Legal Precedents

We understand how vital it is to offer a site that can be used by every audience, including people with disabilities or impairments alike. Where feasible, we have added streamlined features so our content is accessible to anyone who uses assistive technology or may otherwise find standard functions difficult to use as well. We strive to deliver full accessibility across all content on our website; however, please note some older pages may not yet be compatible with every accessibility feature. In addition, third-party content, such as other websites we link to, may not be as accessible as our own website. Help or feedback We remain firmly committed to ongoing accessibility improvements......

Precedent senior manager identification spreadsheet This spreadsheet is intended to capture the initial stage of your corporate criminal liability risk assessment—pinpointing your senior managers and the extent of their authority. It enables you to target training and other risk controls where they will have most effect. It is meant to be used in conjunction with Precedent: Corporate criminal liability—risk assessment. The Economic Crime and Corporate Transparency Act 2023 ( ECCTA 2023) widened corporate criminal liability for the conduct of senior managers. The practical consequence is that commercial organisations are far more vulnerable to committing criminal offences than at any point previously......

1 Introduction 1.1 [ Insert organisation name ] is proud of how we run our affairs. Our Code of ethics sets out the principles and rules that govern our operations. It binds everyone here. Please read the Code carefully, ensure you understand it, and let it steer your day‑to‑day work. If you are unsure about the Code or how it applies, speak with [ insert, eg your manager ] 1.2 [ Insert organisation name ] operates a zero‑tolerance policy on employees engaging in criminal conduct 1.3 From 26 December 2023, under the Economic Crime and Corporate Transparency Act 2023, if a senior manager, acting within their actual or apparent authority, commits a relevant offence, the organisation is likewise guilty of that offence 2 Senior manager 2.1 A senior manager is an individual who plays a pivotal role in: ...

1 Introduction 1.1 We have carried out an organisation-wide review of exposure to corporate criminal liability risks. This was undertaken by engaging key stakeholders, including the organisation’s senior figures. Many of the risks mirror those already highlighted through our crime-prevention compliance frameworks, including risk assessment procedures under the Bribery Act 2010, facilitation of tax evasion, failure to prevent fraud, anti-money laundering ( AML), counter-terrorist financing ( CTF), counter-proliferation financing, etc. We also evaluated broader corporate criminal liability risks as part of this exercise. 1.2 This document sets out the risks assessed, the conclusions reached, and the actions we deem necessary arising from the review. 1.3 The review considered: 1.3.1 who qualifies as a ‘senior manager’ and the extent of their authority; 1.3.2 our governance and oversight arrangements; 1.3.3 the offences captured by the corporate criminal liability provisions within the Economic Crime and Corporate Transparency Act 2023 ( ECCTA...

This register was created in Excel, so it cannot be exported to Word. It is illustrative and completely editable within Excel, allowing you to tailor it to your organisation’s particular requirements. Purpose of an It enables you to collate, in one central place, the risks to your organisation linked to the use of artificial intelligence ( AI). You can also record how you plan to manage and monitor those AI risks, making it easier to keep track of any actions you have taken or still need to take......

1 AI project overview 1.1 Project aims and benefits Project overview [ Provide a concise synopsis of the project ] Intended outcomes [ Set out what the project is designed to accomplish ] Success measures [ Insert ] Expected advantages for the organisation, people and/or other stakeholders [ Describe expected advantages for the organisation, people and/or other stakeholders (including, where relevant, the broader public) ] 1.2 DPIA screening Result of DPIA screening—refer to Appendix 1 ☐ DPIA required under the GDPR ☐ DPIA not required under the GDPR, but undertaken voluntarily ☐ DPIA not required under the GDPR and no DPIA will be carried out—[ explain why a DPIA is unnecessary ] 2 AI tool and provider AI tool name [ Insert ] Purpose of the AI tool [ Insert a brief explanation of what the AI tool is intended to do, noting if your planned use aligns with this ] AI...

Precedent training presentation This Precedent training deck serves as a practical tool for educating your team on applying artificial intelligence ( AI) at work. It clearly outlines, in plain terms, what AI means and the key categories of AI, including generative AI. It also details the organisation’s core AI principles (see Precedent: Responsible AI principles), together with a summary of both the advantages and potential risks associated with using AI in the workplace......

This document offers a straightforward overview of key terms you might encounter in relation to artificial intelligence ( AI). If you would like additional clarification or guidance on any other terminology, please contact [ state who ] Agentic AI AI systems composed of agents that can act and interact independently to fulfil their goals. Artificial intelligence There is no single agreed definition of artificial intelligence ( AI). In general, it refers to machines—usually computer systems—replicating human intelligence. AI tool or AI system Software and computing systems that emulate human intelligence. AI tools can learn, solve problems, make decisions, and interpret language. In contrast, non- AI, pre-programmed tools typically follow the same set of rules each time unless a human changes those rules. An AI tool can learn and adapt without human involvement......

1 Introduction 1.1 [ Insert organisation’s name ] acknowledges AI’s capacity to reshape our working methods and enhance the [ products and ] services we deliver. 1.2 We pledge to deploy AI safely and responsibly, upholding privacy, confidentiality, and the rights of third parties. This commitment extends to any AI operated by third parties for us. 1.3 As with many organisations, we increasingly rely on advanced analytics and technology to provide our [ products and ] services. These Principles explain how we employ AI in our operations. They rest on our dedication to corporate responsibility, which we describe as [ insert, eg the way we do business, working proactively to increase our positive impact and prevent negative impact ]. 1.4 In general, we use ‘artificial intelligence’ to denote machine-based systems that infer answers to defined tasks with some...

1 General information Report date [ Insert date ] Previous report date [ Insert date ] Name and position of report submitter [ Insert name and position, eg Risk Management Director or Compliance Officer ] 2 Review of action points arising from last report Action [ Insert action point ] — Lead [ Identify person responsible ] — Status [ Describe status ] Action [ Insert action point ] — Lead [ Identify person responsible ] — Status [ Describe status ] Action [ Insert action point ] — Lead [ Identify person responsible ] — Status [ Describe status ] Action [ Insert action point ] — Lead [ Identify person responsible ] — Status [ Describe status ] 3 Executive summary 3.1 This report presents: 3.1.1 an overview of business activities; 3.1.2 an...

1 General information Review date [ Insert date ] Reviewer(s) [ Insert name ] 2 Data Criteria During the past [ insert period eg quarter ] Across the previous 12 months Total internal reports of suspected modern slavery or human trafficking, if applicable. [ Insert number ] [ Insert number ] Total internal reports of confirmed modern slavery or human trafficking, if applicable. [ Insert number ] [ Insert number ] Total supplier reports of suspected modern slavery or human trafficking, if applicable. [ Insert number ] [ Insert number ] Total supplier reports of confirmed modern slavery or human trafficking, if applicable. [ Insert number ] [ Insert number ] Total supplier audits completed. [ Insert number ] [ Insert number ] Suppliers requiring remedial action as a consequence of audit......

1 Introduction 1.1 [ Insert organisation’s name ] acknowledges the potential of artificial intelligence ( AI) to reshape how we work, enhance the services we deliver, and bolster our competitiveness. 1.2 We are committed to using AI tools in a safe and responsible manner, upholding confidentiality and third-party rights. This also includes any AI tools used by third parties acting on our behalf. 1.3 This policy guides staff on the use [ and deployment ] of generative AI ( Gen AI) tools in the course of your work, explains when we may monitor the use of Gen AI, and states the action we will take if this policy is breached. It should be read alongside other policies relevant to the use of AI in the workplace, for example: 1.3.1 data protection policy 1.3.2 information security policy 1.3.3 confidentiality policy 1.3.4 equality policy 1.3.5 harassment and bullying...

Privileged and Confidential—not for circulation DRAFT Date [ Enter date ] Prepared by [ State who prepared this document, eg [ external lawyers ] ] External lawyers used [ Provide particulars of the external lawyers instructed in your investigation process ] Purpose of the investigation [ Outline the purpose of the investigation, eg to advise the business on the incident on [ insert date ] ] Procedures followed [ [ Include details of the procedures followed during the investigation ] ]......

Source of funds and source of wealth sits within the anti-money laundering, counter-terrorist financing and counter-proliferation financing regime, yet the topic is often poorly understood. This guide highlights frequent myths, including: Source of funds and source of wealth are identical My role is only to verify the customer’s identity I must prove the money is legitimate If money originates from a UK bank, it is automatically clean It’s impolite to ask Risk assessment and software alone will resolve the issue Source of funds and source of wealth are the same They are not the same; while there is significant overlap, they are interrelated and should not be considered in isolation. The Financial Action Taskforce ( FATF) provides the following definitions for these terms. Source of funds refers to the origin of the specific funds or other assets that are the subject of the business relationship (e.g. the amount being...

When choosing an electronic verification provider, you should be able to show sufficient understanding of the provider’s (i) system inputs; (ii) the data sources the system uses to confirm identity; (iii) the system’s outputs and what they signify; and (iv) how the system aligns with the relevant provisions of the Money Laundering, Terrorist Financing and Transfer of Funds ( Information on the Payer) Regulations 2017 ( MLR 2017), SI 2017/692, as amended. Completing this questionnaire will help you reach a risk‑based judgement on whether, at its stated level of assurance, the provider’s systems deliver an appropriate degree of reliability and independence given the potential risks. 1 General Company name [ Insert company name ] Registered address [ Insert address ] Main country of operation [ Insert country ] Additional countries of operation [ Insert country ] Primary contact (name, role and contact information) [ Insert primary contact ] What are the...

1 General Company name: [ Insert company name ] Address: [ Insert address ] Principal country of business: [ Insert country ] Other countries of business: [ Insert country ] Primary contact (name, title, and contact details): [ Insert primary contact ] Hours of operation: [ Insert details ] Pricing structure: [ Insert details ] Supplier’s standing in the sector and its dealings with regulators: [ Insert details ] 2 Technology and functionality How does the system identify and highlight transactions or activities that call for further review?......

STOP PRESS: This document is currently being revised to reflect the implementation of the Data ( Use and Access) Act 2025 ( DUAA 2025), which updates the UK GDPR and the Data Protection Act 2018. For further guidance on the compliance impacts of DUAA 2025, see Practice Note: Data ( Use and Access) Act 2025—compliance implications. 1 Background information 1.1 Name of organisation [ Insert name ] Name and position of person(s) preparing this policy document ( APD) [ Insert name ] Date of APD [ Insert date ] APD review date or frequency [ Insert, eg annually, six monthly etc ] 1.2 [ This appropriate policy document should be read alongside our: ] 1.2.1 internal data protection policy; 1.2.2 customer-facing privacy policy; 1.2.3 records management policy and retention schedule; 1.2.4 [ [ data processing register ] ] ; 1.2.5 [ [ Add...

1 General information Review date [ Insert date ] Reviewer(s) [ Insert name(s) ] 2 Data analysis Criteria During the past [ insert period, eg quarter ] Across the previous 12 months Total complaints received [ Insert number ] [ Insert number ] Categories of complaints received ☐ No reply to a data subject request—[ insert number ] ☐ Incomplete reply to a data subject access request ( DSAR)—[ insert number ] ☐ Personal data security incident—[ insert number ] ☐ Incorrect personal data—[ insert number ] ☐ Unsuitable data sharing—[ insert number ] ☐ Direct marketing—[ insert number ] ☐ Retaining data for too long—[ insert number ] ☐ Using personal data for purposes not notified to the data subject ☐ Going beyond the scope of consent—[ insert number ] ☐...

This Precedent This Precedent is designed for private-sector commercial organisations in the UK. It enables you to keep a log of data protection complaints, recording each complaint’s category, whether it was ultimately resolved, and, if so, the way it was......

1 General information Date complaint received [ Enter date ] How was the complaint received? ☐ Email ☐ Letter ☐ In person ☐ Telephone ☐ Other—[ please specify ] When replying to the complainant, choose the most appropriate communication method. Date complaint acknowledged [ Enter a date that should be 30 days from the date you received the complaint. ] Proposed deadline for responding to complaint [ Enter a date that meets the expectation that you will handle the complaint without any delay. ] Person investigating complaint and completing this record [ Provide details of the individual who investigated the complaint and completed this report. This could be your data protection officer. ] Date of report [ Enter date ] 2 Complainant Name of data subject ......