Ai Compliance
Do you know if you are fully AI compliant?
The AI Act has a hard deadline: 2 December 2027. Most SMEs using AI tools have no idea where they stand. This changes in 8 minutes.


_01
Provider vs Deployer classification
The classification that determines everything

_02
Annex III risk assessment
Is your sector automatically high-risk?

_03
GDPR Article 9 analysis
Special category data obligations

_04
AI Act Article 50 check
Transparency obligations from Aug 2026

_05
72-hour breach notification
Do you have the procedure in place?
Where does your business operate or have customers?
The AI Act applies to anyone placing AI on the EU market — regardless of where you're based.
Which best describes your organisation?
Size affects DPO obligations and documentation requirements.
What sector does your business operate in?
Annex III designates specific sectors as automatically high-risk.
Does your business use any artificial intelligence tools?
Includes: ChatGPT, Claude, Gemini, Copilot, Notion AI, AI transcription, chatbots, recommendation engines — anything described as 'AI-powered'.
How does AI feature in what you sell or provide?
The single most legally significant classification. Providers face Articles 16–27. Deployers face Article 26.
Which AI tools does your business use?
Determines subprocessor disclosure and international transfer mechanisms needed.
*Select one or more options
What does the AI do in your product or service?
AI that influences decisions about people is classified as higher risk.
*Select one or more options
Who interacts with or is affected by the AI?
Article 50(1) transparency obligation applies when AI interacts directly with natural persons.
*Select one or more options
Have you conducted a conformity assessment for your AI system?
Mandatory for high-risk AI providers before market placement. August 2026.
Do you maintain technical documentation for your AI system?
Article 11 + Annex IV: system description, development process, performance metrics, risk management, post-market monitoring.
What is your lawful basis for AI processing of personal data?
Legitimate interests alone is not valid for health or special category data.
*Select one or more options
How do clients consent to AI processing their data?
For health data: explicit, specific, informed, freely given, and withdrawable.
Are clients clearly informed that AI processes their data — before or at first contact?
EU AI Act Article 50(1) requires disclosure in a 'clear and distinguishable manner'.
When AI produces outputs affecting clients, what happens before they're acted on?
The AI Act requires human oversight. GDPR Art. 22 gives rights against solely automated decisions.
Is client data being used to train or improve any AI models?
Many AI tools do this by default in free tiers. Using health data for training without explicit consent is a serious breach.
Do you have Data Processing Agreements with your AI tool providers?
GDPR Art. 28 requires a written DPA with every processor. AI companies are typically US-based.
Are you registered with your data protection authority?
Most UK organisations must register with the ICO (£40–£400/year). Failure is a separate offence under DPA 2018.
Do you have a privacy notice available to clients and website visitors?
GDPR Articles 13 and 14 require: what you collect, why, legal basis, retention, processors, transfers, and rights.
Do you have a process for handling Subject Access Requests?
Must respond within 30 calendar days. Most common source of ICO complaints.
Contact Information
This is a contact form. Please provide your contact information below, and we'll be able to sen your report in case if you need it
I agree to Privacy Policy





⚠

PARTIALLY COMPLIANT

Rebuild may be required before August 2026.


Access the Full Report
COMPLIANT
We believe you don't need to have a full rebuild, but we still encourage to speak to a professional
Access the Full Report
Step: 
Book a call
LEGAL
© 2025 Decode&Grow
Registered in England and Wales. Company Number 16814320
Registered with the Information Commissioner’s Office – Registration No. ZC120811
© Decode&Grow. All rights reserved
Made on
Tilda