The Data You Send to AI Has Rules. Do You Know What They...

Section 1 — The Problem

The audit that surfaces a different kind of problem

Day nine. Marcus has been answering Harcastle's questionnaire for nearly two weeks. Five documents built, five questions answered. He is starting to see the shape of the AI governance framework Whitmore needed all along — the Policy, the RACI, the System Register, the Risk Register, the Impact Assessments.

Question six is different. It doesn't ask about governance documents. It asks about data.

Harcastle Group "Please provide your AI data governance framework — specifically: what categories of personal and financial data does each AI system in your register process? What is the lawful basis for each category of processing? How is data minimisation applied? What are the retention periods for AI-processed data? And how do you ensure that data processed through AI systems is not retained by vendors beyond your documented requirements?"

Marcus Osei He reads through the question carefully. Then he opens the AI System Register. He looks at AIMS-SYS-003 — the LexisNexis AML platform. He knows client transaction data goes in. AML risk scores come out. But how long does LexisNexis retain the data it processes? He looks at the contract. There is no AI-specific data retention clause. He checks the terms of service. There is a general retention clause — but it doesn't address the AI inference layer specifically.

Marcus Osei He looks at AIMS-SYS-004 — Experian credit scoring. Client financial data, including income information and credit history, goes in. What is the lawful basis for sending that data to Experian's AI? He knows the firm has a credit reference agreement with Experian. But does that agreement specifically cover the AI inference layer? He isn't certain. He looks at AIMS-SYS-002 — Microsoft Copilot. Internal emails and documents. Has the firm documented what Microsoft can and cannot do with data processed through Copilot's AI features?

Marcus Osei "I need a week I don't have."

This is Gap Six. Not a missing document — although the document is missing. A missing mental model: the understanding that data governance doesn't stop at the firm's database boundary. When personal data enters an AI system, all six UK GDPR data protection principles travel with it. And the firm must be able to demonstrate that they apply — not just in the database, but through the AI layer, through the vendor's inference infrastructure, and all the way to the output.

⚠

Warning ISO/IEC 42001:2023 Clause 8.3 requires organisations to ensure that data management practices for AI systems are documented and compliant with applicable data protection requirements. Under UK GDPR Article 5, the data controller — Whitmore & Associates, not the AI vendor — is responsible for demonstrating compliance with all six data protection principles for every category of personal data processed. The principle of accountability under Article 5(2) means the firm cannot satisfy this obligation by pointing to a vendor's general privacy policy. The firm must document its own compliance position for each AI system and each data category.

Section 2 — The Standard

What ISO/IEC 42001:2023 requires from Clause 8.3

ISO/IEC 42001:2023 — Clause 8.3 · Data Management for AI Systems

The organisation shall ensure that data used in the development, testing, and operation of AI systems is managed in accordance with applicable legal, regulatory, and organisational requirements. This includes ensuring that data quality, data provenance, data access controls, and data retention practices are appropriate for the AI system's intended use and comply with applicable data protection requirements.

Source: ISO/IEC 42001:2023 Clause 8.3. British English retained per ISO/IEC Directives Part 2.

The clause covers four dimensions: quality, provenance, access controls, and retention. In financial services, all four matter — and all four must be documented specifically for the AI layer, not just for the underlying database systems.

The six UK GDPR principles that travel with every piece of data into an AI system

Lawfulness, Fairness & Transparency UK GDPR Article 5(1)(a)

There must be a lawful basis for sending personal data to an AI system. The most common bases in finance: contract performance, legal obligation (AML screening), legitimate interests, or consent. The basis must be documented per data category — not assumed from the general client relationship.

Finance example → Is the lawful basis for sending client financial data to Experian's credit scoring AI the same as the lawful basis for the credit reference check itself?

Purpose Limitation UK GDPR Article 5(1)(b)

Data collected for one purpose cannot be repurposed for another without a new lawful basis. Data collected for AML screening cannot be fed into a credit scoring model. Data collected for client onboarding cannot be used to train a vendor's AI model without explicit consent.

Finance example → Is Experian using credit data to train or improve its AI models? If so, does the firm's credit reference agreement permit this?

Data Minimisation UK GDPR Article 5(1)(c)

Only the minimum necessary data shall be sent to an AI system. If the AI can perform its function with anonymised or pseudonymised data, identifiable data shall not be used. This is the principle that Jade violated by pasting full client names and portfolio details into ChatGPT when anonymised summaries would have served the same purpose.

Finance example → Does the Experian API require the client's full name and address, or would a pseudonymised identifier achieve the same credit score outcome?

Accuracy UK GDPR Article 5(1)(d)

Data sent to AI systems must be accurate and up to date. If stale or inaccurate data is fed into an AI, the output will reflect that inaccuracy — and decisions based on those outputs may harm individuals on the basis of wrong information. This principle connects directly to the model drift risk identified in F-G4.

Finance example → Is the credit data sent to Experian the most current available? Is there a process to update client records before they feed into AI scoring?

Storage Limitation UK GDPR Article 5(1)(e)

Personal data shall not be retained longer than necessary. This applies not just to the firm's own storage, but to data retained by AI vendors as a result of API calls. How long does LexisNexis retain transaction data submitted for AML screening? How long does Experian retain credit data submitted via API? These questions must be answered and documented.

Finance example → The LexisNexis contract has a general retention clause. It does not address AI inference data specifically. The firm does not know how long its clients' transaction data stays on LexisNexis infrastructure.

Integrity & Confidentiality UK GDPR Article 5(1)(f)

Personal data must be protected against unauthorised access, loss, or destruction — including while it is being processed by an AI system. This requires understanding what security controls the AI vendor applies to data during inference, and whether those controls meet the firm's obligations under UK GDPR Article 32.

Finance example → What encryption does LexisNexis apply to transaction data in transit and at rest during AI processing? Is this documented in the contract?

◈

ITIL 4 — Information Security Management Practice · Secondary: Service Configuration Management In ITIL 4, the Information Security Management practice requires that information assets are identified, classified, and protected according to their sensitivity. Personal data processed through AI systems is an information asset — one that is particularly sensitive because it crosses an organisational boundary into a vendor's infrastructure. REG-AIMS-FIN-DATA-001 functions as the AI-specific information asset register for data governance purposes, mapping each data category to its classification, lawful basis, minimisation status, and retention position. Service Configuration Management provides a secondary control: every data input to an AI system should be documented as a configuration attribute of that system, ensuring changes to data inputs are governed through the Change Enablement practice.

Section 3 — The FCA & ICO Position

The data governance gap the FCA is beginning to examine

The FCA's data management expectations have been building since the publication of its Data Strategy in 2022 and its operational resilience rules. The FCA increasingly expects firms to understand and document the data flows underpinning their important business services — and AI-assisted services are now within that perimeter.

The ICO's guidance on AI and data protection is explicit: organisations using AI to process personal data must be able to demonstrate compliance with all UK GDPR principles for that processing. A general data protection policy that makes no reference to AI systems does not satisfy this requirement. The ICO expects AI-specific data governance documentation.

The data flow map Whitmore did not have

Before building REG-AIMS-FIN-DATA-001, Marcus needs to understand exactly what data travels through each AI system. This is the data flow map — a visual representation of what goes in, what the AI does with it, and what comes out.

AI Data Flow Map — Whitmore & Associates (Illustrative)

AIMS-SYS-003 — LexisNexis AML Screening

Client
Transaction Data

→

LexisNexis
AML AI

→

Risk Score
+ Alert Flag

→

MLRO
Review

→

SAR Decision

Personal data Financial data Transaction counterparty names

Retention by LexisNexis: NOT DOCUMENTED IN CONTRACT · Lawful basis: Legal obligation (MLR 2017) · Minimisation: NOT ASSESSED

AIMS-SYS-004 — Experian Credit Scoring

Client Financial
Profile Data

→

Experian
Credit AI

→

Credit
Score

→

Credit Decision

Personal data Income & credit history

Retention by Experian: Credit Reference Agreement — does not specifically address AI inference layer · Lawful basis: Contract / Legitimate interests · Minimisation: NOT ASSESSED

AIMS-SYS-002 — Microsoft Copilot

Internal Emails
& Documents

→

Microsoft
Copilot AI

→

Drafts &
Summaries

Personal data (staff) Some client reference data

Retention by Microsoft: M365 Enterprise Agreement applies — data processed within tenant boundary · Lawful basis: Contract · Minimisation: Partially managed by M365 data residency controls

Section 4 — Gap Analysis

The anatomy of this nonconformance

Gap F-G6 — Nonconformance Taxonomy

Gap IDF-G6

ISO ClauseISO/IEC 42001:2023 Clause 8.3 — Data Management for AI Systems

SeverityCritical — personal financial data processed through AI systems without documented lawful basis, minimisation assessment, or vendor retention controls; UK GDPR accountability principle unmet

Current StateNo AI-specific data governance document exists. Data categories processed by each AI system have not been classified. Lawful bases for AI processing have not been documented separately from the underlying client relationships. Data minimisation has not been assessed for any AI system. Vendor retention periods for AI-processed data are undocumented or unknown.

Regulatory ParallelUK GDPR Art. 5 (all six principles) · UK GDPR Art. 5(2) (accountability) · UK GDPR Art. 32 (security of processing) · FCA data management expectations · ICO AI and data protection guidance

Commercial RiskHarcastle questionnaire question six cannot be answered. ICO investigation risk if AI data processing breach is identified. FCA data governance finding during supervisory review.

Required ArtefactREG-AIMS-FIN-DATA-001 — AI Data Governance Register for FCA-Regulated Financial Services Firms

Section 5 — What Marcus built

Building the data governance register — system by system

Classify every data element entering each AI system

For each system in REG-AIMS-FIN-SYS-001, Marcus catalogues every category of data the AI receives as input. Not just "client data" — specific categories: client name (personal data), transaction amount (financial data, not personal), transaction counterparty name (personal data of a third party), credit reference data (personal data under a credit reference agreement), internal email content (potentially contains personal data of staff and clients). Each element is classified against the UK GDPR taxonomy: personal data, special category data, or non-personal data. This classification determines which data protection principles apply and how stringently.

Document the lawful basis for each data category in each AI system

The lawful basis for the underlying client relationship does not automatically extend to the AI processing. For the LexisNexis AML platform, the lawful basis is legal obligation under MLR 2017 — that's clear. For the Experian credit scoring API, the lawful basis may be contract performance or legitimate interests — but this needs to be explicitly documented for the AI inference layer, not just assumed from the credit reference agreement. For Microsoft Copilot processing internal communications, the lawful basis is likely legitimate interests — documented in the firm's existing privacy notice — but the notice may not specifically mention Copilot's AI processing. Each gap is noted for remediation.

Conduct a data minimisation assessment for each AI system

UK GDPR Article 5(1)(c) requires that only the minimum necessary personal data is processed. For each AI system, Marcus asks: does this AI need all the personal data we are currently sending it? Could the same result be achieved with pseudonymised data? Could identifiers be removed and replaced with reference codes that the firm retains separately? For the Experian credit scoring API, the firm's contract specifies the data fields required — minimisation may already be built in. For the LexisNexis AML platform, the firm has been sending full transaction narratives including counterparty names — a minimisation review finds that some of these names can be pseudonymised at the point of API submission without affecting alert quality.

Document and enforce vendor data retention positions

The most uncomfortable finding of the data governance audit: the LexisNexis contract does not specifically address retention of data submitted via the AI inference API. Marcus contacts LexisNexis and requests written confirmation of their data retention position for API-submitted transaction data. While awaiting the response, he documents the gap as an open action in REG-AIMS-FIN-DATA-001 with a completion date. This is the correct approach — an open action with a deadline is demonstrably better than no action and no documentation. For Experian and Microsoft, retention positions are either confirmed in existing contracts or confirmed in writing within a week.

Update client privacy notices to reflect AI processing

UK GDPR Article 13/14 requires data controllers to inform individuals about the processing of their personal data, including where it is shared with third parties. Most firms' privacy notices predate their AI tool adoption and make no mention of AI processing. Marcus reviews the firm's client privacy notice and adds AI-specific language: a description of which AI systems process client data, the categories of data involved, the purpose, and the lawful basis. This does not require individual notification of existing clients in most cases — but it must be in the notice that is provided to new clients and available to existing ones on request.

The data governance register — illustrative extract

System	Data Category	Classification	Lawful Basis	Minimisation	Vendor Retention	Status
AIMS-SYS-003 LexisNexis AML	Client transaction data, counterparty names	Personal	Legal obligation — MLR 2017	Counterparty names: pseudonymisation under review	Not documented in AI layer — action open	In Progress
AIMS-SYS-004 Experian Credit	Client financial profile, income data	Personal	Contract / Legitimate interests — documented	Fields specified in credit reference agreement — confirmed adequate	Credit reference agreement applies — confirmed in writing	Documented
AIMS-SYS-002 MS Copilot	Internal emails, documents — may contain client references	Personal	Legitimate interests — M365 Enterprise Agreement	Processed within M365 tenant — data residency controls apply	M365 data retention policy applies — documented	Documented
AIMS-SYS-001 ChatGPT (OpenAI)	Client portfolio data, names — SUSPENDED	Personal	No lawful basis identified — breach under investigation	N/A — system suspended	OpenAI standard terms — no DPA in place	Suspended

◆

Caution Some firms attempt to satisfy data governance obligations by pointing to their existing Privacy Information Management System (PIMS) or Records of Processing Activities (ROPA). A general ROPA entry for "AI tools" does not satisfy either UK GDPR Article 30 or ISO 42001 Clause 8.3. The ROPA must include a specific entry for each AI system that processes personal data, with the lawful basis, data categories, retention period, and third-party recipients identified at the system level. REG-AIMS-FIN-DATA-001 is designed to be the AI-specific supplement to the firm's ROPA, providing the detail that a general "AI processing" entry cannot.

Section 6 — The Document

REG-AIMS-FIN-DATA-001 — what the fix document contains

REG-AIMS-FIN-DATA-001 — Document Control Block

Document IDREG-AIMS-FIN-DATA-001

TitleAI Data Governance Register — FCA-Regulated Financial Services Firms

Version1.0

Standard RefsISO/IEC 42001:2023 Cl. 8.3 · UK GDPR Art. 5, 13, 14, 30, 32 · ICO AI and data protection guidance · FCA data management expectations · ISO/IEC 27001:2022 Cl. 8.2

ContentsData flow mapping template (per system) · Data classification guide (UK GDPR taxonomy) · Lawful basis documentation template · Data minimisation assessment worksheet · Vendor retention confirmation template · Privacy notice AI addendum guide · ROPA supplement template

OwnerAIMS Programme Lead / Data Protection Officer (where appointed)

Approval AuthorityChief Executive (SMF1)

Review CycleAnnual; triggered upon new AI deployment, change in data inputs, vendor terms update, or ICO/FCA guidance development

Related DocsREG-AIMS-FIN-SYS-001 · REG-AIMS-FIN-RISK-001 · ASSESS-AIMS-FIN-IMP-001 · REG-AIMS-FIN-SUP-001 (F-G9)

Fix Document — Ungated Download

REG-AIMS-FIN-DATA-001 — AI Data Governance Register Template

ISO/IEC 42001:2023 Cl. 8.3 · UK GDPR Art. 5 & 30 · FCA · ICO Guidance · v1.0

Download Template →

Section 7 — Next Steps

After F-G6: Harcastle asks about clients

Marcus sends the completed data governance register to Harcastle — with the LexisNexis retention position marked as an open action with a committed completion date. Harcastle marks question six as provisionally satisfied.

Nine days into the questionnaire. Six gaps identified and documented. Three remaining. Nine days left in the window.

Question seven: "What disclosures do you make to clients regarding the use of AI in their service delivery? Please provide examples of how clients are informed when AI has been used in preparing their reports, assessments, or recommendations."

Marcus opens the most recent quarterly portfolio review that Jade sent to a Harcastle client. He reads it carefully. It was drafted using ChatGPT — before the system was suspended. There is no mention of AI anywhere in the document. Not in the covering letter. Not in the methodology section. Not in a footer note. The client received a report, prepared using AI, with no indication that AI was involved at all.

That is Gap Seven.

Remediation Sequence — Finance Series

✓ F-G1AI Policy — POL-AIMS-FIN-001 · Complete

✓ F-G2AI Accountability in SoRs — RACI-AIMS-FIN-001 · Complete

✓ F-G3AI System Register — REG-AIMS-FIN-SYS-001 · Complete

✓ F-G4AI Risk Assessment — REG-AIMS-FIN-RISK-001 · Complete

✓ F-G5AI Impact Assessment — ASSESS-AIMS-FIN-IMP-001 · Complete

✓ F-G6AI Data Governance — REG-AIMS-FIN-DATA-001 · This article

→ F-G7Client Disclosure — DOC-AIMS-FIN-DISC-001

F-G8Human Oversight — PROC-AIMS-FIN-HITL-001

F-G9AI Supplier Governance — REG-AIMS-FIN-SUP-001

Section 8 — Quality Gate Record

Quality gate record

The following gates were checked before publication. All 10 gates pass.

G1All claims carry named sources: UK GDPR Article 5 (six principles); UK GDPR Article 83 / ICO Enforcement Annual Report 2024 (£17.5M fine); ISO/IEC 42001:2023 Cl. 8.3; ICO AI and data protection guidance. No fabricated statistics.PASS
G2ISO/IEC 42001:2023 Clause 8.3 correctly cited and characterised. UK GDPR Article 5 principles correctly attributed and applied to AI processing context. Accountability principle (Art. 5(2)) accurately characterised — the controller must demonstrate compliance, not assume it from the vendor's privacy policy.PASS
G3Scenario consistent with REF-AIMS-FIN-SCEN-001. Marcus Osei (SMF16), Jade Nwosu (Relationship Manager), Harcastle Group (£28M AUM). Day 9 consistent with series timeline. Data flow map includes ChatGPT (AIMS-SYS-001) correctly marked Suspended — consistent with F-G3 discovery. All system IDs consistent with register.PASS
G4UK GDPR principles applied accurately. Lawful basis for AML processing (legal obligation under MLR 2017) correctly identified. Purpose limitation correctly characterised — AML basis does not extend to credit scoring without separate basis. Data minimisation requirement accurately applied. ROPA supplement correctly characterised as required at system level, not generic AI entry level.PASS
G5REG-AIMS-FIN-DATA-001 linked ungated. All document IDs F-G1 through F-G9 present and consistent with series registry. F-G9 (Supplier Governance) correctly referenced as related document — vendor retention positions connect to the supplier governance gap.PASS
G6Article links to predecessor (F-G5) and successor (F-G7). Series navigation present. Open action documented (LexisNexis retention position) — modelling correct practice for incomplete but documented governance.PASS
G7Disclaimer present as standalone section. All named parties identified as fictional. References to LexisNexis, Experian, and Microsoft are illustrative only. Article noted as educational only, not legal, regulatory, or data protection advice.PASS
G8REG-AIMS-FIN-DATA-001 document control block present with all mandatory fields: ID, version, title, status, standard refs, contents summary, owner, approval authority, review cycle, related documents.PASS
G9H1 includes primary keyword phrase "data you send to AI" — directly addressing the governance gap. Stat bar within first screenful. Schema.org Article JSON-LD with isPartOf series present. Canonical URL set.PASS
G10IEC 82079-1:2012 hierarchy correct. DANGER not used. WARNING for UK GDPR accountability principle — vendor policy insufficient. CAUTION for ROPA general entry being insufficient. NOTE not used in this article — ITIL notice carries the informational content. ITIL 4 notice covers Information Security Management and Service Configuration Management — both substantively mapped.PASS

← F-G5 — AI Impact Assessment ART-AIMS-FIN-G006 v1.0 · ISO 42001 Finance Series F-G7 — Client Disclosure →

The Data You Send to AIHas Rules.