Innovation in the Heart of Kilkenny: Celebrating the 2026 LEO Start Competition Winners

Congratulations — and a practical starting point

Huge congratulations to Niamh Butler on her LEO Start Competition win. CloudMount is proud to support Kilkenny’s innovators by making AI and GDPR compliance simple so they can focus on changing the world.

For any growing startup, the question is how to establish sensible governance without slowing useful experimentation. Start with a few decisions that people can understand and repeat. Know what information you hold, decide which tools are appropriate and make someone responsible for checking consequential work.

Make ownership clear before processes become complicated

Early-stage businesses often share responsibilities informally. That can work until a customer asks who approved a supplier, an employee leaves with access to shared accounts, or nobody knows who should answer a data request. A simple ownership register is more useful than an ambitious policy nobody maintains.

For each important system, record its business owner, purpose, access arrangements and review date. Identify who can approve new tools and who can pause a risky activity. One person may hold several responsibilities, but those responsibilities should still be explicit.

For personal-data processing, assess the GDPR obligations that apply rather than assuming a startup exemption. Article 30’s exemption for some smaller organisations is conditional; team size alone does not settle whether processing records are required.

Treat customer information as a design decision

Before adding a form, analytics service or AI integration, ask what information the feature really needs. Collecting less can reduce the volume of information a team must protect, explain and eventually delete. Avoid requesting sensitive details merely because they might become useful later.

Where personal data is involved, identify the purpose and lawful basis, explain the processing clearly and set appropriate retention arrangements. Data protection by design and by default means incorporating safeguards into the activity, not attaching a privacy notice after launch.

Establish what each supplier receives, what it can do with that information, whether subprocessors are involved and whether transfers outside the EEA need assessment.

Give AI experiments boundaries and human owners

Begin with a defined task, approved information and a person who knows what a good result looks like. Use synthetic or appropriately anonymised examples where possible, while recognising that removing names alone may not anonymise a dataset.

Decide which outputs need checking before they reach a customer or affect someone’s opportunities. Legal statements, financial calculations and recruitment recommendations deserve more scrutiny than an internal brainstorming list. Record known limitations and make it easy for staff to report mistakes.

The AI Act’s literacy duty requires providers and deployers to take measures towards sufficient AI literacy for relevant staff and others operating systems on their behalf. Training should reflect people’s knowledge, the use context and those affected.

Build a governance routine that survives growth

At a regular team review, ask what changed: new tools, new customer information, new access permissions or a new use for existing data. Review unresolved issues and check that someone has both the responsibility and authority to resolve them.

The practical goal is a business that can explain its choices. Clear ownership, proportionate records and meaningful human checks give a growing team a sounder basis for decisions without pretending that any template guarantees compliance.