Resources
Practical tools and trusted references for using AI and data responsibly.
Complimentary tools
AI Use Policy Starter Template
A short, adaptable AI use policy any small business can tailor in an afternoon.
Data & AI Governance Weekly
The week’s most important regulatory developments, in one short read every Monday.
Reference library
Primary sources for the regulations and frameworks most often relevant to our clients.
Privacy regulations
General Data Protection Regulation (GDPR) (European Union)
The foundational global data protection regulation, establishing requirements for data processing, individual rights, controller and processor obligations, and cross-border data transfers. Read the official GDPR text
California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) (State of California)
California’s comprehensive consumer privacy law, as amended by the CPRA, establishing consumer rights and business obligations for personal information. California Attorney General CCPA resources
UK GDPR (UK Information Commissioner’s Office)
The UK’s post-Brexit data protection framework, based on the EU GDPR with UK-specific modifications. ICO UK GDPR guidance
US state privacy laws (Multiple states)
A growing number of US states have comprehensive privacy laws, and the list changes frequently. For a current overview, see the IAPP tracker, and follow our Weekly Briefing for new developments. IAPP US State Privacy Legislation Tracker
AI regulations and frameworks
EU AI Act (European Union)
The world’s first comprehensive binding regulation of AI systems, establishing a risk-based classification framework and obligations for AI developers and deployers. Read the official EU AI Act text
NIST AI Risk Management Framework (AI RMF) (National Institute of Standards and Technology)
A voluntary framework for managing risks associated with AI systems across the AI lifecycle. NIST AI RMF
ISO/IEC 42001 — AI Management System Standard (International Organization for Standardization)
The international standard for AI management systems, with requirements and guidance for organizations developing or using AI. ISO 42001 overview
OECD AI Principles (Organisation for Economic Co-operation and Development)
Internationally recognized principles for trustworthy AI, forming the basis for many national AI frameworks. OECD AI Principles
Regulators and supervisory bodies
- European Data Protection Board (EDPB)
- EU AI Office
- US Federal Trade Commission — Privacy & Data Security
- UK Information Commissioner’s Office (ICO)
- California Privacy Protection Agency (CPPA)
For data professionals: data governance frameworks
DAMA-DMBOK (Data Management Body of Knowledge) (DAMA International)
The reference framework for data management and governance professionals. DAMA International
DCAM — Data Management Capability Assessment Model (EDM Council)
A framework for assessing and developing data management capabilities, widely used in financial services. EDM Council DCAM
Last reviewed: October 2026.
Frequently asked questions
We’re a small business. Do we really need AI governance?
If your team uses AI tools, yes, though probably far less than you’d expect. For most small businesses, governance means a short, practical policy, a list of approved tools, and a few simple habits. It protects your data and customers, and it gives your team the confidence to use AI well.
Our team is already using ChatGPT and other tools. Is it too late?
Not at all. Most businesses start exactly here. The first step is understanding which tools are in use and what information is going into them, then putting sensible rules in place. Our AI Policy Starter engagement is designed for this situation.
Which laws apply to my business?
It depends on where your customers are, what data you handle, your industry and how you use AI. Privacy and AI laws are evolving quickly in US states, Europe and elsewhere, so the answer can change over time. Our AI & Data Risk Check identifies the regulations most relevant to your business today and helps you plan for what’s coming.
Does the EU AI Act apply to us if we’re not in Europe?
It can. The EU AI Act can apply to organizations outside the EU whose AI systems are offered in the EU or whose outputs are used there. If you sell to European customers or build AI into your products, it’s worth an assessment.
Do you provide legal advice?
No. We’re governance and compliance advisors, not a law firm. We translate regulatory requirements into practical policies and controls, and we work alongside your attorney when legal advice is needed.
Do you sell or implement software?
No. We’re independent and platform-neutral. We have no vendor partnerships or commissions, so our recommendations are based solely on your needs. We’re happy to work alongside your technology providers.
How long does an engagement take?
Most of our small business engagements take two to five weeks, depending on scope. Ongoing advisory support is available monthly. We’ll agree on a clear scope and timeline before we start.
How much does it cost?
Every engagement is scoped to your business, so pricing depends on your needs. We’ll discuss scope and provide a tailored proposal after a complimentary consultation.
Do you work with larger organizations too?
Yes. We also advise larger organizations on enterprise data governance, privacy program design and AI governance frameworks.
How do we get started?
Book a complimentary 30-minute consultation. We’ll learn about your business and how you use AI, and you’ll leave with at least one practical next step, whether or not we work together.