This is my journal on UK technology regulation and security guidance. I write it in plain English. I also work as an AI consultant for UK small and medium businesses. I help them adopt AI responsibly and I follow the rules and the official guidance.
I am Frank Vitetta, an AI consultant in London. I help UK small and medium businesses adopt AI responsibly through a governance review, implementation with guardrails and staff training.
This site is also my journal on UK technology regulation and security guidance, written in plain English. Each piece starts from the legislation, the regulator’s guidance or the vendor’s documentation. The journal is analysis and opinion. It is not legal advice.
Published so far.
Each piece starts from the legislation, the regulator’s guidance or the vendor’s documentation. Each one ends with a list of its sources.
Any service with UK users that lets people post, share or message each other can fall under the Act. The size of the company does not matter. This piece covers scope, exemptions, the dates that have already passed and Ofcom’s free checker.
The UK’s cyber authority now puts passkeys ahead of passwords. For a business with staff accounts and shared logins, the advice needs some working out.
A year of staged commencement ended on 19 June 2026. Most of the Act is optional. The new duty to handle data protection complaints is not.
Only 30.7% of citations in UK AI answers go to UK sites. British newspapers barely register. Your own website and trusted UK listings matter most.
Three themes with one question behind them. What does this mean for a business here?
Most owners and managers do not need more technology news. They need someone to read the source and say what it means for a firm of their size. I do the same reading for my paid work, which is AI adoption and governance for UK businesses.
I read the Act, the commencement regulations and the regulator’s guidance. Then I set out who is covered, what is already in force and what is still to come. I describe what the official sources say. Whether a particular business complies is a question for a solicitor.
Where I start: Ofcom on online safety, the ICO’s guidance for organisations, DSIT and legislation.gov.uk.
I take guidance from the National Cyber Security Centre and from vendor documentation. I turn it into steps a small or medium-sized business can act on. I report what the guidance says and where its authors admit the gaps. I do not assess any individual firm’s defences.
Where I start: the NCSC, its pages for small and medium-sized organisations and Cyber Essentials.
I write about the decisions an owner or manager has to make. These include which features to run on a website, how staff sign in and which AI tools to allow and on what terms. They also include what to change when the rules or the tools move. If the sources support it, I end with a short list of what to do now.
Where I start: the ICO’s advice for small organisations and Ofcom’s Online Safety Act checker.
I am Frank Vitetta, an AI consultant based in London.
I have worked in search marketing since 2008. I help UK small and medium businesses adopt AI responsibly.
Read about my backgroundI research and draft pieces with AI assistance. Then I review and edit them before they are published. Every factual claim links to a source. Every piece ends with the full list. My editorial standards set out the corrections policy.
The site sets no cookies and runs no analytics. See privacy.