Most businesses adopting AI tools today aren’t building models from scratch — they’re integrating third-party LLMs into products, customer support, HR screening, or internal workflows. That’s exactly where privacy risk tends to get overlooked: the AI vendor’s terms get reviewed by procurement, but nobody checks what personal data is actually flowing into the model, or what happens to it once it’s there.

Step 1: Inventory where AI touches personal data

• List every AI tool or feature in use or planned — including ones adopted informally by individual teams, not just centrally procured ones
• For each, identify what data is sent to it: customer records, employee data, support conversations, documents, images
• Flag any use case involving sensitive categories of data (health, biometric, financial, data about children)

Step 2: Classify the risk

• Is the AI making or materially influencing a decision about an individual (hiring, credit, pricing, eligibility)? This is generally higher-risk and may trigger DPIA obligations under GDPR, UAE PDPL, and similar laws
• Is personal data being used to train or fine-tune a model, as opposed to just being processed at inference time? Training use carries materially different risk and retention implications
• Is the vendor processing data outside the jurisdictions you’re permitted to transfer to without additional safeguards?

Step 3: Review the vendor, not just the model

• Does the vendor’s data processing agreement cover AI-specific processing, including whether your data is used for their model training?
• Can you get contractual commitments on data retention, deletion, and geographic processing location?
• Does the vendor support data subject rights requests that touch data processed through their AI tool (e.g. deleting a data subject’s data from logs and derived outputs)?

Step 4: Build in human oversight

• Define which AI-assisted decisions require human review before acting on them
• Document who is accountable for reviewing and, where needed, overriding AI outputs
• Keep a record of AI-influenced decisions that are legally or materially significant to individuals

Step 5: Put governance on a cycle, not a one-time review

• Re-assess when a vendor changes their model, terms, or data handling practices
• Re-assess when a new use case is added for an already-approved tool
• Review AI-related data subject complaints or incidents as part of regular privacy reporting

Why this matters now

Regulators across the EU, UK, and the UAE region are actively developing AI-specific guidance layered on top of existing data protection law — AI processing isn’t exempt from GDPR, UAE PDPL, DIFC DPL, or ADGM DPR just because it’s new. Businesses that treat AI governance as an extension of their existing privacy program, rather than a separate problem, are in a materially stronger position when that guidance solidifies.

This checklist is a starting point, not a complete governance framework — the right depth depends on how central AI is to your product and how sensitive the data involved is. A scoping call can help you assess where your actual exposure sits.

Rolling out AI features? Get a governance review before it ships, not after a customer or regulator asks about it. Book a Free Compliance Call