[ Guides by topic ]

Governance, GDPR and risk 9 guides for UK businesses.

These guides cover the rules and risks that come with using AI in a UK business: UK GDPR and DPIAs, acceptable-use policies, shadow AI, security and fraud, employment law, the EU AI Act for firms that sell into Europe, and where your data is processed. They are practical rather than legal advice: what to put in place, in what order, and when to bring in a lawyer. Augustova is registered with the ICO and builds these controls into the systems it delivers.

How we handle security and data →All guides →AI strategy and consultancy →Automation and AI agents →Building software and MVPs →AI tools: Claude, ChatGPT, Copilot →Costs and ROI →Industries →

9 October 2026 · 10 min read

Shadow AI in UK SMEs: Why Staff Use Personal AI Accounts and How to Fix It in a Week (2026)

Staff are already using personal AI accounts at work, and banning them fails, so here is the one-week fix.

Default state
Personal accounts, no policy
Why blocking fails
Use moves to phones
The fix
One week, five steps

9 October 2026 · 13 min read

AI and Employment Law for UK Employers: Recruitment, Monitoring, Automated Decisions and Consultation (2026)

The four areas of law that apply when you use AI on applicants or staff, in practical terms.

ICO, 2026
Test for bias, tell candidates, provide human review
The Act, 2025
Wider lawful bases, same safeguards
Who answers
The employer, not the vendor

8 October 2026 · 12 min read

AI Security Risks for UK Small Businesses: Prompt Injection, Data Leakage and the Controls (2026)

Five risks matter to a small business, and the most common leak is staff using personal AI accounts.

NCSC on prompt injection
May never be fully fixed; reduce impact instead
Most common leak
Personal accounts, not hackers
First control
Least privilege for anything that acts

1 October 2026 · 13 min read

DPIA for AI: When a UK SME Needs One and a Template That Passes (2026)

When an AI project needs a data protection impact assessment, and a template with the seven parts the ICO expects.

Trigger
Processing likely to be high risk
Usual AI triggers
Profiling, special-category data, automated decisions
Template
Seven parts, four pages

30 September 2026 · 13 min read

Is ChatGPT GDPR Compliant? A UK Business Guide by Plan (2026)

ChatGPT can meet UK GDPR, but business plans and the API make it far easier than personal accounts.

Training on your data
No on Business, Enterprise, Edu, API
Consumer plans
Yes unless the user opts out
UK residency
Enterprise only

25 September 2026 · 13 min read

AI Acceptable Use Policy Template for UK Businesses (2026), Clause by Clause

A one-page AI policy with the eight things it must cover, ready to adopt and adjust for your firm.

Length
One page, eight clauses
Pair with
A business plan, not personal accounts
Review
Every six months, and when tools change

24 September 2026 · 17 min read

Is Claude GDPR Compliant? A UK Business Guide by Plan (2026)

Claude can meet UK GDPR, but only the business plans and API do so without extra work.

Training on your data
No on Team, Enterprise, API
Transfer mechanism
UK Addendum to the SCCs, in the DPA
Certifications
ISO 27001, ISO 42001, SOC 2 Type II

14 September 2026 · 14 min read

ChatGPT and Claude at Work: UK GDPR Rules for Business

Using ChatGPT, Claude and Copilot lawfully means business accounts, a written policy and a DPIA.

UK adults using AI tools
54%, from 31% (Ofcom, Apr 2026)
AI-using businesses with a written AI policy
5% (DSIT, Jun 2026)
Upper Tribunal on public AI tools
Upload waives privilege, [2026] UKUT 00081 (IAC) para 60
Half-day staff session
£1,200, fixed

8 August 2026 · 14 min read

Your Data When a Supplier Builds Your Software: UK GDPR

You stay the data controller and they are your processor, so get the eight contract clauses in writing.

You are
The controller
They are
Your processor
Required by Article 28
A written contract, eight clauses
Data (Use and Access) Act 2025
All data protection provisions in force (ICO, Jun 2026)