DEWOLF.CO / SAMPLE
Exposure map (worked example, invented organisation)
Illustrative only. "Ashgrove Studio" does not exist; the organisation, its clients, its tools, and its activities are invented to show what the output of an exposure check looks like, and any resemblance to a real business is coincidental. The tiers shown are illustrative judgements on invented facts, not conclusions about any real activity. Real maps run to one page and are written for the people named on them.
Organisation: Ashgrove Studio, an invented independent brand and content agency, 38 people, London. Around a third of revenue from EU-headquartered clients or UK clients with EU operations.
EU exposure: Yes, through clients. Two EU-headquartered accounts; three UK clients whose campaigns run in EU markets. No EU entity, no EU staff.
AI in use (declared and undeclared): Eleven tools found. Four were on the approved list. Seven were in daily use and not on any list, including two image generators and one transcription tool used on client calls.
| Activity | Tier | Triggers touched | Roles affected | What changes |
|---|---|---|---|---|
| AI-generated imagery and copy in client deliverables | Transparency obligations apply now | Generative content | Creative, account management, production | Disclosure to clients and, where content is published, to audiences; provenance record per asset; approved-tool list enforced |
| Audience segmentation and targeting for EU campaigns using personal data | High risk, on the current timeline | Profiling; personal data | Strategy, media, data | Document the logic, the data sources, and the human review step; confirm client is the controller and what they expect from you |
| Transcription and summarising of client calls | Transparency obligations apply now | Personal data | Account management, all client-facing staff | Consent line at the start of calls; approved tool only; retention rule |
| CV screening for hires using an AI tool in the applicant tracking system | High risk, on the current timeline | Decisions about people; profiling | People team, hiring managers | Stop automated ranking now; human review documented; vendor questioned on its own compliance |
| Internal drafting, research, and admin with general assistants | Minimal | None | Everyone | Approved-tool list, a two-line acceptable-use note, and a way to ask when unsure |
| Social listening and sentiment tools on named individuals | Profiling risk to assess | Profiling or monitoring | Strategy, social | Confirm what is monitored and whether individuals are identifiable; likely fine, needs a written position |
Tier key. Minimal: no action beyond the acceptable-use note. Transparency obligations: disclosure and provenance rules already in force. High risk: obligations due on the current timeline, preparation should start now. Prohibited: none found.
The three actions that matter first
- Stop automated CV ranking this week and put a documented human review step in its place. This is the one activity that a regulator, a candidate, or a buyer of the business would look at first.
- Publish the approved-tool list and the two-line acceptable-use note, and make the seven undeclared tools a decision rather than a secret: approve, replace, or stop each one.
- Write the client disclosure line for AI-generated content and add a provenance field to the production checklist. This answers the procurement questionnaire before it is asked.
Raised for legal advice. Whether the agency is a deployer or a provider for the segmentation work depends on the contracts with the two EU-headquartered clients. That is a question for the agency's lawyers and its clients' lawyers, and the map does not answer it.
Prepared by Daniel de Wolf · Operational guidance, not legal advice