We Know Your Industry and Your Regulators
Different sectors carry different AI risk profiles, so AI regulatory compliance is never one-size-fits-all. We map yours against the right rulebook: UK GDPR, the Data (Use & Access) Act 2025, the Equality Act, your sector regulator (FCA/PRA, MHRA, ICO, NCSC, OSA), and the EU AI Act where you have EU exposure.
Our sector work goes beyond AI governance: where it helps, we bring the same depth in ServiceNow and Enterprise Service Management to the operations underneath.
Manufacturing & Engineering
Derby, Leicester, Nottingham, Lincoln
Healthcare & Life Sciences
NHS Trusts, private healthcare, pharma
HR & Recruitment
Article 22 + Equality Act exposure
Financial Services
FCA/PRA SS1/23 model risk
Logistics & Distribution
UK's logistics heartland
Retail & eCommerce
Personalisation & dynamic pricing
Agriculture & Food
Precision farming & data governance
Manufacturing & Engineering
Derby · Leicester · Nottingham · Lincoln
The Risk
Manufacturers across Derby, Leicester, Nottingham and Lincoln are using AI in production-line quality control, supply-chain optimisation, predictive maintenance and workforce scheduling. The right rulebook depends on what you do and who you sell to:
- Bucket 1 (your real UK legal duties): UK GDPR & DPIAs (any AI touching staff or supplier data), Equality Act 2010 (workforce-scheduling AI that disadvantages protected characteristics), NCSC AI cyber-security guidance for the security side, and product-safety regulators for safety-critical AI.
- Bucket 2 (voluntary best practice): DSIT AIME, ISO/IEC 42001, and the EU AI Act's high-risk framework as a benchmark.
- EU AI Act as a hard legal duty: only if you export products into the EU, supply EU manufacturers, or have EU-based customers requiring compliance evidence. For those firms, August 2026 is real.
What We Deliver
- AIME-based governance health check for the whole AI estate
- AI risk classification for production, QC and supply-chain systems
- EU AI Act compliance documentation for EU-facing operations
- NCSC-aligned AI security controls for the production environment
- Equality Act bias review for workforce-scheduling AI
Healthcare & Life Sciences
NHS Trusts · Private Healthcare · Pharma
The Risk
For healthcare and life-sciences, the UK regulatory stack is denser than the EU one. The MHRA regulates AI used as Software as a Medical Device (SaMD) and increasingly expects AI-specific evidence. UK GDPR DPIAs are mandatory for high-risk processing of patient data. The ICO's guidance on AI & data protection and on automated decision-making sets the operational bar. EU AI Act high-risk obligations apply on top where you trade with EU healthcare systems, pharma partners or run EU clinical operations.
NHS Trusts across Nottinghamshire, Derbyshire, Lincolnshire and Leicestershire, plus private providers and East Midlands pharma, are all in scope of at least one of these.
What We Deliver
- MHRA-aligned evidence pack for AI used as SaMD
- UK GDPR DPIAs for high-risk patient-data processing
- Clinical AI transparency and explainability documentation (ICO-aligned)
- Human oversight control frameworks for patient-facing AI
- EU AI Act high-risk audit for EU-facing pharma and clinical operations
Logistics & Distribution
Amazon · DHL · Pall-Ex · XPO · Regional operators
The Risk
The East Midlands is the UK's logistics heartland: Amazon, DHL, Pall-Ex, XPO and hundreds of regional operators. Route optimisation, automated warehouse management, dynamic workforce scheduling and demand forecasting are everywhere. The exposures stack up:
- UK GDPR & DPIAs for driver, picker and customer data flowing through your AI stack.
- Equality Act 2010 for workforce-scheduling and performance-monitoring AI that disadvantages protected groups.
- NCSC AI cyber-security guidance: your AI is now critical operational infrastructure.
- EU AI Act as a hard legal duty if your supply chains, fulfilment or carrier operations touch the EU.
What We Deliver
- AIME-based governance health check across the AI estate
- Article 22 / Equality Act review for workforce-scheduling AI
- NCSC-aligned AI security assessment for warehouse and routing systems
- EU AI Act compliance documentation for EU-facing supply chains
- UK GDPR DPIAs for driver, picker and customer data
Financial Services
Experian · Capital One · Nottingham Building Society
The Risk
Financial services has the deepest UK rulebook of any sector for AI:
- FCA/PRA SS1/23 on model risk management: the binding UK supervisory expectation for AI/ML models in regulated firms. This is your primary, today, legal-adjacent duty.
- DUAA 2025 Article 22 for any automated credit, insurance underwriting or pricing decisions with legal or similarly significant effects on customers.
- UK GDPR & DPIAs for high-risk processing across credit, fraud and onboarding.
- Equality Act 2010 for indirectly discriminatory model outputs.
- EU AI Act as a hard legal duty for credit scoring of EU consumers and for group entities operating in the EU.
Nottingham's cluster (Experian, Capital One UK, Nottingham Building Society and the regional professional-services sector) sits inside several of these at once.
What We Deliver
- SS1/23-aligned model risk management documentation for AI/ML models
- Article 22 audit for automated credit, insurance and pricing decisions
- UK GDPR DPIAs for high-risk processing
- Equality Act bias-risk review for credit and pricing models
- EU AI Act audit for EU-consumer credit scoring and EU-resident group entities
- Human oversight controls and explainability documentation
HR & Recruitment
In-house people teams · Recruitment agencies · RPO providers
The Risk
HR and recruitment is the single highest-exposure use of AI in UK SMEs today, and most teams don't know it. The stack of duties is dense:
- DUAA 2025 Article 22 directly governs automated CV screening, candidate ranking and any AI-driven hiring decision with legal or similarly significant effects.
- Equality Act 2010 is your real liability when a model produces biased outcomes against protected characteristics. We've seen unintended disparate-impact claims become career-defining for HR directors.
- UK GDPR & DPIAs are mandatory for high-risk processing of applicant data.
- EU AI Act explicitly names recruitment and employment AI as high-risk: a hard legal duty if you recruit EU candidates or use AI procured from EU vendors.
What We Deliver
- Article 22 audit of your ATS, CV screening and candidate-ranking AI
- Equality Act bias-risk review against protected characteristics
- UK GDPR DPIAs for applicant data processing
- Meaningful-human-involvement and contestability process design
- Staff AI-literacy training for recruiters and hiring managers (Article 4-aligned)
- EU AI Act high-risk evidence pack for cross-border hiring
Retail & eCommerce
Leicester · Nottingham · Online Retail
The Risk
For most UK-only retailers, the binding rules sit in UK law, not the EU AI Act:
- DUAA 2025 Article 22 bites where dynamic pricing, automated credit decisions or eligibility checks make significantly automated decisions about a customer.
- Equality Act 2010 is the real liability around personalised pricing or service delivery that disadvantages protected characteristics.
- UK GDPR & DPIAs for personalisation engines processing customer profiles.
- CMA guidance on price personalisation continues to harden.
EU AI Act exposure exists for cross-border eCommerce that ships into the EU, but for Leicester and Nottingham domestic retailers it's a benchmark, not a legal duty.
What We Deliver
- Article 22 audit for dynamic pricing and automated eligibility decisions
- Equality Act bias-risk review for personalisation engines
- UK GDPR DPIAs for customer profiling
- AI inventory and risk classification for the retail stack
- EU AI Act benchmarking for cross-border eCommerce
Agriculture & Food Production
Greenfield Opportunity
The Opportunity
The East Midlands agricultural sector is adopting AI fast (precision farming, yield prediction, supply-chain automation, food-safety monitoring) but governance investment is thin on the ground. The relevant duties for most farms and food producers are UK GDPR (any AI processing personal data of workers, contractors or customers), ICO guidance on data and AI, and, for anyone exporting to the EU, the EU AI Act as a forward benchmark.
Early movers on governance will be a step ahead of both competitors and incoming UK regulatory pressure. Talk to us if you want to be the first in your part of the supply chain with a proper framework in place.
What We Deliver
- AI systems audit for agricultural and food production operations
- Governance frameworks for precision farming and supply chain AI
- Regulatory readiness for incoming compliance requirements
If You Use AI, Something Applies to You
UK GDPR applies to nearly every UK business using AI with personal data. Article 22 of the DUAA applies whenever AI makes significantly automated decisions about people. Your sector regulator may have specific guidance too. Take the free 10-minute scorecard and we'll tell you which rules and benchmarks actually apply, and which don't.