Most AI compliance problems are not exotic. They are ordinary engineering oversights that become regulatory exposure the moment personal data enters the pipeline. These are the ones we see repeatedly.
The retrieval index nobody scoped
A knowledge assistant is pointed at a shared drive. The drive contains an HR folder. Salary figures, performance notes and identity documents are now embedded in a vector index with no access control, and every employee who can ask a question can reach them.
The fix is not clever, it is just work: classify before you index, filter retrieval by the requesting user's permissions, and treat the index as a system holding personal data — because it is.
Erasure that stops at the database
A deletion request is honoured in the primary database. The same personal data remains in the vector index, in prompt logs, in a caching layer and in whatever the model was fine-tuned on. Partial erasure is a finding, not a defence.
Logs as the quiet second database
Prompt and response logs are indispensable for debugging and evaluation — and they accumulate every piece of personal data a user ever pasted in, usually with no retention policy and broader internal access than the source system had.
- Set a retention window and enforce it with a scheduled job, not a reminder
- Redact identifiers at write time where the log's purpose does not require them
- Apply the same access controls the source system uses
- Include the log store in your data inventory, because a reviewer will
Consent notices written before AI existed
Data collected under a notice describing service delivery is then used to train or ground an internal model. That is a purpose the notice did not cover. The engineering is fine; the paperwork is not, and the paperwork is what gets assessed.
Cross-border processing that nobody mapped
A commercial API endpoint sits in another jurisdiction. That may be entirely permissible — but it needs to be a documented decision with a named region and a processing agreement, not an unexamined default inherited from a tutorial.
The pattern across all five is the same: the model is not the risk surface. The data pipeline around it is. Systems designed with classification, permissions, retention and logging from the first commit pass review. Systems that add them after a questionnaire arrives usually need rebuilding.