Elevate AI Governance & Data Protection Check
How the check works.
This educational self-check is based on your answers. It does not inspect your systems, establish every legal requirement or certify compliance.
From ten answers to an action plan
Your ten answers are checked against fixed rules in your browser. Each rule that matches adds an action with a priority, an evidence label, a suggested owner and the evidence to check. The same answers always give the same plan; no AI writes it. The check is usable across industries, but reports legal relevance conditionally. Selection is routing evidence, not verified legal applicability.
How answers are read
- Account labels never prove safety or legality.
- Country choice establishes candidate relevance only.
- An unasked supplier question cannot produce a reported-gap finding.
- Known absence of important outputs is not itself a review-control failure.
- No-use readiness keeps Q08-Q10 answers visible but does not invent active-workflow failures.
Priorities
Priorities order the actions. They are labels, not a score, and the number of actions is not a measure of compliance.
- Urgent
- High priority
- Priority
- Lower priority
- Scope note
Evidence labels
Every label describes what you reported. Nothing is inspected or verified.
- Reported in place, not verified
- Reported gap
- Reported as partly in place
- Not sure: check with your team
- Not asked in this check
- Specialist review recommended
- Not assessed in this scope
- Possible incident: act now
Regions
Choosing a country links the plan to that region's guidance. It does not establish that its laws apply to you. Where a region's legal context is still awaiting review, the plan says so and gives operational guidance only.
- UK
- Core privacy, PECR and selected official sector signposts. NI equality law separate.
- EU27
- Shared GDPR/AI Act baseline with country-specific research gates. No complete national-law audit.
- EEA non EU
- GDPR baseline and authority directory; do not assume every EU AI Act provision is incorporated identically without verifying EEA status.
- US
- Prior L-series selective federal/state/sector sources retained; not a 50-state audit.
- CH or other
- General operational recommendations only plus explicitly applicable cross-border modules; domestic law not assessed.
What the check does not assess
- The lawful basis for using personal information
- Supplier contracts and terms
- Sending information to other countries
- Data protection impact assessments
- When each AI system was put on the market or into use
- Whether your business is a regulated entity
- Cross-industry ten-question educational AI governance check; US legacy plus EU/EEA baseline and UK expansion. Not a full national/sector compliance audit.
Sources
Each action lists its sources with the publisher, the reference, what the source supports and its limits. Sources are background, not a finding that a law applies to your business. Links come only from the check's fixed source register.
Versions
Content pack 0.5.1-linked-copy-staging. Site fingerprint 5d9c6946656e9571be38cc1afe4375c3d4675739c00fc1f6e24252bf3fe36750. Every plan carries these versions and its own fingerprint.