Ulf Aslak Lai
Co-founder, Chief Technology Officer
Ulf is Co-founder and CTO at Lawcel. He leads engineering architecture for connectors, analysis pipelines, and the safeguards needed when automation touches regulated customer content.
- Platform architecture
- Data governance
- ML/AI systems
Articles by Ulf Aslak Lai
An auditor keeps your security honest. Nothing keeps your privacy policy honest.
A SOC 2 audit examines the security controls you scoped into it, and platforms like Vanta collect the evidence for that…
24 Aug 2026
Adding AI to your app? Add these three disclosures to your privacy policy.
Calling an LLM API adds three things to what GDPR Article 13 makes you disclose: the model vendor becomes a recipient o…
19 Aug 2026
Your Vercel app deploys on every merge. Its privacy policy is still on version one.
Vercel's compliance covers Vercel's own service, not the app you deploy on it. From day one your privacy policy must di…
19 Aug 2026
Remove "we may" or "possible" from your privacy policy. EU regulators call for plain language.
Search your own privacy policy for "we may". I did it to 336 published policies from Product Hunt launches and 231 of t…
18 Aug 2026
Starting September 11 2026, you have just 24 hours to report on-device vulnerabilities.
The Cyber Resilience Act's reporting duties start on 11 September 2026. The CRA covers software that runs on the user's…
17 Aug 2026
Product Hunt seriesThe most upvoted Product Hunt launches are no more compliant than the least
I scanned 458 products launched on Product Hunt over 30 days in 2026 and split them by upvotes. Across a range from 4 t…
11 Aug 2026
Product Hunt seriesOnly 45% of Product Hunt privacy policies name a legal basis
I scanned 458 products that launched on Product Hunt over 30 days in July and August 2026. 397 published a readable pri…
11 Aug 2026
Product Hunt series60% of Product Hunt sites load a foreign vendor their policy never mentions
I scanned 458 products launched on Product Hunt over 30 days, loading each from inside the EU and reading its legal pag…
11 Aug 2026
Product Hunt seriesOnly 17% of Product Hunt launches ask when they set tracking cookies
I scanned 458 products that launched on Product Hunt over 30 days in July and August 2026, loading each site from an EU…
11 Aug 2026
Two days from launch with no privacy policy. Twelve facts have to be true.
Before you publish a Privacy Policy, GDPR Article 13 requires twelve items. Two are close to boilerplate and one is you…
6 Aug 2026
Article 33 asks four things. The EDPB's new breach template asks 100.
The EDPB's draft template for personal data breach notification, which went out for comment until 5 August 2026, turns…
3 Aug 2026
Scraping the whole internet is the easy case. Your small, targeted scrape is not.
The EDPB's draft Guidelines 03/2026 cover web scraping for generative AI, and they reach the team that re-uses someone…
3 Aug 2026
Article 50 applies on 2 August 2026, and your model vendor cannot carry it for you
Article 50 of the EU AI Act applies from 2 August 2026. The delay you read about in June covered high-risk uses such as…
30 Jul 2026