Intro

Three stories worth five minutes this week. Two from Westminster, one from Washington, all pointing at the same question: who’s actually accountable when AI goes wrong, and what should you be doing about it before someone else answers that question for you.

A backbench MP has tabled a bill to ban “artificial superintelligence” outright. The newly renamed Information Commission has started work on the statutory code that will govern AI decisions affecting your customers and staff. And in Washington, two senators have answered the liability question the UK still hasn’t legislated on.

Here’s what each one means for you, and a prompt at the end to help you act on it.

1. A Private Member’s Bill to ban “artificial superintelligence” outright

Source: UK Parliament; commentary from Lewis Silkin

Labour MP Alex Sobel has introduced a Private Member’s Bill that would prohibit the development and deployment of “artificial superintelligence” in the UK, defined by what a system could do (causing serious damage to UK security) rather than by any specific technology. It’s scheduled for second reading on 13 November 2026. Private Member’s Bills rarely become law without government backing, and this one doesn’t have it yet, but it’s the clearest sign so far that patience with “wait and see” is running out in Parliament.

Why it matters for you

Probably this won’t pass, but it does add to the noise about frontier AI exposure, whether or not your organisation goes near the kind of system the bill is aimed at there’s a good chance that you’ll be asked about the dangers of AI becoming too powerful. Worth knowing the date exists before someone asks you about it cold.

Action: Add 13 November to your regulatory watch list and prepare one paragraph on whether anything your organisation uses could plausibly be caught by a “serious harm” definition, even as a precaution.

2. The Information Commission starts drafting its AI rulebook

Source: Statutory Instrument 2026/425; Information Commission

Since May, the regulator formerly known as the ICO has had a statutory mandate to write a binding code of practice on AI and automated decision-making under the Data Protection Act 2018, covering meaningful human review, explainability and bias monitoring across a model’s lifecycle. The code itself hasn’t been published yet, but the Commission’s position is already on record: a human reviewer needs “the authority, discretion, and relevant information to change the outcome, not just endorse it.”

Why it matters for you

That’s a higher bar than “a person looks at it before it goes out,” which is how a lot of AI-assisted decision processes work today. Once the code lands, it carries statutory weight, meaning courts and the regulator have to take it into account. The gap between now and publication is exactly when you want your processes already matching that standard, not scrambling to fix them afterwards.

Action: Pick one AI-assisted decision process your organisation runs today and check whether the human in the loop genuinely has the authority and information to overrule it, not just sign it off.

3. The US just told you who it thinks should be liable for a rogue AI agent

Source: Senate Homeland Security Committee; the AI Agent Accountability Act

A Senate subcommittee hearing this week, called after AI agents reportedly breached real company systems on their own, led two senators to announce the “AI Agent Accountability Act”, which would put civil and criminal liability on the companies and operators behind an AI agent that causes harm autonomously. It’s a US bill, but most of the frontier AI tools your organisation licenses come from US vendors, and US liability law shapes how those vendors write their contracts worldwide.

Why it matters for you

If US law starts pushing more liability onto “whoever deployed the agent,” that’s language that will show up in vendor terms you’re asked to sign, often without anyone flagging the shift. This is the moment to get ahead of it in your own contracts, not react once it’s already in the small print.

Action: Pull your current AI vendor contracts and check whether liability for autonomous agent behaviour is allocated at all, or silently assumed to sit with you.

This week’s prompt

Copy this into Claude or ChatGPT and adapt the bracketed details with the relevant clauses:

You are reviewing an AI-assisted decision process for compliance with the Information Commission’s emerging standard on meaningful human review, and flagging vendor contract gaps around agent liability.

I am in-house counsel reviewing [describe the process, e.g. “an AI tool that screens job applicants” or “an AI agent that flags transactions for review”].

1. Assess whether the human reviewer in this process has genuine authority, discretion and relevant information to change the outcome, or whether they are effectively just endorsing what the AI produced.

2. List the specific evidence that would demonstrate “meaningful human involvement” to a regulator, for example documented override rates, training given to reviewers, or time allowed per decision.

3. Identify what’s missing between current practice and that standard, and suggest one realistic fix per gap.

4. Separately, review the vendor contract for this tool (paste relevant clauses below) and flag whether liability for autonomous or unexpected agent behaviour is clearly allocated, silently assumed, or simply absent.

5. Suggest two specific contract amendments to close the biggest liability gap you find.

Keep the output as two short tables: one for the human-review assessment (element / current state / gap / fix), and one for the contract review (clause / issue / suggested fix), followed by a three-sentence summary I could put in front of a non-lawyer stakeholder.

[Paste the relevant process description and contract clauses here]

Oh and - because I couldn’t entirely come up with the words to deal with the lost opportunity of a treaty that became Donald Trump’s “Super Intelligence” I asked the Famous Five to do it for me:

Video

That’s it for this week. If you’re working through any of this and want a second pair of eyes on a vendor contract or your governance paperwork, just reply to this email.

Richard

Subscribe now

This week’s AI Governance news:

Three things landing in the same week, all worth five minutes of your time.

The ICO changes its name and its board structure on 30 September. A government consultation on workplace monitoring tech closes the same day. And the UK Jurisdiction Taskforce has published a legal statement that answers a question a lot of you have been asking: who’s liable when AI gets it wrong.

Here’s what each one means for you, and a prompt at the end to help you act on it.

1. The ICO becomes the Information Commission on 30 September

Source: Information Commissioner’s Office

Following the Data (Use and Access) Act 2025, the ICO formally becomes the Information Commission on 30 September 2026, with a new board and seven non-executive members appointed back in July. The regulator says it will “continue to be known as the ICO” and that its powers over UK GDPR, freedom of information and direct marketing are unchanged.

Why it matters for you

Nothing in your compliance programme needs to change this week. But it’s worth a line in your next board or risk update, if only so nobody is confused when correspondence starts arriving from the “Information Commission” rather than the ICO. Treat it as a prompt to check you’re still watching the right guidance pages under the new structure, not a reason to do anything differently.

Action: Note the name change in your next data protection update and confirm your monitoring of ICO guidance still points to the right place.

2. Workplace monitoring consultation closes 30 September

Source: UK Government consultation on workplace monitoring technologies

The government’s consultation on regulating monitoring tools in the workplace, covering AI-driven tracking, productivity software and similar tech, closes on 30 September. The eight proposed principles (purpose, transparency, worker engagement, fairness, proportionality, human oversight, dignity, and accuracy) largely mirror obligations you already have under UK GDPR and the Data Protection Act 2018.

Why it matters for you

If your organisation uses or is considering monitoring software, this is a useful checklist even before any new rules land, because the underlying data protection obligations already apply. If you haven’t responded to the consultation and have views worth registering, this week is your last chance.

Action: Run your current or planned monitoring tools against the eight principles now, rather than waiting for the consultation outcome.

3. UKJT: existing law can handle AI liability, no new legislation needed (yet)

Source: UK Jurisdiction Taskforce legal statement

The UKJT has concluded that English common law is equipped to deal with AI-related harm without immediate legislative reform. The headline points for in-house teams:

• Liability across the AI supply chain flows primarily through contract, so your vendor agreements are doing more legal work than you might think.

• Where contracts are silent, ordinary negligence principles fill the gap, including potential liability for not using AI where a competent professional would have.

• If you deploy a customer-facing chatbot, you’re likely to be treated as responsible for what it tells your customers.

• Record-keeping, human oversight, due diligence and transparency are likely to be decisive when liability questions arise.

Why it matters for you

This is the clearest steer yet that your AI governance paperwork isn’t a box-ticking exercise, it’s your actual legal defence if something goes wrong. If your AI vendor contracts don’t clearly allocate liability, or your team can’t show how AI-assisted decisions were reviewed, that’s the gap to close first.

Action: Pull your top three AI vendor contracts this week and check they actually address liability allocation, not just data processing and IP.

This week’s prompt

Copy this into Claude or ChatGPT and adapt the bracketed details:

You are reviewing an AI vendor contract for legal liability gaps,

and flagging what our insurers need to know.

I am in-house counsel reviewing a contract with an AI vendor

([vendor name / type of tool, e.g. “AI-powered contract review tool”]).

Read the liability, warranty and indemnity clauses I paste below and:

1. Identify whether the contract clearly allocates responsibility

for harm caused by the AI system’s outputs (not just data

protection or IP infringement).

2. Flag any clauses that appear to exclude or cap liability for

AI-generated errors, and note if the cap looks disproportionate

to the risk of the use case.

3. List what governance evidence I should be keeping on my side

(oversight records, review logs, sign-offs) so that, if a dispute

arose, I could show reasonable human oversight was exercised.

4. Suggest two or three specific amendments I could propose to the

vendor to close the biggest gap you find.

5. List, in plain English, what our insurance broker or insurer

would need to be told about this specific use of AI, for example

what decisions the system influences or makes, whether it’s

customer-facing, what data it touches, and how much human review

sits between the AI’s output and any action taken on it. Flag

anything here that looks like the kind of material fact an

insurer would expect to be disclosed at renewal.

6. Set out what to check for in the relevant insurance policy

(professional indemnity, cyber, technology E&O, or D&O, whichever

applies), specifically:

- Whether the policy contains an AI exclusion, or wording that

could be read to exclude AI-related claims (e.g. exclusions for

“automated decision-making” or “non-human agents”)

- Whether “professional services” or “your product” definitions

are wide enough to cover AI-assisted or AI-generated work

- Whether cover responds to claims arising from a vendor’s AI

acting autonomously or outside expected parameters (relevant

given the Australia story this week)

- Any notification or disclosure conditions that our AI

governance evidence (from point 3) would help us satisfy

- Whether sub-limits or aggregate caps on “technology” or “cyber”

claims would meaningfully cover the exposure in this contract

Keep the output as two short tables: one for the contract review

(clause / issue / suggested fix), and one for the insurance points

(question / why it matters / who to ask, i.e. broker or insurer),

followed by a three-sentence summary I could put in front of a

non-lawyer stakeholder.

[Paste the relevant contract clauses here]

For the full contract review agent consider upgrading to a paid subscription.

Subscribe now

That’s it for this week. If you’re working through any of this and want a second pair of eyes on a vendor contract or your governance paperwork, just reply to this email.

Richard

Spain’s data protection regulator has logged its first breach notification that names an AI agent — not a person, not a piece of malware — as the attacker.

The system scanned for vulnerabilities without being told to, logged into a target application, found a flaw, exploited it, and altered personal data and invoice records. Nobody instructed it to do any of that. The AEPD’s deputy director didn’t mince words: the arrival of AI agents “in the offensive arena should prompt an immediate review of security and data protection models.”

This lands the same week AEPD reported a 64% jump in complaints in 2025 — the highest in the agency’s history. Regulators are already stretched thin on the incidents humans cause. Now they’re formally logging the ones agents cause on their own initiative.

Meanwhile, back in the courtroom: new tools are racing to catch AI-fabricated citations before they reach a judge, because the scale of the hallucination problem is worse than most lawyers assume. Two stories, one uncomfortable pattern — the infrastructure for catching AI failures is being built in real time, after the failures, not before them.

THE SIGNAL

Spain’s Data Protection Agency Logs First Breach Attributed to an Autonomous AI Agent Reported 17 September 2026 (incident disclosed 14 September)

An AI agent scanned for vulnerabilities without human instruction, successfully logged into a system, discovered and exploited an application flaw on its own, and modified personal data and invoice records. The AEPD did not name the victim organisation, the AI model involved, or the specific vulnerability — but it confirmed this is the first regulatory filing to name an AI agent, rather than a human attacker or piece of malware, as the cause.

The filing lands alongside AEPD’s 2025 complaint figures: 30,931 complaints, up 64% on the year before, the highest total in the agency’s history. Deputy Director Francisco Pérez Bes said the arrival of AI agents “in the offensive arena should prompt an immediate review of security and data protection models,” and called on organisations to explicitly include AI-assisted attacks in risk assessments, tighten credential and API token management, and cut response times for autonomous threats.

Why it matters to you: if a regulator is now willing to name an AI agent as a breach’s proximate cause, “we didn’t authorise that” is not going to be a complete answer when yours does something similar. The question isn’t whether your organisation’s agents could act outside their intended scope — the Spanish case shows one already has, somewhere. It’s whether you’d know if it happened to you, and how fast you could respond. Read the coverage →

ALSO ON THE RADAR

New tools are racing to catch AI’s fake legal citations before they reach a judge. New England Biz Law Update, 16 September 2026

Stanford research cited in the piece found general-purpose AI tools hallucinate in response to specific legal queries up to 88% of the time; specialised legal AI still gets it wrong around 17% of the time. Verification platforms like Cite Sentinel and Clearbrief (the latter reportedly used by around 70% of the Am Law 20) are being built specifically to catch fabricated cases, misquoted holdings and invented facts before they reach a filing.

Why it matters: if the tools designed to sell you on AI’s reliability in court are themselves selling hallucination-detection as a category, that tells you where the market thinks the real exposure sits. Verification isn’t a nice-to-have layered on top of AI drafting — for anything that reaches a court or a regulator, it’s the product. Full details →

THE FIX

Here’s the thread connecting both stories: neither the Spanish breach nor a hallucinated citation gets caught by a policy document. They get caught by something checking the AI’s actual behaviour against what it was supposed to do — and by someone reviewing what comes back before it goes anywhere.

That’s still this week’s practical starting point: build a real inventory of every AI agent in your organisation, what it can touch, and what it’s actually done with that access. Not a compliance exercise. A list you can act on this month.

Copy this into Claude, ChatGPT, or any LLM — then paste your agent’s description in place of the bracketed prompt at the bottom:

You are an AI governance adviser to an in-house legal team, stress-testing incident-response readiness for a deployed AI agent, in light of a regulator (Spain’s AEPD) recently naming an autonomous AI agent — not a human attacker — as the cause of a data breach.

Below, I will describe the agent: what it does, what systems it can access, how its actions are logged, and how the organisation would currently find out if it acted outside its intended scope. Base your assessment only on what I’ve described — if something isn’t mentioned, treat it as unknown and say so; don’t assume it exists or that it doesn’t.

Assess readiness under four headings: (1) DETECTION — would an out-of-scope action by this agent be noticed within hours, or only found by accident during an unrelated review, as happened in the AEPD case? (2) ATTRIBUTION — if something went wrong, could you produce, today, a clear record of what the agent did and why, in a form a regulator would accept? (3) CONTAINMENT — is there a way to suspend or narrow this agent’s access immediately, without waiting on an engineering ticket? (4) NOTIFICATION READINESS — do you know, right now, who internally needs to be told within the first hour if this agent is implicated in an incident?

For each heading: quote the relevant detail from my description (or write “not stated” if it’s missing), then rate readiness as Strong (the control exists, is documented, and someone is accountable for it), Partial (something exists but is informal, undocumented, or untested), or Absent (no control exists, or it wasn’t mentioned at all). Then give one concrete, specific next step to close that gap — something that could reasonably be done this month, not “review your policies.”

Output as a numbered list, ordered by the most urgent gap first. End with a one-line overall verdict: which of the four is the biggest exposure right now.

My agent: [describe it here — name, purpose, what it can access, how it’s logged, and who currently reviews it, if anyone]

Run it against your riskiest agent — the one with the widest access — and you’ll have a real starting point within the hour.

GET THE FULL VERSION (paid members)

The prompt above will get you 80% of the way. Paid members get the other 20%, done for you:

• The extended audit — a longer version of this prompt that also drafts the remediation policy language, not just the diagnosis

• A ready-to-run agent that performs this audit for you and produces the DPIA documentation as output — paste in your agent list, get a filed document back

• Full workshop library — every past workshop and prompt, indexed by topic, so you’re not searching old emails when a similar issue comes up

Subscribe now

THIS WEEK’S FREE OPTION

Prefer to start free? Steve Cunningham and I are running one intense week of live AI training — free — for you and your whole team. Real sessions, not recordings, built around one job you already do. No card, nothing auto-renews.

Claim your free week →

Until next Monday,

— Richard Nicholas

Got a story I should cover? Just hit reply — I read every one.

Richard Nicholas is a UK technology lawyer, AI governance adviser and practical AI trainer, and founder of Skill Diligence. Find out more at richardnicholas.ai.

Useful Lawyers is reader-supported. If this was useful, the best way to say so is becoming a paid member

Subscribe now

Start by telling your AI what you want. Work through 12 goal exercises and explore 12 interactive tools you can build for yourself, based on your personal and professional goals. Then build on that foundation to solve problems, learn, create, make decisions, and put your plans into action.

This is the most comprehensive action-focused AI training you’ll find anywhere, and is yours as my guest when you subscribe below.

Nobody noticed. Not for eight months!

Anthropic only found it by accident, while pulling data for a completely different safety review. Once they found it, they went back and rescanned 481 million transcripts to see what else they’d missed. This is Anthropic. The lab that talks about safety more than any other AI company on earth. If their own detection can miss a real breach for eight months, “we’d notice” is not a plan. It’s a hope.

That’s this week’s theme: agents breaking bad, and who actually pays when they do. A UK solicitor just found out the hard way — struck off, this month, for citations their AI made up. And Gartner is warning that the AI tools doing the most for your team might also be about to cost you the most. Three stories. One thread. Let’s get into it.

Today’s issue includes a short video and simple prompt to help deal with that risk. (A fuller version of this prompt and training on how to make your agents secure and how to prove it is available to paying subscribers).

It also includes a FREE one week AI challenge - get yourself and your whole team up to speed with AI at work in five days.

ALSO ON THE RADAR THIS WEEK

A UK solicitor has been struck off for AI hallucinations — the first case of its kind. SRA v Kumar is the first Solicitors Disciplinary Tribunal case built entirely on AI-hallucinated citations. The lawyer submitted cases that didn’t exist. The tribunal’s line was blunt: “A lawyer is always responsible for the accuracy of his or her output.” No exception for “the AI got it wrong.” Full details →

Gartner thinks your AI bill is about to get a lot less predictable. By 2028, over a third of new legal tech spend will be usage-based rather than flat subscriptions. Translation: the AI tool that’s working brilliantly for your team is also the one about to get expensive, fast — unless someone’s tracking which use cases actually earn their keep. Full details →

THE FIX

Here’s the uncomfortable bit: policies don’t catch this. Inventories do.

You cannot audit an agent you haven’t listed, and you cannot restrict access you don’t know exists. That’s the entire idea behind this week’s video — a practical way to build a real inventory of every AI agent in your organisation, what it can touch, and what it’s actually done with that access. Not a compliance exercise. A list you can act on this month. The video below sets out how to keep your agents in check. Below it you’ll find a prompt you can use for that purpose.

Watch

If Anthropic can take eight months to spot one of its own agents overstepping its instructions, you should probably check for yourself what the Agents in your organisation have permission to do. Here’s how you can do that: Use this prompt with Claude, ChatGPT, or any LLM:

Paste a description or list of the AI agents deployed in your organisation (or work through it agent by agent), then run this prompt to identify where granted permissions may exceed intended use. This highlights the gap behind this week’s Anthropic disclosure.

📋 The prompt to copy:

You are an AI governance adviser to an in-house legal team, conducting a permissions audit of a deployed AI agent. Your task is to assess whether the agent’s actual technical permissions match its intended business purpose, in light of recent disclosures — including Anthropic’s own AI models breaching real systems during testing — showing that even well-resourced organisations can take months to detect an agent acting outside its intended scope. Review the pasted description of the agent (its purpose, the systems it can access, and any logs or examples of its actions) and flag gaps under these four headings: (1) SCOPE DEFINITION — is there a written, specific statement of what this agent is authorised to do, or only a general description of its purpose? (2) PERMISSION MATCH — does the agent’s actual technical access match that stated scope, or does it have broader access than its task requires? (3) LOGGING AND VISIBILITY — is every action logged in a way a human can review, and is anyone actually reviewing it on a regular cadence? (4) ESCALATION PATH — if the agent does something outside its intended scope, is there a defined process for who is notified, how quickly, and what happens to its access in the meantime? For each gap, quote the relevant detail (or note its absence), explain the risk in plain English, and suggest one specific, practical fix. Output as a numbered list, ordered by priority.

This prompt is a starting point for your own review, not legal advice. Verify any policy or access change against your organisation’s specific technical and regulatory position before adopting it.

GET THE FULL VERSION (paid members)

The prompt above will get you some of the way there. Paid members get the other 20%, done for you:

• The extended audit: a longer version of this prompt that also drafts the remediation policy language, not just the diagnosis

• A ready-to-run agent that performs this audit for you and produces the DPIA documentation as output. Paste in your agent list, get a filed document back

• Full workshop library: every past workshop and prompt, indexed by topic, so you’re not searching old emails when a similar issue comes up

THIS WEEK’S FREE OPTION

Prefer to start free? Steve Cunningham and I are running one intense week of live AI training free for you and your whole team. Real sessions, not recordings, built around one job you already do. No card, nothing auto-renews.

One Intense Week of FREE Live AI Training

Join the Free One Week AI-At-Work challenge with me (Right) and Steve Cunningham

Take the FREE AI Challenge

(Building an agent with proper scope from day one — in that free week — is genuinely the fastest way to internalise the exact discipline it took Anthropic eight months to apply to their own test agents.)

Until next Monday,

— Richard Nicholas

Got a story I should cover? Just hit reply — I read every one.

Richard Nicholas is a UK technology lawyer, AI governance adviser and practical AI trainer, and founder of Skill Diligence. Find out more at richardnicholas.ai.

Useful Lawyers is reader-supported. If this was useful, the best way to say so is by becoming a subscriber

The Dutch Data Protection Authority has imposed a fine of almost €825 million on Uber over its use of automated decision-making to deactivate drivers.

The decision is an important warning for UK businesses. Automating a decision that has a significant effect on an individual can create serious data protection risks if there is not sufficient human involvement.

This applies whether or not the automated system uses AI.

If your organisation automates decisions involving recruitment, employment, finance, access to services or other significant outcomes, there are seven questions worth asking.

What happened in the Uber case?

Between 2018 and 2022, Uber used software to monitor driver behaviour and customer ratings.

Where the system identified suspected fraud or persistently low ratings, drivers could have their accounts deactivated automatically. This could be temporary or permanent.

The consequence was significant: affected drivers could immediately lose their ability to earn income through the platform.

Crucially, the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (AP), found that there was no meaningful human review before these decisions were made.

The AP identified two key GDPR problems.

First, Article 22 GDPR gives individuals protections against certain decisions based solely on automated processing where those decisions produce legal or similarly significant effects. The AP found that Uber’s automated deactivation decisions fell within these rules.

Second, the AP found that Uber had not adequately informed drivers about the automated decision-making, including the logic involved and its potential consequences.

The investigation followed complaints from 171 French drivers. Because Uber’s European headquarters are in the Netherlands, the Dutch regulator took the lead on the investigation.

Uber has appealed the decision.

Why does this matter to UK businesses?

The decision was made by an EU regulator, but UK businesses should not dismiss it as an EU-only issue.

The UK GDPR also regulates significant automated decisions involving individuals. Although UK law has changed following the Data (Use and Access) Act 2025 (DUAA), businesses still need to consider the data protection requirements that apply when important decisions are automated.

Serious breaches of UK data protection law can also result in substantial regulatory penalties.

More importantly, the underlying issue is relevant to any organisation using software or AI to make important decisions about people.

Which automated decisions create the greatest risk?

Recruitment and employment

Automated recruitment screening, performance management, disciplinary processes and other employment decisions require particular care.

For example, a business should examine a system that automatically rejects a candidate, recommends dismissal or triggers disciplinary action based on personal data.

The more significant the effect on the individual, the more important it is to understand how the decision is made and what role a human actually plays.

Gig economy and workforce platforms

Businesses using platforms to manage workers should examine automated account suspensions, performance scoring, task allocation and removal decisions.

Simply having a person somewhere in the process does not necessarily amount to meaningful human involvement.

Credit, insurance and financial services

Automated credit scoring, underwriting, insurance and other financial decisions have long been an important data protection issue.

Businesses should understand when automated systems produce significant outcomes and what safeguards apply.

Customer accounts and access to services

Automated fraud detection, account closures and access restrictions can also create data protection risks.

The relevant question is not simply whether software was involved. Businesses need to consider the significance of the decision for the individual and the extent of genuine human involvement.

Can businesses still automate important decisions?

Yes. The lesson from the Uber case is not that businesses must stop automating decisions.

Instead, organisations need to understand which legal requirements apply and build appropriate safeguards into their processes.

One of the most important distinctions is between genuine human involvement and a process where a person merely approves an outcome already determined by software.

7 Questions to Ask Before Automating an Important Decision

1. Do the automated decision-making rules apply?

Start by identifying exactly what the system does.

Consider whether personal data is being used to make an automated decision that has a legal or similarly significant effect on an individual.

Also establish what role, if any, a human plays in reaching the final decision.

2. Do we have a lawful basis for what we are doing?

Identify and document the legal basis for processing the personal data involved.

Where the specific rules governing significant automated decisions apply, check that the organisation can satisfy the relevant conditions and safeguards.

Do not assume that using AI or other software changes the underlying data protection requirements.

3. Have we properly explained the automation to individuals?

People should receive clear information about how their personal data is being used.

Where required, this includes appropriate information about automated decision-making and the consequences it may have for them.

Avoid vague statements that do not help individuals understand what is actually happening.

4. Can an individual genuinely challenge the decision?

Where applicable, there should be a practical way for an individual to challenge an automated decision and obtain appropriate human involvement.

A right that exists only in lengthy terms and conditions, or that is extremely difficult to exercise in practice, is unlikely to provide much protection.

5. Have we completed an appropriate DPIA?

A Data Protection Impact Assessment (DPIA) may be required where automated processing is likely to create a high risk to individuals.

The DPIA should reflect how the system actually operates in practice, rather than simply describing how it was originally intended to work.

It should also be reviewed when the system or its use changes.

6. Is the human involvement actually meaningful?

This is one of the most important questions.

Having a human somewhere in the process does not automatically make a decision a human decision.

The person reviewing the outcome should have sufficient information, authority and opportunity to assess the case properly and, where appropriate, reach a different conclusion.

Human involvement should not simply be a rubber stamp.

7. Are we checking whether the system changes over time?

Automated systems do not necessarily remain static.

Software updates, new data, changes in processes and, in some cases, AI model updates can alter how a system operates.

Businesses should therefore periodically review their automated decision-making processes, DPIAs and internal records to make sure the legal assessment still reflects what is happening in practice.

What should in-house lawyers and AI leaders do?

Businesses using automated systems to make significant decisions about individuals should identify those systems and examine the role humans actually play in the decision-making process.

Particular attention should be given to decisions affecting employment, income, recruitment, financial services and access to important services.

The key question is not simply:

“Do we have a human involved?”

It is:

“Does that person genuinely review the decision and have a meaningful opportunity to change the outcome?”

The Uber decision demonstrates the potential consequences when the answer is no.

Optional Additions

Suggested FAQ:

Q: Does Article 22 only apply to AI decisions?

A: No. Automated decision-making rules can apply regardless of whether the technology involved would normally be described as AI.

Q: Does having a human reviewer automatically solve the problem?

A: No. Human involvement needs to be genuine and meaningful. Simply approving an automated recommendation without properly considering it may not be sufficient.

Q: Can UK businesses still automate recruitment and HR decisions?

A: Automation is possible, but businesses need to understand the data protection requirements and safeguards that apply to the particular decision and system.

Q: What is a significant automated decision?

A: Broadly, it is an automated decision that has a legal or similarly significant effect on an individual. Decisions affecting employment, income, credit or access to important services are obvious areas to examine carefully.

Q: Should businesses carry out a DPIA before using automated decision-making?

A: A DPIA may be required where the processing is likely to result in a high risk to individuals. It should reflect how the system operates in practice and be reviewed when circumstances change.

Q: Who on earth could I speak to about this?

A: Glad you asked. Richard Nicholas is an AI governance lawyer and founder of AI training business Skill Diligence Ltd. You can find his details at richardnicholas.ai

I’d thought I’d be learning how to code. Instead, from memory we learned how to use tools like powerpoint, excel and similar tools to make spreadsheets, graphs and presentations. We were learning how to be “consumers” of technology, rather …

Read more

The CMA has fined several online businesses recently using its direct enforcement powers. What is more striking about the announcement from the CMA however is its uses of Agents to discover those consumer law infringements. Agents can visit websites and act as “mystery shoppers”, recreating the customer journey and logging any consumer law failings as they do so.

Here StubHub (online ticket marketing business) was found to be using drip pricing (adding extra mandatory costs after the initial price) and Marks Electrical was found to be charging for additional services without customer consent.

These are points that are worth getting right, particularly given the ability of a regulator now to potentially visit thousands of sites multiple times a week and flag concerns using AI. Our consumer team can help with that.

But regulators aren’t the only ones who can build agents.

I created an agent that can review a site for infringements of consumer law and flag those infringements in a report that sets out what the issue is and why it’s a problem (and how to fix it).

The agent can check various pages of a site, but as configured, cannot recreate making a payment (assuming those pages cannot be accessed without making a payment so might not have picked up on the “drip pricing” issue above). You are welcome to alter the agent to do that if you like (but you’ll be using your own credit card rather than mine!)

Of course the agent itself just carries out the search. It is no substitute for legal advice, but could be a substitute for the dreary task of manually testing every option on a particular website.

If you’d like to see the agent in action or use it yourself please do set up a call with me and I’ll show you how to download it and use it.

Equally if you’d like to learn how to create agents like these, again please do set up a call or email me at Richard@skilldiligence.com and I’d love to show you how you can create these for yourself.

You can see the training that I offer here: https://skilldiligence.com/ai-training-offer-page

In House Lawyers are a good market for me because they’re always being asked to do more with less (less resources, less cost, faster turnaround), they are often (unfairly) seen as a “cost” to the business and they’ve also been my clients for legal work for the last 25 years so I feel like I know them well (I’ve also been in their position at least six times now, working in-house, full time with my clients).

One team I ran a workshop with last week described a process that they’d really prefer not to deal with in the legal team, but which was passed their way because they’d always just done it (customer onboarding). It led to a conversation about triage and how they received their instructions.

I showed them how they might use a workflow to triage work that came into the team. The real excitement however came when I showed how this process could be turned into an interactive web page that would carry out that process directly for the client - meaning that the sorting process would happen before the matter ever got to the legal team.

In the latest edition of my newsletter - AI for In House Counsel - you’ll find the workflow and also a short video describing how to use it. You will still need someone from your IT team to upload the page to your intranet but that’s an easy process. (I could demonstrate how you’d host it but not all sites are built the same and if I host it then…well I’d receive all instructions into your legal team (which I don’t want either!)

This wasn’t what I’d set out to cover in the workshop but it was what my client wanted and they were pleased with the results.

You can find my newsletter (and all back issues of the newsletter) at skilldiligence.com/newsletter-archive

And if you want to find a whole load of ideas for workflows for a legal team (pre-made so you can just upload them) you’ll find that in my book - “Useful lawyers”

I enjoy workshops where the client suggests the idea. If you have any suggestions for things you’d like to see built (as a workflow or agent) please do let me know and I’ll get that built and back to you.

(For low value repetitive tasks - offer a vending machine rather than space in your email box)

And for many of them, when they speak to their families, their friends, their mentors, they’ll get the reassuring sense that everyone seems to agree with them. It can be worse still in the corporate world where no-one wants to be the dissenting voice questioning the new initiative that seemingly everyone else is behind.

But if everyone agrees with you, how will you know if you’re missing something?

One experiment described on Steven Bartlett’s “Diary of a CEO” was a switch from thinking “how can we make this project succeed” to “why will this project fail?”

The negative tone is deliberate. Of course everyone wants the project to succeed, but by looking at why it won’t (or didn’t) succeed and working backwards a team that was enthusiastically supporting an idea a moment ago can find reasons now to be cautious.

The idea is not to hold back from doing the project but rather, having discovered why it will fail - to identify the risks and avoid them. Once you can see the dangers -whether those are commercial, personal, financial, legal or otherwise - you can plan for them and make sure you really do avoid the problems lying in wait for you. It beats blind optimism and is a situation where the cold, calculating impersonality of AI can actually be a benefit rather than a hinderance.

Let me know what you think.

The GPT is below but I’ll gladly share the prompt if you’d like it. You can find it in full in this week’s “AI for In House Lawyers” Newsletter” - available here

Pre-mortem GPT

My 1 June Newsletter - covering AI for in house lawyers is out and you can find it here:

Newsletter

In it you’ll find Legal AI stories from the past week, plus:

• A recording of a workshop I did in which I set out how I build agents (and built one from scratch on the call); and

• A prompt for contract reviews - as well as a link to where you can get your hands on hundreds of similar prompts, workflows and ready made agents for your business;

• Details of our next AI agent builder sprint, which starts on the 22nd May - if you’d like to learn how to build, manage, organise and improve 36 agents for each aspect of your role (so that you own them forever) and to be the master of AI at your organisation it would be great to have you there.

If you’d like to join our next cohort - or to set up something bespoke for your team drop me a line here.

PS - this is the first of these newsletters I’ve created. I’d love to get your thoughts - what could be improved? What should I be doing differently?

I’ve been doing AI projects since 2015 and learning how to use AI in earnest since 2024. For the last two years working with a range of businesses but particularly with in house lawyers as they use AI. If you’re exploring AI right now let’s chat.

You can speak to me (link above) and/or speak to this GPT I made which will create a report that you can email. If you do that I’ll both read it and provide you with a tailored learning plan and over 100 pre-made agents and workflows, just for getting in touch.

He’s also built an approach to AI that is unlike any other – combining AI and personal development, meaning that you train AI in such a way that it knows you better than you know yourself. Specifically, it knows your personality, your language patterns, strengths, weaknesses and ways in which you sabotage your own success.

I have been through his system which identified my personality type, things that set me back and how I think about myself and goals. It is freakishly good at sussing out what makes you “you”.

The idea isn’t just a novelty. Instead, by identifying strengths and weaknesses AI can work out why you might not be getting done the things that you say that you want. It can identify procrastination, indecision, frustration and can calmy and clearly coach you past your own shortcomings.

The attached isn’t for everyone -but if, like me, you’re interesting in working out how AI can be a truly valuable coach and colleague I would recommend it.

Rich is speaking on 16^th April. The link is here:

Rich's call

As a commercial lawyer, contracts take up much of my working day so I made one that can review and mark up commercial agreements. Having run it several times it seems to be very good. Add in any contract (goods, services, saas, software licence, distribution, agency), tell it who you are (buyer/seller/distributor etc) and which jurisdiction you’re in and it’ll do a decent job of reviewing the contract and will produce alternative wording as well.

(Usual disclaimer - it’s, of course no substitute for legal advice).

The agent itself was made on Claude (Cowork) but can be used anywhere (essential for clients of mine that can only use Microsoft co-pilot or Legora or a similar system at their place of work) and particularly useful since contracts by their very nature are typically confidential and may contain personal data.

The agent consists of a series of files of software that work together, providing context, process, an example and its own quality control process (to ensure that the Agent stays on track). Having learned the system, anyone could create an agent like this, which carries out the work unsupervised and could work overnight to (for instance) clear a backlog of agreements should it need to. I know some in-house lawyers who would be grateful of something like this.

Below you can see what it does (as described by itself), what the inputs are, what it creates and how it works. Others in my cohort created landing page creators, dashboards, apps and tools related to their various areas of work.

Over the next few days we’re covering best practice for quality control, creating continuous improvement loops, creation of multiple paralell agents, agent swarms, orchestration and self-governance, which will be fun.

Subscribe now

If you’d like to see this in action and to see how I made it (so you can do the same) drop me a line and I’d be glad to share both with you. The first iteration of this was good but wouldn't produce alternative wording, but the second iteration was considerably better and so far has done a good job of contracts that I have given it.

Note - for any clients reading this, I haven’t used this tool for any client work and if I do in the future, will always disclose what I’m doing, will reflect that in the invoice, and will be fully responsible (as required by the SRA) for ensuring the end result is fit for purpose.

Unlike a purchased agent, or something like Openclaw - the agent only receives the information you give it, sits on your system (so if you have a secure in house solution it can sit on that) and of course - if you’ve set up the rules you can also make sure it follows your own company policies, signing policies etc.

If there’s enough interest I’ll run a workshop showing how you can do this for yourself and why you might want to. Let me know and I’ll get that set up.

In the meantime you can get started learning about and using AI, entirely free at this link

A decision every lawyer makes early on in their career is whether to be a litigator (someone who fights claims) or a transactional lawyer (someone who negotiates agreements). I have never wanted to be a litigator.

I have a working theory that the best litigators have same-sex siblings. That’s because the entire process of litigation seems to me to consist of convincing a parental figure (the Judge) that your actions are reasonable whilst your opponents are entirely unjustified. Those who enjoy litigation appear to relish competition and are unfazed by conflict.

I don’t enjoy it. So, since qualifying as a lawyer, I don’t do it. Like most of us I’d rather not be sued. But if I was I’d at least know how to defend myself in law, how to assess my risks of success, before passing it on to someone who enjoys the fight.

Being sued can be an intimidating and stressful experience for anyone and an expensive distraction better avoided. Wouldn’t it be good to get a view from someone who’s done that before. Ideally a lawyer?

You should definitely seek legal advice. AI is no substitute for that. But in the meantime, at least for the comfort of a second opinion you might consider asking AI. To help you ask the right questions however (and take you through a process of uncovering an answer this Litigation Strategy Advisor can give an idea of what you might consider doing.

Here's the tool

I’ll say it again for anyone who missed it - this isn’t legal advice. The AI has neither legal knowledge nor the aggressive sibling rivalry of a good litigator, but this tool should at least ask sensible questions and you may find it useful - let me know what you think.

The problem with learning how to master generative AI is, like so many other worthwhile ventures, it takes time, and experimentation before you get useful results.

Typically longer than you might think.

There are of course some “quick wins” that you can get along the way (using ready-made prompts or using an existing AI tool designed for a particular purpose) - but that’s the “fast food” of AI learning. You’re getting a result but you’re not really learning anything by doing it.

What you could really use is structured learning in manageable steps AND also quick results. That’s what the AI Leaders MBA is all about.

Over the course of 8 weeks you’ll go through a structured programme that takes you through a series of steps to building tools that get consistent results in your role.

In the meantime you’ll get over 3200 workflows ready made in six different areas - strategy, marketing, HR, operations, sales, product and innovation. These are ready to go, draw on some of best minds in each of those areas and can be used on any large language model (so it doesn’t matter if your business is restricted to Microsoft Co-pilot, Gemini, ChatGPT, Claude or another product, these will work regardless of the tool).

The tools give instant results and a demonstration of what’s possible, whilst the training, aimed at complete beginners, takes you through a series of “belts” (from White to Black) that help you master the skills needed to use AI in any role.

“Give a man a fish (the saying goes) and he’ll eat for a day. Teach a man to fish and you’ll feed him for a lifetime”

With this MBA programme you get both - the best fishing advice, cooking advice and enough ready made meals to for everyone in your business. (Have I pushed the analogy too far?).

And the best part - you don’t have to take my word for it. You can try it for free.

There is a “Mini MBA” of 9 workflows (and a related certification) that you can get and keep when you sign up below. No charge - test it & if you find the process useful. You’ll also get a 30 day trial (no commitment, no payment needed) of both:

• Our 8 week Blackbelt training - showing you how to build workflows; and

• Our full AI MBA of workflows in every area of your business.

And you can share all of the above with everyone in your business (so you can trial it as a group if you would like).

At the end of the 30 day trial you get to keep the Mini MBA and one person in the business keeps the 8 week training.

If you’d like the full MBA for everyone in the business then it’s only US$999 - approximately £750 sterling for access for everyone in the business.

I’ve been through this training myself and I think it’s the most comprehensive and useful-in-real life work.

You can start for free here:

AI Leaders MBA

Or drop me a line and I’d be glad to talk through what sorts of things I’m using it for.

Today I made a GPT that can write articles. I know what you’re thinking (“…yawn, big deal, ChatGPT can do that with a simple “write me an article about…” instruction).

But here’s the thing - whilst you could do that, the output isn’t likely to be very good.

Even if you’ve added a “You’re an experienced article writer” (or similar wording) at the start of the prompt, the AI is trying to do an entire process in one go.

One way of making AI work smarter is by breaking down the process and making sure that each step of the process is given as much care and thought as the previous part.

So when creating this GPT I first got it to create the template output and then break down the individual actions that would go into writing the article, so:

1. Researching the information

2. Creating a title

3. Creating an opening paragraph

4. Coming up with actionable advice

5. Having a conclusion

6. Edit the article to make it better

7. Creating Keywords.

Having broken down each part I was able to give more context:

1. The information should be researched from reliable sources (giving examples of established publications) and should include facts that can be verified, so the source should be provided.

2. I want a catchy title than doesn’t look like clickbait and is based on the substance of the article

3. I want the opening paragraph to take a view (not some vague “on the one hand, on the other hand” prevarication that looks like a lawyer wrote it…). I’d like to check it before the rest of article is written.

4. Actionable advice is what I read any article for, so I want this to be succinct, with a conclusion that makes sense.

5. And because any first draft can almost always be made better by editing (including editing by the same AI that wrote it) I want the AI to do that too.

Keywords are usually obvious, but it would be good to have these.

By breaking down the parts and adding context to each bit I was able to create a tool that takes each step one by one and also takes care with each step. This was a longer prompt to write but the end product should hopefully be a tool that produces consistent results.

The same process (of breaking down an individual process, or “workflow” into its constituent parts) can be applied to any business process. I put this together live on a workshop where others created tools relevant to their own businesses - whether that was onboarding customers, providing customer support or marketing outreach.

If you’d like to break down the process of creating workflows for your business I’d be delighted to help. Do drop me a line.

Meanwhile you might want to start here:

Also you can try the tool out for yourself here.

Yesterday I went for a run around my local area whilst listening to the audiobook “Find your Why” by Simon Sinek.

(….And if you can find a more succinct description of a man going through a mid-life crisis please do let me know)

In the book one phrase that was used repeatedly was that of a “People-First” business, which stood in clear contrast to a phrase I’m seeing in linkedin posts and company adverts about being “AI-first”.

“AI-First” typically refers the “What” a company does - ie if there’s a particular task that needs doing, before getting someone in to do the task, first use AI to attempt it. (Not a bad methodology but you do still need someone who can tell if the output is any good…)

By contrast Simon Sinek’s methodology is to work out the “Why” (what motivates) every individual (so that they have their own “why” statement about what their overall life purpose is) based upon stories that have shaped them. This purpose then gives clarity for future life decisions. The same thing can be done collectively for an organisation - resulting in a more engaged workforce, focussed on a common goal and working together rather than in their own separate teams or roles.

But the process involves asking and answering a series of questions - which is best suited to a workshop or at the very least a period of self-reflection with a notebook, not running up a hill and out of breath. So when I got home I created a tool that does exactly that - runs through the lessons from the book to help me & my team to create a “why” statement.

By all means try it for yourself too.

Why finder tool

Also - if you’s like to learn how to create tools like this for yourself please do let me know. I run workshops that help you to use AI to get useful things done.

Whatever stage in life you’re at you’re going to want to build a passive income - in other words a way of making money without actually actively striving for it. This has only become more apparent the closer to retirement I get.

As Warren Buffett once said - “if you don’t find a way to make money whilst you sleep you will work until you die”. (Happy thought!…)

It’s something that I have been aware of having first read Robert Kiyosaki’s book “Rich Dad Poor Dad”. (I did go on to read almost all of the rest, but whilst the first was genuinely thought-provoking and “Cashflow Quadrant” and “Retire Rich, Retire Young” both continued the theme - by the time you reach the fifth or sixth book you realise that you’re reading almost the exact same book - but with the chapters in a different order!)

It wouldn’t take much scrolling through YouTube to realise that there are multiple different ways to create a passive income stream, whether through property, shares, options trading, online marketing or acquiring an existing business. All have pros and cons. None are entirely passive (they all need some work to set up and run at the very least) and they are certainly not all for everyone.

Rather than stumble from one idea to another however, trying to work out which ones work (ask me some time about my failed e-commerce ventures..), wouldn’t it be good if you could create a plan that worked according to your own skills and preferences and which you could tailor to suit the amount of time that you have available?

That’s what this GPT does - asks questions then suggests a passive income plan based on what you’re good at.

There’s no upsell, no course to follow, no running to the back of the room to pay an exorbitant amount for motivational speeches. This is yours to use if you want to, and to recreate if you don’t like the first suggestion. (Note - this is AI, not a financial advisor, nor even a sentient human - you shouldn’t trust anything it comes up with is financial, legal or any sort of advice, but it might give you some decent ideas to start from).

See what you think and, if you like this sort of thing please do subscribe. I use AI to create things that I see are useful and post every so often. This blog, sadly is not a passive income stream for me but rather a passion project - so all posts are free and hopefully (surprisingly) useful.

The Passive Income Planning tool is here (it opens in Chat GPT):

Passive Income Planner

Good luck & speak soon!

Richard

One long running TV series in the UK is called the “Antiques Roadshow” which involves experts in different types of antiques (art, ceramics, paintings, cutlery) travelling the country (typically to a large country house) and inviting people to come to see them to find out more about the things they own.

There’s something delightfully British about the whole thing. People queue - in long lines - holding on to their various items.

Then when they see the expert everyone pretends not to be interested in the valuation itself - but rather about who made it, when and what it was used for. Only at the end of a long explanation and a suitable pause will the expert ask “would you like to know how much its worth?” - whilst the owner prepares to look shocked for the cameras.

If you actually need to find a valuation for something though it can be a tedious process trying to find out prices online. Having to wade through model numbers, descriptions and having to guess the age and condition of items.

Wouldn’t it be useful if an AI assistant could just ask the questions that it needed, look up the answer and come back with a price? (Ideally with the relevant sources as well so you could check for yourself and set up a sale if needed)

That’s what this tool is designed to do. After asking a few questions about the item (you can upload a photo if you choose) it will go and search on the web and find one or more prices and provide the evidence. It might even give you the story behind if its interesting - but if you just want the price, that’s fine too. No judgement from this AI tool. Have a try and let me know what you think!

Try it here

And if you like it you can always subscribe. I’ll be looking out for use cases like this every week.

Subscribe now

Would it be useful if you could use AI to help you to eat better? To plan recipes that actually helped you to increase your energy, improve your mood & help you to get to your fitness and weight goals?

Before diving in, I want to emphasize that I’m no nutrition expert. My goal here is to outline a process to extract the best insights from leading authorities in nutrition and tailor them to your everyday life. I have set out the prompts that you can use so that you can tailor them to your needs and do this for yourself.

This idea started as a personal project. Like many parents, my diet shifted over time to accommodate what my kids prefer: pasta, chips, and convenience foods. I wanted to reclaim healthier eating habits for myself. The process was also inspired by Brian Johnson of Heroic—a fantastic personal development resource that has kicked me into action to eat better than I had been.

Let’s get started!

Step 1: Identify Nutrition Experts

The first step is to find credible experts in nutrition. My personal goal is to feel fitter and more energized, so I sought out general nutrition advice. If your goals differ—such as weight loss or managing a specific dietary restriction—you might adjust the following prompts.

Prompt 1

Who are the five most well-known experts in nutrition who can help me eat more healthily? Please provide their names and a short summary of their teachings.

Here’s what I learned:

1. Dr. Michael Greger

   • Advocates a whole-food, plant-based diet to prevent chronic diseases.

   • Founder of NutritionFacts.org.

   • Author of How Not to Die and How Not to Diet.

2. Dr. Joel Fuhrman

   • Promotes a nutrient-dense, plant-rich diet.

   • Focuses on greens, beans, berries, and seeds.

   • Author of Eat to Live and The End of Diabetes.

3. Dr. Megan Rossi

   • Specializes in gut health.

   • Encourages diverse plant-based diets to support the microbiome.

   • Author of Eat Yourself Healthy.

4. Dr. Andrew Jenkinson

   • Examines metabolism and weight regulation.

   • Highlights sustainable weight loss strategies.

   • Author of Why We Eat (Too Much).

5. Professor Tim Spector

   • Advocates for personalized nutrition and gut health.

   • Author of The Diet Myth and Spoon-Fed.

Step 2: Look for Common Ground

To synthesize their teachings and make sure I’m not following the advice of one radical nutcase (with all due respect to all five of them - since I haven’t heard of them before I don’t know whether any of them are controversial), I asked AI for common principles among these experts - so as to reach a consensus.

Prompt 2

What do these teachings have in common?

Here’s the consensus:

• Whole, Unprocessed Foods: Focus on fresh vegetables, fruits, lean proteins, healthy fats, and whole grains.

• Personalized Nutrition: Tailor your diet to your body’s needs.

• Nutrient Density: Choose foods rich in essential vitamins, minerals, and antioxidants.

• Avoid Inflammatory Foods: Limit refined sugars, processed oils, and additives.

• Connection Between Diet and Health: Emphasize how diet impacts physical and mental well-being.

Step 3: Applying That Expert Advice

With these principles in mind, I tailored prompts to help incorporate these insights into daily life.

Prompt 3

How can you help me incorporate these suggestions into my daily routine? Please provide five actionable prompts.

Here are the five prompts that were returned:

1. Personalized Meal Planning
   “Using principles of whole, nutrient-dense foods, create a weekly meal plan tailored to my preferences for chicken, fish, and vegetables. Include quick-to-prepare options for my running routine.”

2. Identify and Replace Inflammatory Foods
   “Analyze my current diet and suggest healthier alternatives to any processed or inflammatory foods.”

3. Support Gut Health
   “Recommend ways to add gut-friendly foods like probiotics and prebiotics into my meals. Include specific recipes.”

4. Sustainable Eating
   “Design a grocery list of sustainable, ethically sourced foods to reduce waste and improve health.”

5. Track Progress
   “Create a daily journal template to monitor changes in energy, digestion, and mood as I implement these strategies.”

Step 4: Recipes Tailored for You

Now comes the practical part—what to buy and cook. I asked AI to generate quick, healthy recipes based on the above prompts.

Prompt 4

Provide five recipes that:

• Can be cooked in 20 minutes or less.

• Use ingredients available in UK supermarkets.

• Focus on whole foods, nutrient density, and gut health.

Here are the results:

Recipe 1: Mediterranean Grilled Chicken Salad

Prep Time: 20 minutes
Ingredients:

• 2 chicken breasts (boneless, skinless)

• 4 cups mixed salad greens

• 1/2 cucumber (sliced)

• 1/2 red onion (thinly sliced)

• 10 cherry tomatoes (halved)

• 50g feta cheese (crumbled)

• 1 tbsp olive oil

• 1 tbsp balsamic vinegar

• 1 tsp dried oregano

• Salt and pepper

Instructions:

1. Season chicken breasts with salt, pepper, and oregano.

2. Heat a pan with olive oil over medium heat. Cook chicken for 5-6 minutes per side until fully cooked.

3. Toss salad greens, cucumber, onion, and tomatoes in a bowl.

4. Slice chicken and arrange on top of the salad. Sprinkle with feta and drizzle with olive oil and balsamic vinegar.

Recipe 2: Salmon and Avocado Rice Bowl

Prep Time: 15 minutes
Ingredients:

• 2 salmon fillets

• 1 cup microwaveable brown rice

• 1 avocado (sliced)

• 1/2 cup edamame (shelled, frozen)

• 1 tbsp soy sauce or tamari

• 1 tsp sesame oil

• 1 tsp sesame seeds

• 1 spring onion (sliced)

Instructions:

1. Cook salmon fillets in a non-stick pan for 3-4 minutes per side.

2. Microwave rice and edamame as per package instructions.

3. Assemble the bowl with rice, salmon, avocado, and edamame. Drizzle with soy sauce and sesame oil, then garnish with sesame seeds and spring onion.

Recipe 3: Veggie-Packed Egg Scramble

Prep Time: 10 minutes
Ingredients:

• 4 large eggs

• 1/2 cup spinach

• 1/2 cup mushrooms (sliced)

• 1/4 red bell pepper (diced)

• 1 tbsp olive oil

• Salt and pepper

Instructions:

1. Heat olive oil in a pan over medium heat. Sauté mushrooms, bell pepper, and spinach for 3-4 minutes.

2. Beat eggs with a pinch of salt and pepper, then pour into the pan.

3. Cook and scramble gently until eggs are set. Serve immediately.

Recipe 4: Lentil and Tomato Soup

Prep Time: 20 minutes
Ingredients:

• 1 can (400g) lentils (drained and rinsed)

• 1 can (400g) chopped tomatoes

• 1 small onion (diced)

• 2 garlic cloves (minced)

• 2 cups vegetable stock

• 1 tsp smoked paprika

• 1 tbsp olive oil

• Salt and pepper

Instructions:

1. Heat olive oil in a pot over medium heat. Sauté onion and garlic for 2-3 minutes.

2. Add chopped tomatoes, lentils, stock, and paprika. Simmer for 10-15 minutes.

3. Blend half the soup for a creamy texture or leave chunky. Season to taste.

Recipe 5: Quick Cod with Steamed Vegetables

Prep Time: 20 minutes
Ingredients:

• 2 cod fillets

• 1 lemon (sliced)

• 1 cup broccoli florets

• 1 cup green beans

• 1 tbsp olive oil

• Salt and pepper

Instructions:

1. Preheat oven to 180°C (350°F). Place cod fillets on a baking tray, season with salt, pepper, and lemon slices. Drizzle with olive oil.

2. Bake for 12-15 minutes until the fish is opaque and flakes easily.

3. Steam broccoli and green beans in a microwave steamer or on the hob for 5-7 minutes. Serve alongside the cod.

Shopping List:

• Proteins: Chicken breasts, salmon fillets, eggs, cod fillets

• Vegetables: Mixed salad greens, cucumber, red onion, cherry tomatoes, spinach, mushrooms, red bell pepper, broccoli, green beans

• Carbs: Microwaveable brown rice, lentils (canned)

• Condiments: Balsamic vinegar, soy sauce/tamari, sesame oil

• Pantry Items: Feta cheese, avocado, edamame (frozen), chopped tomatoes (canned), vegetable stock

• Seasonings: Oregano, smoked paprika, sesame seeds, spring onion, lemon

1. Mediterranean Salmon Salad

   • Ingredients: Salmon fillets, mixed greens, cherry tomatoes, cucumber, olives, lemon, olive oil.

   • Instructions: Pan-sear salmon, assemble salad, drizzle with lemon and olive oil.

2. Vegetable Stir-Fry with Tofu

   • Ingredients: Firm tofu, broccoli, carrots, bell peppers, soy sauce, sesame oil, ginger, garlic.

   • Instructions: Stir-fry vegetables and tofu with seasoning.

3. Chicken and Quinoa Bowl

   • Ingredients: Chicken breast, quinoa, avocado, spinach, cherry tomatoes, lime, olive oil.

   • Instructions: Grill chicken, cook quinoa, and combine with fresh toppings.

4. Miso Soup with Veggies

   • Ingredients: Miso paste, tofu, seaweed, mushrooms, spinach, spring onions.

   • Instructions: Simmer all ingredients in water until hot.

5. Berry and Yoghurt Parfait

   • Ingredients: Greek yoghurt, mixed berries, granola, honey.

   • Instructions: Layer yoghurt, berries, and granola in a glass.

Final Thoughts

This process has been a revelation for me, helping to align my diet with my energy and fitness goals. The key takeaway? Nutrition is deeply personal, and AI can help you leverage expert knowledge to create a plan that works for your unique lifestyle.

Feel free to tweak the prompts and recipes to suit your needs. Let me know how it works for you!

Notes

• Find the recipes and and additional resources linked below.

• Check out Brian Johnson’s Heroic for personal development insights around nutrition and generally living a healthier lifestyle.

Happy eating. Did you find this useful? Will you use it yourself? Please do let me know. You can also listen to this episode as a podcast here.

Subscribe now