Guides
AI compliance, written for UK businesses
Most AI compliance material is written for large EU manufacturers. These guides are for a UK company with somewhere between one and five hundred staff, no legal department, and a team already using AI tools.
Not sure where you stand?
Discover your AI Governance & Readiness Maturity Score™
- Readiness Score
- Governance Score
- Heatmap
- Executive Report
Most Read Guides
The four pages to open first if you're not sure where to begin.
EU AI Act
Whether the Act reaches a UK business, what it asks of you, and the order to do it in.
Scope Test
Does the EU AI Act apply to UK businesses?
The Act reaches beyond the EU. Four questions that tell you whether a British company is in scope, and what to do about it if you are.
Plain English Summary
EU AI Act summary in plain English
The four risk tiers, provider vs deployer duties, penalties and the timeline to 2027 — without the annexes written for machinery manufacturers.
Compliance Checklist
EU AI Act compliance checklist for SMEs
Ten practical steps, in the order they make sense: scope test, tool register, classification, oversight, training and review.
UK Regulatory Guidance
The rules that already apply to a UK business using AI tools, and the body that enforces each one.
ICO Guidance
ICO guidance on AI, explained for small businesses
What the UK's data protection regulator actually expects from a company using AI tools — and the shortest route to meeting it.
UK GDPR & AI
UK GDPR and AI: what applies when you use an AI tool
Lawful basis, transparency, automated decisions and DPIAs — the four things UK GDPR asks of you the moment an AI tool touches personal data.
Sector Regulators
Which UK regulator covers your AI use?
The UK has no single AI law. Instead your existing regulator — FCA, ICO, EHRC, MHRA, Ofcom, SRA — applies its own rules to AI. Find yours.
Templates & Resources
Documents you can copy, adapt and start using this week.
How These Guides Fit Into The Trestano 7-Step Methodology™
Each guide answers a question at one of the seven stages below. Reading takes you as far as the stage you are already at; the Diagnostic tells you which one that is.
Solid stages are covered by a guide on this page. Dashed stages are measured, not written.
AI Readiness
Find out which rules actually reach you.
Scope Test · Plain English Summary · Sector Regulators · ICO Guidance · UK GDPR & AI
Governance Architecture · Attributable Authority™
Put ownership, permissions and evidence in writing.
AI Usage Policy · Checklists
Governance Operations™
Turn one-off reading into a review rhythm you can keep.
Compliance Checklist
Governance at Execution™, Continuous Assurance and Certification Readiness have no guide, because they can't be read — they are checked against what your AI actually does. That is where the Diagnostic starts.
The case for getting this right
Why AI governance matters
Your staff are already using AI tools — often without telling anyone. Governance is how you keep the benefits and stay defensible at the same time.
Why governance is essential
AI tools now draft contracts, screen candidates, analyse customer data and answer client queries. When something goes wrong — a data leak, a biased decision, a wrong answer given with confidence — you need to show what you used, what it touched and who was responsible. Regulators, insurers, clients and acquirers all ask the same question first: where is your AI register?
Why SMEs struggle
Enterprise teams have compliance departments for this. Most SMEs have an ops lead doing three jobs. The rules exist across UK GDPR, the EU AI Act and sector regulation, but they're written for lawyers — so it's easier to do nothing and hope. That gap is exactly what 'shadow AI' grows in: well-intentioned staff adopting tools faster than anyone can govern them.
Why ISO 42001 matters
ISO/IEC 42001 is the first international standard for AI management systems. You don't need certification to benefit — a gap assessment against it gives you a prioritised, evidence-based view of where you stand, and it's increasingly the reference point clients and tenders expect. It turns 'we take AI seriously' into something you can demonstrate.
Why DPO support matters
AI sits squarely inside data protection law: personal data flows into models, automated decisions affect people, and the ICO expects documented accountability. A named, experienced DPO keeps your register, policies and incident response current — without the six-figure cost of hiring that expertise in-house.
Where to start
If you only read one page, start with the scope test for UK businesses. Most British SMEs discover the EU AI Act either does not reach them or reaches only a small part of what they do — and knowing that, in writing, is the first piece of evidence in a compliance file. From there, the ten-step compliance checklist gives you a working order: register your tools, classify them, assign oversight, train staff, and set a review rhythm.
If your immediate worry is data protection rather than the EU AI Act, read UK GDPR and AI alongside the ICO guidance explained. The ICO is the regulator most likely to come knocking for a UK SME using AI tools, and its expectations are narrower and more achievable than the headlines suggest.
Explainer + diagram
Runtime Authority Continuity
AI systems don't just make decisions once — they act across time, tools and changing conditions. That means an AI can be authorised at the start of a task, but the situation may have changed by the time it takes action.
For SMEs, this creates a simple but important governance question: "Is the AI still allowed to do this at the moment it acts?" To keep AI safe, reliable and defensible, three lightweight checks answer it.
1. Authority validity
If data, risk, policy or objectives change, AI authority must be revalidated. Yesterday's permission may not be safe today.
2. Execution boundary check
Before an AI sends an email, updates a record or triggers an action, authority is confirmed again. This prevents AI from acting on outdated assumptions.
3. Evidence at the moment of action
Each important AI action produces a simple record showing what it did, why it did it, and whether authority was still valid.
The third check matters most when a regulator, client or insurer asks what happened. It gives SMEs clear, defensible proof of responsible AI use — not just a policy written once and filed away.
In short: AI shouldn't act just because it once had permission. It should act because permission is still valid right now. That is runtime authority continuity — and it is part of Trestano's governance model for SMEs.
The UK and EU frameworks are different — and you may owe duties to both
The UK has no single AI law. Instead, existing regulators — the ICO for data, the FCA for financial services, the EHRC for equality, the MHRA for medical products, Ofcom for online safety and the SRA for legal work — each apply their current rules to AI use in their sector. Our regulator finder maps which body covers your business.
The EU AI Act is a single, horizontal law with extraterritorial reach: it applies based on where an AI system is used or where its output is used, not where your company is registered. A UK business can be fully compliant with ICO expectations and still have unmet EU duties if its tools touch EU customers or staff. The plain-English summary explains the four risk tiers and the provider/deployer split that decides which duties are yours.
Why these guides exist
Trestano builds tooling that turns these obligations into a register, risk ratings and ready-to-edit documents. The guides are the reading behind the tooling — written in plain English, checked against primary sources, and updated as guidance changes. Every guide links to the regulator or legislation it draws from so you can verify what it says. They are practical information, not legal advice; where a question turns on your specific facts, we say so and suggest when to brief a solicitor.
Skip the reading
Tell us which AI tools your team uses and we'll tell you which of the above actually applies to you, tool by tool.
Check your AI compliance status