Question 1

Can’t I just use ChatGPT or Claude to write my own compliance documents for free?

Accepted Answer

You can, just as you could represent yourself in court. But that approach has limits. AI tools like ChatGPT and Claude don’t know your specific business, your AI use cases, your data flows or which risk category the EU AI Act places you in. They may produce something that looks like a compliance document, but whether it covers your circumstances is another question. Clausely starts with a structured risk assessment to establish your obligations. Your documents are generated against that specific profile, not a generic template. They reference the relevant articles of the EU AI Act, reflect your business’s risk level and follow the structure regulators expect. If you are ever investigated, “I asked ChatGPT” is not a defence. A tailored, dated and signed document demonstrates genuine compliance awareness.

Question 2

What is the EU AI Act and does it apply to my UK business?

Accepted Answer

The EU AI Act is a regulation that entered into force in 2024 and applies on a phased timetable that is already under way. It applies to any business whose AI systems are used by, or have impact on, individuals in the European Union, regardless of where the business is based. If you have EU customers, staff, or users, the Act applies to you.

Question 3

When do the EU AI Act obligations apply?

Accepted Answer

Full enforcement begins, including deployer obligations under Article 26, transparency requirements under Article 50, and penalties for non-compliance that can reach 7% of global annual turnover or €35 million for the most serious breaches. Preparation needs to happen before that date.

Question 4

What does the Worker Protection Act 2024 actually require from employers?

Accepted Answer

It places a positive preventative duty on every UK employer to take reasonable steps to prevent sexual harassment of their workers, including harassment by third parties such as customers, contractors, and suppliers. In practice that means a documented risk assessment, an anti-harassment policy, a third-party harassment policy, a clear reporting route, and evidence that staff have been trained. The duty applies whether or not a complaint has ever been raised.

Question 5

Does the Worker Protection Act apply to small employers?

Accepted Answer

Yes. There is no headcount threshold. A five-person business carries the same preventative duty as a five-hundred-person business, though what counts as reasonable steps is judged proportionately against your size, sector, and the risks your people actually face. Our Worker Protection Pack is generated against your declared working patterns and risk profile rather than issued as a generic template.

Question 6

What happens if we cannot evidence reasonable steps on harassment?

Accepted Answer

In a successful sexual harassment claim, an employment tribunal can uplift compensation by up to 25% where the employer has failed the preventative duty, and the EHRC has standalone enforcement powers it can use without any individual claim being brought. The practical test is documentary: a dated risk assessment, current policies, and training records.

Question 7

When does UK GDPR require a DPIA, and do we need one?

Accepted Answer

A Data Protection Impact Assessment is required before processing that is likely to result in a high risk to individuals, which includes large-scale processing of special category data, systematic monitoring, profiling with significant effects, and in most cases feeding personal data into AI tools. If you are unsure, the ICO's position is that carrying out a DPIA is the safer course. Our UK GDPR and DPIA Pack produces one tailored to your declared processing.

Question 8

What UK GDPR documentation should a small business already hold?

Accepted Answer

At minimum: a privacy notice that reflects what you actually do with personal data, a Record of Processing Activities covering your purposes, lawful bases, retention periods, and recipients, and a DPIA where your processing is high risk. Those are the first documents an ICO caseworker asks for, and the ones most small businesses either lack or have never updated.

Question 9

Does putting client or customer data into an AI tool create UK GDPR obligations?

Accepted Answer

Yes. Personal data entered into an AI tool is still being processed, so you need a lawful basis, a privacy notice that reflects it, an entry in your Record of Processing Activities, and usually a DPIA. This is where UK GDPR and the EU AI Act overlap in practice, which is why the packs are designed to be held together rather than in isolation.

Question 10

Are these documents actually legally valid?

Accepted Answer

Our documents are drafted to statutory quality in British English, citing the correct regulatory frameworks (EU AI Act, UK GDPR, Worker Protection Act). They are ready to present to a regulator, auditor, or solicitor. They are not legal advice and should be reviewed against your specific circumstances before being relied upon in any enforcement context.

Question 11

How is this different from a free template?

Accepted Answer

Free templates are generic. Clausely documents are tailored: your company name, sector, declared AI tools, accountable person, and regulatory exposure are all injected directly into the text. The drafting quality and specificity match what you would expect from a mid-tier consultancy, at a fraction of the price.

Question 12

What does the Annual Update Subscription include?

Accepted Answer

Whenever the ICO, EHRC, or EU AI Office publishes new guidance, we regenerate your pack to reflect the updated position and email it to you. This keeps your documents defensible against a shifting regulatory landscape without you having to track every guidance update yourself. Year one is included in the price of your pack. Your first renewal is 50% off at £74.50, and renewals after that are £149 per year.

Question 13

Can I get a refund?

Accepted Answer

Yes, if document generation fails on our side or there is a technical error. Once documents are generated and delivered, the service has been consumed and we do not offer refunds. See our Refund Policy for full details.

Question 14

Can I upgrade to a higher pack later?

Accepted Answer

Yes. If you purchase a pack and later find you need a higher tier, you can upgrade and pay only the difference between what you have already paid and the higher pack. You will never pay twice for the same documentation. Just get in touch and we will arrange it for you, usually within the hour.

Question 15

Who reviews the documents before I receive them?

Accepted Answer

Documents are generated by AI and delivered automatically. They are designed to be reviewable by you, your team, or your solicitor before use; this is the industry standard for AI-generated compliance documents and is explicitly recommended by the EU AI Act’s human oversight provisions.

Question 16

What if my business changes and I need the pack updated?

Accepted Answer

Regenerate at any time by purchasing a fresh pack at the current price, or wait for your annual update if you hold the subscription. Material changes to your AI use or regulatory exposure often warrant a fresh pack rather than an incremental edit.

Question 17

Is my data safe? What do you store?

Accepted Answer

We store your intake responses, generated documents, and transaction records on Supabase (EU-hosted). Documents are held for 30 days on live systems, after which download links expire. Transaction records are retained for 6 years as required by UK tax law. We do not sell or share your data for marketing. See our Privacy Policy.

Question 18

Do I need a solicitor as well?

Accepted Answer

For most UK SMEs at the Essentials or Professional tier, Clausely documents are sufficient for baseline compliance and audit-readiness. For High-Risk AI deployments (hiring, credit, healthcare, essential services), we recommend your pack is reviewed by a qualified solicitor before relying on it in regulatory defence. Clausely makes your solicitor’s work easier, not redundant.

Question 19

What did the Digital Omnibus political agreement (May 2026) actually change?

Accepted Answer

The Digital Omnibus political agreement narrowed and clarified scope in several places, eased some technical compliance burdens for general-purpose AI providers, and pushed the substantive obligations for most Annex III high-risk AI systems to December 2027. What it did not change: the Article 4 AI literacy obligations, the Article 50 transparency obligations, the prohibited-use rules, and the governance and documentation expectations placed on deployers. For UK businesses deploying AI tools, the baseline policy framework you need is essentially unchanged, and only the timetable for high-risk system technical conformity has moved.

Question 20

Has the high-risk AI deadline really moved to December 2027? What still applies now?

Accepted Answer

Yes. The agreement pushes the substantive technical and conformity obligations for most Annex III high-risk AI systems to December 2027, giving providers more time to complete conformity assessments and CE marking. Transparency obligations (Article 50), AI literacy obligations (Article 4), prohibited-use rules, governance structures, and the documentation expected of deployers sit outside that extension and already apply. In practice the policy framework, Acceptable Use, AI Literacy, Article 50 disclosures, oversight SOPs and vendor registers, needs to be in place now, even if you are also a high-risk system provider working to a 2027 conformity deadline.

Question 21

Does the Digital Omnibus mean we can wait until 2027 to act?

Accepted Answer

No. The Omnibus extended one specific timetable, substantive conformity for most Annex III high-risk systems, to December 2027. It did not defer the transparency, literacy, governance, or deployer documentation obligations. If your business uses AI tools (ChatGPT, Copilot, an internal copilot, an AI chatbot, AI-assisted recruitment or marketing), those obligations already apply to you rather than waiting until 2027. Waiting risks both regulatory exposure and PI questionnaire failure at renewal.

Question 22

What actually counts as a “high-risk” AI system under Annex III?

Accepted Answer

Annex III lists categories of AI systems treated as high-risk because of where they are used, not because of the underlying technology. These include AI used in: biometric identification and categorisation; critical infrastructure (water, gas, electricity, transport); education and vocational training (admissions, grading, proctoring); employment (recruitment, CV screening, performance evaluation, task allocation, termination); access to essential private and public services (credit scoring, insurance pricing, benefits eligibility, emergency dispatch); law enforcement, migration and border control; and administration of justice and democratic processes. If your AI sits in any of these workflows, even if it only assists a human decision, you are likely a high-risk deployer.

Question 23

Does the EU AI Act still apply to UK businesses post-Brexit?

Accepted Answer

Yes. The Act applies extraterritorially. A UK business is in scope if it places an AI system on the EU market, if the output of its AI system is used in the EU, or if it employs or serves people in the EU or EEA. Brexit did not remove EU regulatory reach over UK businesses whose AI touches EU users, staff, or customers, much as UK GDPR continues to interact with EU data protection law for cross-border processing.

Question 24

What happens if our business is not compliant?

Accepted Answer

Enforcement of the EU AI Act is phased and already under way, and there is no grace period once an obligation applies to you. National regulators (in the UK, the ICO and sector regulators acting in cooperation with EU authorities) can investigate, request your documentation, and refer matters for fines. Penalties reach €15 million or 3% of global annual turnover (whichever is higher) for breaches of deployer and transparency obligations, and €35 million or 7% of global turnover for the most serious prohibited-use breaches. PI insurers are already asking for documented AI policies at renewal, so undocumented AI use can affect cover as well as expose you to enforcement.