Choose a light baseline, publish a short policy pack, create a simple use case register, and add minimum monitoring. Keep it to what your team will use every week. Expand only when risk grows.

Keep it simple and focused on outcomes. Name one owner, list AI use cases with a risk tier, publish clear guardrails, and add short reviews for high risk cases. Bake checks into your existing product and security processes. Scale the program as risk grows.

From September 12, 2025, new data processing service contracts (IaaS/PaaS/SaaS) must include a switching package: max 60-day notice, then a 30-day transition to port data/assets (extendable once), followed by ≥30 days for final retrieval, and complete erasure after. Switching charges (incl. egress fees) phase down to cost-based only until January 11, 2027, and are banned from January 12, 2027 (with a narrow multi-cloud exception). Providers must help customers reach functional equivalence on another like-for-like service and publish registers of formats/standards and relevant interfaces.