Library
White paperMichael Clark
The Estate Nobody Owns
Retail vision and analytics estates were bought by five budgets, and no single function holds the list, yet the AI Act and UK GDPR attach to what each system does. The exposure sits where nobody has looked: staff captured by customer-facing systems, and the demographic categorisation layer that the ICO guidance does not cover. The first steps are to trace spend, put four biometric questions to each vendor, list outputs, name one owner and remediate mostly by configuration.
Key findings
- The law attaches to what a system does rather than to the budget that paid for it, so the exposure tracks the estate rather than any single decision about facial recognition.
- The UK enforcement record turns on the analysis (purpose, necessity, the Article 9 condition, consent, impact assessment and safeguards), not on who is watched.
- Staff are inside the Article 5(1)(f) emotion prohibition and customers outside it, so a customer-facing system that also captures staff can engage it.
In the paper
- The law attaches to what a system does
- The enforcement record turns on the analysis
- Where nobody has looked
- The list is the work
Michael Clark
Chief Executive Officer, Standard Intelligence
Your next step