UK GDPR and the ICO's AI guidance give regulators everything they need to audit your AI governance. Your team uses ChatGPT, Copilot, AI screeners, or generative design tools — and you need documentation. Stone & Carter delivers your ICO-aligned governance folder in 7 days.
AI in use?
ChatGPT, Copilot, AI hiring
tools — anything
UK operations?
UK-registered or
processing UK personal data
Personal data involved?
Staff, customer, or
candidate data
If all three: UK GDPR accountability obligations apply to your AI use today.
"Organisations using AI in ways that affect individuals must be able to demonstrate they have assessed the risks, put appropriate safeguards in place, and ensured their people understand how to use these tools responsibly."
— ICO Guidance on AI and Data Protection, 2024
What the ICO wants to see
Documented staff training on AI risks, a data protection impact assessment for each AI tool in use, clear governance policies, and an evidence trail showing the programme is maintained. Not a one-off session — an ongoing record.
What they're actually finding
Organisations that have deployed AI tools without any formal governance, staff who paste personal data into consumer AI tools without understanding the data implications, and no documentation trail at all.
What comes next
The UK AI Bill will create a formal regulatory framework — likely in 2026. Organisations with documented governance programmes in place will have a significant advantage when mandatory requirements arrive.
£17.5M
or 4% of global annual turnover — whichever is higher
A £2M company faces up to £80,000 in exposure. A £10M company: £400,000. AI-related data protection failures are a stated priority for the ICO.
Stone & Carter Starter costs £150/month. That's £1,800/year — against £80,000–400,000 in exposure for a typical SME.
UK GDPR, the Data Protection Act 2018, and the ICO's AI guidance already give the regulator everything it needs to ask how your organisation governs AI. Most companies can't answer.
Now
ICO AI audits are already in progress
The ICO began proactive AI audits in 2024. They're using existing UK GDPR accountability powers — no new legislation required. If your team uses AI to process personal data, you're in scope.
< 1%
of affected organisations have formal AI governance documentation
A GDPR training certificate isn't AI governance. The ICO expects documented policies, role-specific training, and a record showing staff understand AI risks — most companies have none of this.
4%
of global annual turnover — the maximum ICO fine
Up to £17.5M or 4% of global turnover — whichever is higher. AI-related data protection failures are a priority enforcement area. The ICO has signalled they will use maximum penalties on AI cases.
You spend half an hour with us on day one. We do everything else. The Governance Folder is ready on day 7. Training runs automatically every week after that.
10-minute governance audit call
We map your AI tools, data flows, and staff exposure against ICO expectations and UK GDPR. You leave with a gap analysis — not a proposal for more consultancy.
We write your role-tailored curriculum
Five tracks — Finance, HR, Sales, Ops, Leadership — each built with UK-specific scenarios. Not generic GDPR slides. Real incidents from your sector, with ICO enforcement context.
Programme activates on day 7
Lessons land in inboxes. Two minutes a week. No LMS to install. No new login for staff. Your DPO has a real evidence trail from day one.
Governance Folder delivered at activation
The full evidence file is ready before a single lesson is completed. You have documentation on file from the moment your programme starts.
We maintain it as ICO guidance evolves
Quarterly curriculum reviews. As the ICO publishes new AI guidance, the AI Bill progresses, and FCA or sector-specific expectations shift, your programme updates. No legal retainer required.
Every plan includes a fully populated AI Governance Folder, five role tracks, and quarterly curriculum reviews — maintained for as long as your regulatory obligation runs.
Starter
Up to 30 staff
Growth
31–100 staff
All prices in GBP. VAT may apply. Implementation waived for contracts signed before May 31, 2026.
The governance audit call is 10 minutes. We map your obligation, identify what you're missing, and tell you exactly what a programme for your organisation would cost. No slide deck. No commitment.
10 minutes · No commitment · Governance Folder ready within 7 days of signing