Audit? A productised opportunity assessment that scores every process on ROI, suitability and risk, then ranks your top three.
Build vs Buy AI for Small Business: Which Path Fits Your Firm?
Build vs buy AI for a small business: what each path costs in time, talent and control, when building is justified, and why most firms should buy first.
AI Literacy Under Article 4: The EU AI Act Duty in Force
The EU AI Act's Article 4 AI-literacy duty has bound providers and deployers since 2 February 2025 — what it requires and how to evidence it.
How Do You Answer an EU AI Act Vendor Questionnaire?
A customer sent an EU AI Act vendor questionnaire. State your role under Article 3, map each question to a document, and attach the evidence you hold.
EU AI Act Article 50: AI Transparency and Labelling
EU AI Act Article 50 makes you tell people when they deal with AI and mark AI-generated content from 2 August 2026 — the four duties and example wordings.
EU AI Act Compliance for Small Business: The Documentation Guide
A deployer-first EU AI Act compliance guide for a small business: the five-step path, the nine-document pack, and the corrected post-Omnibus 2026 timeline.
EU AI Act Deadlines in 2026: What the Omnibus Changed
The corrected EU AI Act deadlines after the Digital Omnibus: what moved to December 2027, what still lands on 2 August 2026, and what to do first.
EU AI Act Fines and Penalties: How They Work (2026)
EU AI Act fines reach €35 million or 7% of worldwide turnover under Article 99. How the three penalty tiers work, when they apply, and what cuts exposure.
Internal AI Use Policy: What It Must Contain (2026)
An internal AI use policy is how a deployer puts the EU AI Act into effect for staff — what it must contain, who owns it, and how to keep it a living document.
Who Does the EU AI Act Apply To? US, UK, Swiss Firms
Who does the EU AI Act apply to? It binds by role and market, not location: US, UK and Swiss firms are in scope when they sell AI into the EU market.
AI Agents vs Automation Platforms: Which One Fits Your Work
AI agents vs automation platforms, for a small business: what each one suits, what each costs, how each fails, and when a hybrid beats both of them.
RPA vs AI Agents: Which Should You Use to Automate?
RPA vs AI agents for a small business: what each suits, what each costs, where each fails, and when the right move is both or fixing the process first.
GDPR Accountability: What EU Companies Must Document
GDPR accountability means proving compliance rather than claiming it. The records EU companies must hold — ROPA, DPIA, policies — and how to build the set.
The AI-Native Company: AI in Every Workflow, Governed
An AI-native company runs AI in every workflow with humans at the right checkpoints — one governed operating layer over unified data. Here is the model.
AI Customer Support Triage: How to Automate the Queue
AI customer support triage automation classifies, prioritises and routes tickets faster without new headcount. What it costs, what it saves, and when it fits.
AI for Accounts Payable Automation: A UK Small Business Guide
AI for accounts payable automation reads invoices, matches purchase orders and routes exceptions. What it realistically saves a small business.
AI for Order Processing: The Wholesaler's ROI Guide
AI for order processing cuts order-entry errors and frees ops staff. Realistic costs, savings, and how to tell whether it is the right first automation for you.
What Are AI Agents? Cost and Where a Small Business Starts
An AI agent takes multi-step actions toward a goal rather than only generating text. What that means for a small business, what it costs, and where to start.
AI Implementation Roadmap for Small Business: Pilot to Scale
An AI implementation roadmap for a small business turns a ranked top-three shortlist into phases: pilot, stabilise, expand, with oversight from day one.
AI Opportunity Assessment for Small Business: Rank Your Top 3
An AI opportunity assessment for a small business scores every repeatable process and ranks the top three by payback before any budget is committed.
How to Prioritise AI Use Cases: A Scoring Framework
How to prioritise AI use cases: inventory every process, score each on ROI, suitability and risk, combine into one number, and cut to a defensible shortlist.
Which Process to Automate First? A Decision Framework
Which process to automate with AI first? Pick the highest-suitability, lowest-risk early win over the highest-ROI one — a decision framework for a small team.
What Is the Agent Opportunity Score? The AOS Method Explained
The Agent Opportunity Score (AOS) is the 0–100 framework behind every AI Priority Map audit — ranking your processes across ROI, suitability and risk.
How to Build an AI Register in 90 Minutes (EU AI Act)
How to build an AI register in ninety minutes, before the Article 26 deployer duties begin to apply in December 2027: the five steps, the starter columns, the owner rules and the pitfalls.
Human-in-the-Loop Isn't Oversight. It's a Design Discipline.
Human-in-the-loop AI design is a threshold system, not a sign-off button: how to build fallback paths and override logs an auditor will actually accept.
Local LLM vs Cloud LLM Data Security: The Wrong Question (2026)
Local LLM vs cloud LLM data security is the wrong question: the real leak is staff pasting into personal accounts, which a local model never touches.
50 Questions to Ask Before Implementing AI: A Buyer's Guide
50 questions before implementing AI, distilled from 252 real buyer questions and grouped by the five people who ask them, each answer sourced.
Hiring an AI Engineer? Your Best One Is Already on the Payroll
Hiring an AI engineer rarely fixes the problem. The bottleneck is operational judgement, and below 500 staff the better AI lead is already on your payroll.
You Don't Need More AI Tools. You Need an AI Strategy Framework
An AI strategy framework replaces ad-hoc per-seat subscriptions with one accountable plan: audit the footprint, consolidate it, then implement in phases.
AI Governance From Day One: What Retrofitting Compliance Costs
AI regulation is converging. Firms that build AI governance in from day one avoid the GDPR-style retrofit trap that cost the last cohort several times more.
AI Implementation Framework: It's an IT Integration Project
An AI implementation framework has to budget the integration: identity, data and monitoring work is 60–70% of real cost, and no vendor quotes it.
Scale, Don't Cut: The Business Case for AI Without Layoffs
The case for AI without layoffs: scale output with the team you have. The enterprise cutting playbook targets work a smaller firm does not have enough of.