Boxfish Labs helps founders, product teams, startups, scaleups, SMEs, and organisations understand their AI obligations, classify AI use cases, and build practical governance for AI-enabled products and everyday AI use.
AI is moving into products, operations, customer support, marketing, hiring, education, analytics, and decision-making faster than most organisations can establish clear rules for its use. The opportunity is real -but so are the questions: Which AI systems are in use? What risks do they create? Which rules apply? Who is accountable? What data is involved? How are people informed, protected, and able to challenge important outcomes?
The EU AI Act introduces a risk-based approach to AI governance. Some practices are prohibited. Some systems are subject to stringent requirements because they are classified as high risk. Other systems carry transparency obligations. At the same time, every organisation using or providing AI needs practical governance that connects legal, ethical, security, privacy, data, product, and human factors.
Boxfish Labs helps teams move beyond generic AI policies. We work with you to understand your AI landscape, identify material use cases and risks, establish proportionate guardrails, and build the documentation, responsibilities, review processes, and learning needed to use AI with greater confidence.
The EU AI Act applies a risk-based approach. Your obligations depend on factors such as the type of AI system, intended purpose, role in the value chain, market, users, and potential impact on people.
In practical terms, organisations need to understand:
The right response is rarely a single document. It is a governance system that lets your organisation make informed decisions as AI use evolves.
We help create an AI inventory across products, internal tools, vendors, teams, models, data sources, workflows, and customer-facing features. This gives you a factual starting point for governance.
We help assess intended purpose, users, impact, data, decision context, level of automation, and human involvement to identify prohibited practices, potential high-risk use cases, transparency duties, and priorities for further review.
We help product, engineering, legal, privacy, security, and leadership teams establish lightweight review points and decision criteria that support innovation without leaving critical questions until after launch.
We connect AI governance to GDPR, data protection, DPIAs, data minimisation, vendor and processor arrangements, transparency, retention, access, and data-subject rights.
We help assess supplier dependencies, contractual terms, data flows, training or inference arrangements, security, access, logging, monitoring, service changes, concentration risk, and exit options.
We create human-centred learning and practical guidance for employees, developers, product teams, leaders, educators, and customer-facing teams -so AI use is not governed by informal experimentation alone.
We help create a clear governance narrative and evidence base for due diligence, procurement, customer questions, partnerships, audits, and stakeholder trust.
Identify AI-enabled products, features, internal tools, vendors, models, data sources, automated workflows, users, countries, owners, and intended purposes. Include experimental uses that may have bypassed formal procurement or product review.
Review the role, impact, autonomy, data, users, decision context, potential harms, transparency needs, security exposure, and regulatory relevance of each priority use case. Identify prohibited, high-risk, transparency-sensitive, or otherwise material situations.
Establish roles, decision rights, approval points, risk acceptance, documentation standards, product and vendor review processes, monitoring responsibilities, incident escalation, and policies for internal AI use.
Implement proportionate measures such as data governance, access controls, human oversight, user information, testing, logging, monitoring, documentation, vendor due diligence, security controls, DPIAs, training, and complaint or issue-handling mechanisms.
AI systems, vendor capabilities, regulations, and use cases change quickly. Review performance, incidents, feedback, drift, supplier changes, data use, risks, and governance effectiveness on a recurring basis.
A maintained view of AI systems, providers, owners, purposes, users, data, jurisdictions, and potential impact. This is the foundation for deciding what needs deeper review or governance.
A practical assessment of potential harms, including unfair outcomes, privacy impact, security risks, manipulation, misinformation, exclusion, loss of human control, errors, and harm arising from inappropriate reliance on AI outputs.
Meaningful human involvement in decisions and workflows: clear responsibility, understandable escalation, the ability to question or override outputs where appropriate, and safeguards against automation bias or blind reliance.
Clear decisions about data sources, quality, personal data, special-category data, minimisation, retention, access, purpose limitation, transparency, rights, DPIAs, and provider arrangements.
Protection against unauthorised access, data leakage, prompt injection, model misuse, insecure integrations, supply-chain issues, compromised accounts, failures, and other AI-specific or amplified cybersecurity risks.
Clear records of intended purpose, system behaviour, limitations, data and vendor arrangements, risk decisions, controls, user information, governance actions, monitoring, and incident handling.
Due diligence and ongoing oversight of model, API, platform, data, and tool providers: contracts, service changes, subprocessing, security, data location, reliability, logging, export, and exit arrangements.
Role-relevant guidance and learning so people understand what AI can and cannot do, how to use it responsibly, what information not to share, how to identify concerns, and when to escalate.
Assess AI-related security, compliance, product, and governance questions. Build a roadmap, define controls, clarify leadership priorities, and connect AI governance to wider risk management.
Useful when
you need an AI readiness assessment, a practical governance plan, decision support for a new AI feature, or help responding to customer questions.
Connect AI use with data protection: personal-data processing, lawful basis, DPIAs, transparency, data rights, automated decision-making considerations, vendor contracts, data transfers, and privacy-by-design.
Useful when
AI systems process personal data, shape significant decisions, use sensitive information, or introduce complex privacy and vendor questions.
Provide ongoing cybersecurity leadership for AI-related risk management, model and vendor security, access control, secure development, incident readiness, resilience, executive reporting, and governance implementation.
Useful when
AI becomes a material part of your product, operations, customer commitments, or security-risk profile.
Map data and model-provider dependencies, understand hosting and processing locations, assess third-country exposure, evaluate EU-focused options, and make more resilient infrastructure and supplier decisions.
Useful when
AI features depend on external models, international data processing, cloud providers, proprietary data, or customers with data-sovereignty expectations.
Build practical AI literacy and responsible-use habits. Use interactive learning, scenarios, simulations, and guidance to help people recognise privacy, security, bias, confidentiality, social-engineering, and human-oversight concerns.
Useful when
employees or users need to adopt AI safely, understand escalation routes, or apply clear boundaries in their day-to-day work.
It can. The EU AI Act applies based on activities, roles, markets, and AI systems -not only on company size. Startups that provide, deploy, import, distribute, or otherwise make AI systems available in the EU may have relevant obligations. The appropriate level of governance should be proportionate to the use case and risk.
No. The EU AI Act uses a risk-based approach. Some AI practices are prohibited, some systems may be high risk, and others may have transparency or other obligations. Many AI uses will not fall into the highest-risk category, but they can still create meaningful privacy, security, customer-trust, contractual, or human-impact concerns.
Not necessarily. The goal is to understand where and how tools are used, which data or confidential information may be entered, what the risks are, and what guidance, controls, approved tools, and review processes are appropriate for your organisation.
They can apply alongside one another. GDPR focuses on personal-data processing, while the EU AI Act addresses AI-system risks and governance. AI systems that use personal data often require both data-protection and AI-governance consideration, alongside security, consumer, employment, sector, and contractual rules where relevant.
Yes. We can support an early-stage review of intended purpose, users, data flows, providers, risk classification, transparency, privacy, security, human oversight, documentation, vendor terms, monitoring, and rollout decisions.
We provide practical security, privacy, governance, risk, human-factors, and implementation support. For formal legal interpretation or legal representation, work with qualified legal counsel. We can collaborate with your counsel to translate legal requirements into usable product, operational, and technical practices.
Tell us what you are building, which AI tools you use, what data is involved, or what a customer has asked. We will help you identify the risks, responsibilities, and next steps that matter most.
