AI governance and data protection
AI governance for the agent era
When you deploy AI that acts, agents that book, pay, decide, and touch customer data, your board and your counsel ask one question: who is accountable, and is this defensible? That is the question answered here.
Free download
The AI API compliance checklist
The steps a procurement or DPIA review will ask about when you build on the OpenAI or Anthropic API, with a worked example.
Free download
Get the AI API Compliance Checklist
OpenAI / Anthropic DPA setup, zero-retention config, and the documentation a procurement or DPIA review will ask for. Worked example included.
Built for engineers implementing AI and the founders or compliance leads responsible for signing it off.
- ·DPA setup steps for OpenAI and Anthropic API accounts
- ·Zero-retention configuration: when it applies, what it changes, how to evidence it
- ·Retention and logging questions to answer before launch
- ·Audit documentation pack a procurement reviewer will accept
Your email is used to deliver the PDF and (if you opt in) the newsletter. No spam. Privacy policy.
The practice
What I do
Governance for AI and AI agents, written by someone who reads the law and runs the systems.
Agent & AI governance reviews
A written assessment of an AI or agent deployment: the data flows, the tool boundaries, the decision points, the liability across the chain, and the documentation a regulator or a buyer will ask for.
DPIAs & EU AI Act readiness
Data Protection Impact Assessments for AI and agentic systems, risk classification under the AI Act, Article 50 transparency, and the conformity work for anything high-risk.
Fractional DPO
Ongoing Data Protection Officer coverage for organisations deploying AI: the standing governance, the records, and the accountability model that agent adoption now demands.
The work
The analysis behind the advice
The public record of how this lane is thought about. The advice clients pay for is the same analysis, applied to their system before the incident.
AI Agent Incident Register
A numbered public corpus: every significant AI agent failure analysed legally. What happened, which duty was engaged, who bears liability, and the governance that would have prevented it.
AI and your rights
The individual-rights side: what UK law gives you when an algorithm screens, scores, or rejects you, and what the deployer owes in return.
Compliance Engineering
Practitioner-grade writing on AI compliance: DPIAs, the EU AI Act, the OpenAI and Anthropic API setup, and the governance of agents.
Build, with the governance included
Need the system built too?
We also build compliant AI systems: chatbots, workflow automation, and document processing, each shipped with the DPIA, the AI Act classification, and the documentation a review will ask for. The build and the compliance work come from one team.
See what we build →Credentials
CIPP/E
Certified
10+ Years
Financial Services
LLB · LLM
Common Law Qualified
RBS · Fidelity
Previous Roles
Sample Deliverables
See the work before you buy
Blog posts explain the ideas. These sample deliverables show what the work product actually looks like.
See the paid work before you buy it
What a £500 scoping review actually says
A complete worked example of the paid review itself, on an invented client, with real findings traced to primary sources and the limits stated. No PDF, no email needed.
Most useful for GDPR + AI buyers
Sample DPIA structure for an AI chatbot
A redacted outline showing the sections, risk analysis, and controls we include in a real AI-system DPIA.
Quick proof of practical drafting
Sample privacy notice update
A before-and-after example showing how a privacy notice changes once an AI system is introduced.
Useful before hiring any AI vendor
AI vendor due diligence checklist
A practical checklist covering DPAs, retention, subprocessors, transfers, security, and exit risk.
Start with the scoping review.
A written review of your AI or agent deployment: the risk, the documentation gap, and what the full work should cost. One week, fixed price.
Insights
Latest articles
AI Governance
Can I Use Claude at Work? Free, Pro, Max, Team and Enterprise Compared Under the GDPR
Claude at work under the UK and EU GDPR, plan by plan: the consumer terms' ban on business use, training and feedback, retention, the DPA, Anthropic Ireland, residency, certifications and transfers.
16 min read
AI Governance
Is ChatGPT GDPR Compliant? Free, Plus, Business and Enterprise Compared
ChatGPT and the UK and EU GDPR, plan by plan: training defaults, retention, the DPA, which OpenAI entity UK customers contract with, data residency, certifications and transfers.
15 min read
GDPR
How to Name Your GDPR Representative in Your Privacy Notice: UK and EU Wording (2026)
Articles 13 and 14 require your privacy notice to identify your UK or EU representative and give their contact details. Example wording, placement and common errors.
10 min read
Questions
What does Michael K. Onyekwere do?
Practitioner-grade AI governance. DPIAs and EU AI Act readiness for AI and agent deployments, automated-decision compliance under the UK and EU rules, and fractional Data Protection Officer services. He also authors the AI Agent Incident Register, the public legal analysis of how AI agents fail and who is liable when they do.
Do I need EU AI Act compliance?
If you deploy AI in the EU or UK, probably. The Article 50 transparency obligations apply from 2 August 2026. The high-risk obligations moved to 2 December 2027 under the Digital Omnibus. Most customer-facing AI needs at least a risk classification and transparency disclosures, and agent deployments need a governance and accountability model on top.
What makes this different from other AI compliance advisers?
Most advisers have never run the systems they govern. Michael is a common law qualified lawyer and CIPP/E who operates real AI systems and publishes the legal analysis behind the advice. You get the law and the engineering reality from one person, not a policy template.
What regions do you work in?
United Kingdom and Ireland primarily. Michael also advises on NDPA compliance for businesses operating in Nigeria.
Ready when you are.
Start with a written scoping review. Reply within 48 hours.
Book the £500 scoping review