Service
AI Compliance Consulting for UK Businesses: UK GDPR, Sector Rules and the EU AI Act
AI compliance consulting maps the AI you use to the rules that apply, then writes down what you must do. HAeX does this for UK businesses: UK GDPR first, then sector rules and the EU AI Act where it reaches you. We are not a law firm, and we flag legal questions for your own adviser. Price is scoped on a call.
- We map each AI use to the rules that apply.
- We write the records you need to keep.
- We tell you where to ask a lawyer.
It is a practical check of your AI against the rules, and a plan to close the gaps. It sits between a risk assessment and a legal opinion.
What is AI compliance consulting?
We do the mapping and the paperwork: which rules apply, what you do today, what is missing. For a view of each risk in turn, see our AI risk assessment.
Which UK rules apply to AI?
UK GDPR applies whenever AI handles personal data. The Data (Use and Access) Act 2025 changed the rules on automated decisions. The ICO enforces both.
Key duties include a lawful basis, being open with people, keeping data to what you need and doing a DPIA for high risk use. Read the ICO's guidance on AI and data protection. We turn it into steps for your firm.
Does the EU AI Act apply to my UK business?
It can, if you place AI on the EU market or your AI output is used in the EU. Otherwise it may not reach you directly.
The timetable changed in 2026, so we print no dates here. Our EU AI Act guide for UK business carries the current position. On the call we check your exposure in a few questions.
Yes. Regulated sectors add their own duties on top. Law, finance, health and recruitment are the clearest examples.
Do sector rules add anything?
For example, law firms must think about client confidentiality, accountants about anti money laundering duties, and recruitment firms about equality law and automated decisions. Our industry pages list the main rules for each.
Our page for financial advisers and brokers shows how those rules look in practice.
What does a worked example look like?
Here is a worked example with assumed figures. It is not a client result.
Say a firm uses an AI tool to screen job applicants. We map it: personal data, an automated step, and equality law. We find three gaps: no DPIA, no human check on rejections and no notice to applicants. We write the DPIA, set a human review rule and draft the notice.
We can work through this with your own details on a free call.
AI compliance consulting
What do you deliver?
We deliver a rules map, a gap list and the documents that close the gaps.
Rules map:
which rules apply to which AI use.
Gap list:
what is missing, ranked by risk.
Documents:
policy, DPIA, notices and records.
Action plan:
who does what by when.
You can start with our free AI policy and DPIA builder. We also complete a DPIA before an embedded AI team captures any staff data.
We cannot give legal advice, sign off your compliance or represent you to a regulator. Those are for a solicitor.
What can you not do?
We can tell you where a legal view is needed and prepare the facts so that the legal bill is smaller. We do not claim certification for you. We keep to what we can do well and say so.
How does an engagement run, step by step?
It runs in four steps.
- 1
Discovery call (30 minutes)
You tell us what AI you use and where.
- 2
Audit and quote
We list uses, data and rules, then quote in writing.
- 3
Map and write
We produce the rules map, gap list and documents with you.
- 4
Review
We set a date to check again, as rules and tools change.
What does AI compliance consulting cost, and how long does it take?
Price depends on the number of AI uses and the rules that apply. We scope it on a free call and quote in writing.
A single use in one country is quick. Several uses across UK and EU rules take longer. We give a timeline in the quote.
Start with the free 30 minute call. List the AI you use, the data it handles and whether you sell into the EU.
What is the next step?
We will say which rules matter most and what to write first.
Questions that come up
What is AI compliance?
It is meeting the legal and regulatory rules that apply to your AI use, and keeping records to show it.
Does UK GDPR cover AI?
Yes, whenever AI handles personal data. The ICO has published guidance on how.
Is there a UK AI Act?
We do not rely on a single UK AI Act. UK rules come mainly from data protection law, sector regulators and general law.
Do I need to comply with the EU AI Act?
Only if it reaches you. Our guide and a short call will tell you.
Can you certify us?
No. We are not a certification body. We say who can issue a certificate if you need one.
How often do rules change?
Often. That is why we set a review date and keep the documents short.
What happens on the call
- 1
You list the AI you use and the data it handles
- 2
We say which rules matter most
- 3
You leave with a short list of what to automate first and a rough idea of cost
Prefer to talk first? Ring 07435 708864.
What you now know
- What AI compliance consulting is
- Which UK rules apply
- Whether the EU AI Act reaches you
- What sector rules add
- What a worked example looks like
- What we deliver
- What we cannot do
- How an engagement runs
- What it costs and how long it takes
- Your next step
Check where you stand on the rules
The first call is free. We tell you which UK rules apply to your use of AI and what to document first.