Yes, if you build or use AI systems. ISO/IEC 27001 governs information security.

https://dev.to/mickai/iso-42001-vs-iso-27001-do-you-need-both-standards-g8b

#SovereignAI #AI #Compliance

Yes, if they sit inside the certification scope. Def Stan 05-138 Issue 4 scopes your whole corporate environment, not just contract data, so AI tools count as software or cloud services under Cyber Essentials.

https://dev.to/mickai/defence-cyber-certification-do-your-ai-tools-count-580f

#SovereignAI #AI #Compliance

JSP 936 Part 1 is the MOD's directive on dependable AI. It sets mandatory requirements built on five ethical principles: human-centricity, responsibility, understanding, bias and harm mitigation, and reliability.

https://dev.to/mickai/jsp-936-for-ai-suppliers-what-the-mod-now-requires-2o8d

#SovereignAI #AI #Compliance

Only on infrastructure you control. MOD contract information carries confidentiality conditions such as DEFCON 531, which limit disclosure to the people who need to know.

https://dev.to/mickai/generative-ai-and-mod-contract-data-what-suppliers-can-do-3il6

#SovereignAI #AI #Compliance

Yes, where the AI system supports an essential service. The Network and Information Systems Regulations 2018 cover air, rail, water and road transport operators, and the duty attaches to the network and information systems behind the service, AI incl

https://dev.to/mickai/nis-regulations-and-ai-rules-for-transport-operators-eah

#SovereignAI #AI #Compliance

Not in a public AI tool. A declaration carries commercial values, consignee details, tariff codes and contract terms that a competitor would pay for, and pasting it into a consumer service puts it outside your control.

https://dev.to/mickai/customs-declarations-and-ai-tools-is-your-data-safe-2lo6

#SovereignAI #AI #Compliance

Almost certainly yes. The ICO treats monitoring that tracks location and behaviour, then uses analytics to score how someone drives, as high risk.

https://dev.to/mickai/driver-monitoring-dpia-do-you-need-one-for-telematics-52pm

#SovereignAI #AI #Compliance

Yes, if you set it up properly. UK GDPR does not ban AI transcription of customer calls.

https://dev.to/mickai/ai-call-transcription-and-uk-gdpr-what-firms-must-do-188a

#SovereignAI #AI #Compliance

Yes, in most cases. Where EU users are involved, Article 50 of the EU AI Act requires people to be told they are interacting with an AI system, and that duty still starts on 2 August 2026.

https://dev.to/mickai/ai-chatbot-disclosure-must-you-tell-customers-its-ai-34hd

#SovereignAI #AI #Compliance

No AI customer service chatbot is compliant with UK GDPR on its own. Compliance comes from your lawful basis, your transparency notice, your retention rules and your transfer position.

https://dev.to/mickai/uk-gdpr-ai-chatbot-compliance-a-checklist-for-firms-ffd

#SovereignAI #AI #Compliance

The AI Playbook for the UK Government is Government Digital Service guidance setting ten principles for public sector AI: knowing its limitations, lawful and ethical use, security, meaningful human control at the right stage, life cycle management, t

https://dev.to/mickai/ai-playbook-for-uk-government-the-10-principles-explained-57e5

#SovereignAI #AI #Compliance

Most public bodies buy AI from an existing commercial agreement instead of running a fresh tender.

https://dev.to/mickai/buy-ai-through-g-cloud-and-government-frameworks-guide-263n

#SovereignAI #AI #Compliance

There is no blanket duty. PPN 017 gives UK contracting authorities optional example questions asking whether AI helped write your bid and whether AI will deliver the service.

https://dev.to/mickai/ai-disclosure-in-public-sector-tenders-whats-required-3nb5

#SovereignAI #AI #Compliance

AI can support a public sector evaluation, but it cannot make the award decision. The Procurement Act 2023 requires assessment against published award criteria and an assessment summary giving each supplier reasons, so a named officer must own every

https://dev.to/mickai/ai-bid-evaluation-in-public-procurement-is-it-lawful-20an

#SovereignAI #AI #Compliance

Yes, provided the documents never leave infrastructure you control. Supplier contracts and tender responses arrive under confidentiality terms, so the risk is not AI itself but sending commercially sensitive material to an outside service.

https://dev.to/mickai/ai-for-procurement-contract-review-is-it-allowed-1072

#SovereignAI #AI #Compliance

Eight clauses matter: whether your inputs train the supplier's models, where processing happens, who owns outputs, who carries liability for wrong ones, security and sub-processor control, audit and evidence rights, change notification, and exit with

https://dev.to/mickai/ai-supplier-contract-clauses-a-uk-buyers-checklist-2llh

#SovereignAI #AI #Compliance

It can. Most NDAs limit disclosure to named recipients and a permitted purpose, so sending a counterparty's documents to an outside AI service is a disclosure to a third party unless the agreement allows it.

https://dev.to/mickai/nda-and-ai-tools-does-ai-use-breach-confidentiality-528

#SovereignAI #AI #Compliance

No single rule forces disclosure. The SRA expects it to be clear to clients where they are dealing with AI, which in practice means a general clause in the client care letter plus specific disclosure where AI does substantial work on a matter.

https://dev.to/mickai/telling-clients-about-ai-use-do-solicitors-have-to-2la0

#SovereignAI #AI #Compliance

The SRA warning notice on misuse of AI: what it actually says, and what it means for your firm in practice.

https://dev.to/mickai/sra-ai-warning-notice-what-it-means-for-your-firm-boo

#SovereignAI #AI #Compliance

Does pasting a matter into a public AI tool waive legal privilege? The honest answer is that nobody wants to be the test case.

https://dev.to/mickai/ai-and-legal-privilege-uk-does-public-ai-waive-it-17e0

#SovereignAI #AI #Compliance