This Checklist deals with areas of diligence and contractual terms relevant to personal data sharing by a customer with a vendor that is using generative AI (artificial intelligence that can create outputs such as text, images, video, or sound, referred to as Gen AI below) to provide services to the customer. We will refer both to the underlying Gen AI model and the AI system in which it operates as applicable, and will refer simply to Gen AI where vendors may be utilising either a Gen AI model or an AI system incorporating it. This Checklist only covers data protection issues under UK law (in particular, the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR)). It focuses on the salient points for Gen AI purposes when contracting in a data processing relationship, and should be read in conjunction with: Audit of a new or existing personal data processor—checklist and Stand-alone data processing

1 A term used in the regulation of domestic nuclear facilities and materials. The use of material control and accounting programs must verify that all special nuclear material is properly controlled and accounted for, and the physical protection equipment and security forces; and 2 As used by the IAEA, verifying that the "peaceful use" commitments made in binding non-proliferation agreements, both bilateral and multilateral, are honoured.

Exclusion under the Criminal Justice Act 2003 The admissibility of hearsay in criminal proceedings is governed by the Criminal Justice Act 2003 (CJA 2003). CJA 2003 allows for the admission of hearsay evidence if one or more of the statutory grounds of admissibility are satisfied. CJA 2003 also provides several safeguards, described by the Court of Appeal in Horncastle as a ‘crafted code’ designed to ensure that hearsay is admitted only when it is fair that it should be. See Practice Note: Admissibility of hearsay evidence. Practitioners may wish to begin by considering whether the hearsay evidence might be excluded entirely under CJA 2003, s 126 or section 78 of the Police and Criminal Evidence Act 1984 (PACE 1984), before considering what other safeguards might be deployed if it is admitted. General discretion to exclude Under CJA 2003, s 126, the courts have a discretion to exclude hearsay evidence where it is satisfied that the case for excluding the evidence, taking into account the danger that to admit it

Protection of confidential information is fundamental to your relationship with clients, both as a matter of law and as a matter of conduct. This duty continues despite the end of the retainer and even after the death of the client and can apply to prospective as well as current and former clients. There are four key issues that are relevant when considering whether you can act in a confidentiality situation: • what is material confidential information? • what is an adverse interest? • what is informed consent? • what does the common law say about effective safeguards including information barriers? This Practice Note discusses safeguards and information barriers. For guidance on the other issues, see Practice Notes: Material confidential information and adverse interests and Informed consent—law firm confidentiality. The duties of confidentiality and disclosure—SRA requirements You must keep the affairs of clients confidential unless: • disclosure is required or permitted by law, or • the client consents For more guidance on the general duty of confidentiality and the relationship between confidentiality and client conflict

Publication and approval In this Practice Note, ‘bank’ means a UK institution which has permission under Part 4A of the Financial Services and Markets Act 2000 (FSMA 2000) to carry on the regulated activity of accepting deposits (within the meaning of FSMA 2000, s 22, taken with Schedule 2 and any order under FSMA 2000, s 22) and any references to ‘bank’ below include a resolution company. Following the failure of Silicon Valley Bank, the government consulted on further reforms and in May 2025 enacted the Bank Resolution (Recapitalisation) Act 2025 (see: LNB News 19/07/2024 30). Note that these reforms are not limited to smaller banks and apply to banks of any size (provided they satisfy the other entry conditions) from 16 July 2025 onwards to help recapitalise in scope entities using FSCS funds rather than through taxpayer support, so reducing the risk that small bank failures post to public funds (see Practice Note: Bank resolution reforms under the Bank Resolution (Recapitalisation) Act 2025). Part 1 of

This Practice Note provides a comparison of the main differences between the EU, UK and the US in conducting safeguard investigations. EU UK US Has the Agreement on Safeguards been incorporated into national law? The EU has implemented EU legislation to incorporate the provisions of the Agreement on Safeguards. It uses three regulations to do so. Regulation (EU) 2015/755 regulates safeguard investigations from certain countries, these being Azerbaijan, Belarus, Kazakhstan, North Korea, Turkmenistan and Uzbekistan. Regulation (EU) 2015/478 regulates safeguard investigations for all other countries. The EU also employs Regulation (EU) 2015/936 for textile products imported from third countries which are not covered by bilateral agreements, protocols or other arrangements.This comparator makes use of Regulation (EU) 2015/478. The UK has implemented legislation to incorporate the provisions of the Agreement on Safeguards provisions into UK law. Schedule 5 to the Taxation (Cross-border Trade) Act 2018 sets out how to conduct a safeguard investigation and when safeguard duties may be imposed. The Trade Remedies (Increase in Import Causing Serious Injury to UK Producers) (EU Exit) Regulations 2019 contain

Law360, London: An appellate judge on 2 April 2025 reinstated a scaffolding manufacturer's three registered designs for builders' trestles, ruling that its many components all formed a single product rather than several alternative goods.

A documented body of evidence which is submitted to regulators to provide a convincing and valid argument that a specified system is safe for a given application in a given context or environment.

Safety Gate is the EU Rapid Information System for non-food products (formerly known as RAPEX). It does not cover pharmaceuticals and medical devices which are covered by other specific alert systems. Safety Gate ensures that information about dangerous products withdrawn from the market and/or recalled from consumers anywhere in Europe is quickly circulated between Member States and the Commission, so that appropriate action can be taken everywhere in the EU. 31 countries participate in the system, including Iceland, Liechtenstein and Norway. See the Safety Gate website.

A control rod used to decrease the reactor reactivity in the case of emergencies.

This Practice Note provides practical guidance on the safety and security requirements when importing and exporting goods to and from the UK. Introduction As a result of Brexit, the UK is no longer part of the safety and security zone with the EU. As a result, the UK had to implement safety and security border controls. It did so in a phased approach to ensure that the transition does not hinder trade. The following safety and security controls apply: • from 1 October 2021, all exports, unless exempt, had to comply with relevant export requirements • import and export declaration continue to apply when goods are entering or leaving the UK when coming from or destined for non-EU countries • from 1 January 2021, movements from the UK to Northern Ireland require the submission of an entry summary declaration • as of 31 January 2025, import requirements for goods from the EU will come into force (this was due to be implemented from 1 July 2022 and then 31 October 2024 but its implementation

In England and Wales, compliance health and safety legislation is enforced by the Health and Safety Executive (HSE) and local authorities. For information on the approach taken to the enforcement of health and safety law, including the ability of the HSE to charge for the cost of their investigations pre-charge, see: • Practice Note: Health and Safety Executive prosecutions policy • Practice Note: Powers of health and safety inspectors under the Health and Safety at Work etc Act 1974 • Practice Note: Improvement and Prohibition Notices under the Health and Safety at Work etc Act 1974 For information on the enforcement of health and safety law in Scotland, see: Scottish health and safety enforcement—overview. Statutory duty to ensure the health, safety and welfare of employees at work An employer must ensure, so far as is reasonably practicable, the health, safety and welfare at work of its employees. This is enshrined in section 2 of the Health and Safety at Work etc Act 1974 (HSWA