Trust and governance
Built to be trusted.
We built the Console so that the safeguards regulators now ask for are simply how it works. A person decides anything that matters. Agents say what they are. Every run leaves a record.
How the Console is built
A person decides
Agents draft and prepare. A person approves anything that leaves the business. Email is the clearest case: an agent writes the draft, a human sends it.
UK GDPR Articles 22A to 22D, in force since 5 February 2026, give people the right to human intervention on a significant automated decision, and the right to contest it.
Agents say what they are
When a Zarco agent posts in Slack or Teams, it identifies itself as an agent. Nobody has to wonder who they are talking to.
The EU AI Act's transparency duty applies from 2 August 2026. People must be told they are interacting with an AI system, within the interaction itself.
Every run leaves a record
Runs are logged. When an agent tells you something, it shows you where that came from.
Accountability runs through both regimes. You should be able to show what a system did, and on what basis.
Least privilege by default
People and agents get the minimum access the job needs, and every integration is scoped to the task in front of it.
Data minimisation under UK GDPR: collect and use only what the purpose actually requires.
Where the rules stand
Current as of 29 July 2026
The EU AI Act
- Feb 2025
Bans on unacceptable-risk uses took effect, alongside a duty to build AI literacy in the teams using these systems.
- Aug 2025
Obligations for general-purpose AI models took effect.
- 2 Aug 2026
Transparency. People must be told when they are interacting with an AI system, and generative output must be machine-readable as AI-generated.
- Dec 2027
Standalone high-risk systems. Moved back from August 2026 by the Digital Omnibus, which the European Parliament approved in June 2026.
- Aug 2028
High-risk AI built into regulated products.
The UK
- Today
There is no UK AI Act and no AI bill before Parliament. Existing law is applied to AI by the sector regulators: the ICO wherever personal data is involved, the FCA, Ofcom, the CMA and the professional bodies elsewhere.
- 5 Feb 2026
The Data (Use and Access) Act 2025 replaced UK GDPR Article 22. Solely automated decisions with significant effects are allowed where safeguards are in place: tell the person, let them make representations, give them a human to go to, and let them contest the outcome.
- Expected
The ICO has held a statutory duty since May 2026 to produce a code of practice on AI and automated decision-making. Final guidance is expected this year, with the statutory code to follow.
Personal data
We handle personal data under UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Never used to train models
Your data trains nothing. It is used to do the work you asked for, and that is the whole of it.
A written agreement, every time
We provide a data processing agreement for every engagement, so the terms are on paper before the work starts.
UK or EU, on request
Data can be kept in the UK or the EU where that matters to you.
Only what the task needs
We collect what a job requires, keep it while it is useful, and never sell it.
The Console runs on models from Anthropic and OpenAI, is hosted on Vercel and stores data in Supabase. How this website handles your own data is set out in the privacy policy.
Certifications we are working towards
Cyber Essentials
The UK government-backed baseline for everyday cyber hygiene.
Working towardsCyber Essentials Plus
The hands-on, independently tested tier of Cyber Essentials.
Working towardsISO/IEC 27001
The international standard for managing information security.
Working towardsSOC 2
Independent attestation of our security controls over time.
Working towardsWant our security posture or a data processing agreement in writing? Email luke@zarco.uk.