This page covers steps 7 to 10 of our AI governance framework. The data protection and security controls these steps build on are in AI data protection, human oversight and security controls.
Step 7: Vendor due diligence
Every AI tool your organisation uses involves a third-party vendor processing your data. The due diligence questions below apply to any new AI tool before approval, and should be revisited when a vendor makes significant changes to their terms or product.
| Question | Why it matters |
|---|---|
| Does the vendor train their models on customer data by default? | Many free-tier tools do. Business tiers typically offer an opt-out. Confirm it is off and get it in writing. |
| Where is data processed and stored? | Determines which transfer mechanism you need for UK GDPR compliance. EU-hosted does not automatically mean GDPR-compliant for UK transfers. |
| Who are the sub-processors? | Your vendor's AI infrastructure may run on AWS, Azure, or Google Cloud in a different jurisdiction. Check the sub-processor list in the DPA. |
| What happens to data when you cancel? | Confirm deletion timelines. Some vendors retain data for model improvement purposes after contract termination unless you explicitly request deletion. |
| What security certifications does the vendor hold? | ISO 27001 and SOC 2 Type II provide useful assurance for AI tools processing sensitive data, but certification should be assessed alongside the vendor's security controls, contractual commitments, data handling practices, and independent assurance. Request the current certificate where applicable. |
| What is the data retention period for prompts and outputs? | Some platforms retain conversation history for extended periods. This is relevant for your data retention policy and for responding to subject access requests. |
| How does the vendor classify their system under the EU AI Act? | Relevant if you have EU operations. Ask whether the vendor has conducted a conformity assessment and what risk tier they assign their system. |
Add the vendor's data processing agreement and a summary of answers to these questions to the AI tool register. When a vendor updates their terms, your register tells you which tools to re-evaluate.
AI procurement requirements
For any new AI tool of consequence, put these requirements in front of procurement or legal before the contract is signed, not after. They sit alongside your organisation's normal procurement checks and cover what is specific to AI:
- Data processing and training: the vendor's rights to use your data, and an explicit contractual commitment on model training, not just a settings toggle that can change
- Security and privacy: the security certifications and privacy commitments covered in the due diligence table above, written into the contract
- Retention and deletion: the retention period for prompts, outputs, and logs, and a defined deletion timeline on termination
- Data location and subprocessors: where data is processed and a right to be notified of new subprocessors
- Incident notification: a contractual obligation to notify you within a defined window of a security incident or breach affecting your data
- Audit and regulatory cooperation: a right to request evidence of controls, and a commitment to cooperate if a regulator asks about processing involving your data
- Model and service changes: notice of material changes to the underlying model, service availability commitments, and how those changes are communicated
- Exit and portability: what happens to your data and configuration on termination, and whether you can export it in a usable form
Where a vendor will not commit to these in writing, treat that as a finding in itself, not a reason to skip the clause.
Step 8: AI incident management
Governance needs to cover what happens when something goes wrong. AI incidents are not the same as general IT incidents, and your existing incident response process may not account for them. Define what counts as an AI incident and ensure the escalation path reaches your AI governance owner and, where relevant, your DPO.
What counts as an AI incident
- Confidential or personal data entered into an unauthorised or unapproved AI tool
- AI-generated content sent to a customer or published externally without appropriate review
- Discriminatory or harmful AI output affecting an individual
- An incorrect automated decision with a significant effect on an individual
- Prompt injection causing data exposure or unintended AI behaviour
- A security breach at an AI vendor affecting your data
- Prohibited AI use by a member of staff
- AI-generated content causing legal, regulatory, or reputational harm
- Unexpected model behaviour after a vendor update
Response process
AI incidents that involve a personal data breach connect directly to your broader incident response capability. If your organisation does not have a tested incident response process, an AI incident is a poor time to discover that.
Step 9: EU AI Act applicability
The EU AI Act is EU law. UK organisations are not directly subject to it solely by virtue of being UK-based. However, if your organisation places AI systems on the EU market, deploys AI that affects people in the EU, or supplies AI systems to EU customers, the Act may apply to you regardless of your location. The UK government is developing its own AI regulation approach, which is expected to differ from the EU model.
The EU AI Act applies a four-tier risk framework: unacceptable risk (prohibited), high risk, limited risk (transparency obligations), and minimal risk. For UK organisations with EU exposure, the most practically relevant provisions are:
Prohibited AI
Examples of prohibited AI practices that have applied since February 2025 (this is not an exhaustive list of Article 5 prohibitions):
- AI systems that use subliminal techniques to manipulate behaviour in ways that cause harm
- Social scoring systems used by public authorities
- Real-time remote biometric identification in public spaces (with limited law enforcement exceptions)
- AI that exploits vulnerabilities related to age, disability, or social situation to distort behaviour
High-risk AI
Under the revised implementation timeline, the rules for high-risk AI systems covered by Annex III apply from 2 December 2027. Certain high-risk systems embedded in regulated products apply from 2 August 2028. High-risk categories include AI used in recruitment and employment decisions, educational assessment, credit scoring, insurance risk assessment, critical infrastructure management, and law enforcement. If your organisation deploys AI in any of these areas and has EU operations or EU-affected individuals, begin compliance preparation now. The EU AI Act compliance guide covers the full risk tier structure and what each requires.
GPAI models
General-purpose AI model rules have applied since August 2025. These primarily affect model developers and providers rather than organisations using AI tools commercially, but organisations that fine-tune or adapt foundation models for their own products should take specific advice.
Step 10: ISO 42001 as a management system
ISO/IEC 42001:2023 is the international standard for AI management systems. It sets requirements for how an organisation establishes, implements, maintains, and continually improves its management of AI-related activities. If you already hold ISO 27001, many of the management system elements transfer directly.
ISO 42001 certification makes most sense for:
- Organisations developing or deploying AI systems at scale
- Regulated entities where auditors or customers ask for formal AI governance evidence
- Organisations with EU AI Act high-risk AI obligations, where ISO 42001 can contribute to a conformity assessment
- Businesses where AI governance is a sales differentiator in their market
For most UK SMEs using AI tools commercially rather than building them, formal ISO 42001 certification is not proportionate. Implementing its governance controls, including an AI policy, a risk assessment process, human oversight requirements, and a review cadence, gives you the substance without the certification overhead. Our ISO 42001 guide covers what the standard requires in detail.