GDPR and data governance for supply chain AI in logistics

Unmapped is not the absence of data protection — most operators at this stage have privacy notices, a DPO or privacy lead, and a RoPA that covers HR and payroll. What is missing is the bridge to the AI estate: nobody has walked the telematics feed, the ETA model, the tracking portal and the labour-planning tool and written down which fields are personal data, where the identity joins happen, and which vendors see what. The obligations exist; the map that would let anyone discharge them does not.

The tell is the vendor estate. Telematics platforms, TMS vendors and visibility providers have been adding AI features for years — driver scoring, ETA prediction, network benchmarking — and many switch them on by default or by commercial nudge. At stage 1 the operator's contracts were signed before those features existed, so data is being processed for purposes nobody assessed, under clauses that never contemplated model training. The operator is accountable for processing it has never actually seen.

This stage is uncomfortable to leave because the first honest inventory usually finds something: a retention period nobody set, a vendor reusing fleet data, a tracking page exposing more than intended. Leaders sometimes prefer not to look. That instinct is exactly backwards — every enforcement decision in this space punishes the operator who could not answer, far more severely than the operator who found a problem and fixed it. The regulator's first question is always the map.

Inventoried is the most common stage and the most deceptive, because the paperwork looks finished. There is a spreadsheet of AI systems, each with a lawful basis in a column, retention periods in another, and a privacy notice that gestures at 'vehicle and route data'. What is missing is the substance underneath: a legitimate-interests basis with no balancing test behind it is an assertion, not a basis, and a retention period that no system enforces is a wish. The gap between claimed and actual is precisely what an audit or a works-council challenge exposes.

The structural problem at this stage is that governance and engineering have not met. The privacy team wrote the register from interviews; the data team built the pipeline from requirements that never mentioned minimisation. So the register says '90-day raw retention' while the object store keeps everything since 2021, and it says 'pseudonymised for analytics' while the feature table carries driver names because that was the join key that worked. Neither team is lying. There is simply no mechanism that makes the paper true.

Time at stage 2 accumulates risk quietly. Every month of over-retention deepens the eventual erasure problem — especially in training corpora, where personal data hardens into model inputs nobody wants to rebuild. And the asserted lawful bases set expectations with drivers and customers that the first serious challenge will test. Operators tend to leave this stage under external pressure: a works council, a shipper's procurement questionnaire, or a regulator's letter. Leaving it deliberately is considerably cheaper.

Controlled is the stage where governance moves from the register into the pipeline. Retention is a TTL the object store enforces, not a sentence in a policy. Minimisation is a schema decision — driver identity stripped before the feature layer, ETAs aggregated to the stop where the customer does not need the vehicle — not a promise. The DPIA's mitigations column names real controls that an engineer can point at. This is the data-protection equivalent of the maturity-curve write-back moment: the point where the discipline starts running in production instead of alongside it.

The character of the work changes accordingly. Stage 2 problems are analytical and legal; stage 3 problems are engineering: how to pseudonymise the driver-to-vehicle mapping while keeping ETAs accurate, how to give the safety team fatigue signals without giving every analyst a location history, how to delete a driver from a training corpus without rebuilding every model. None of these is exotic — tokenised joins, purpose-scoped views, retention-tiered stores and periodic retraining windows cover most of it — but they must be designed in, and each one measurably strengthens the balancing test in the LIA.

The constraint that emerges at stage 3 is evidence. The controls exist, but proving them takes weeks: the DPIA is a document in a folder, the LIA is version-less, the vendor chain has grown a sub-processor nobody assessed, and every transfer question is answered from scratch. The operator is compliant and cannot demonstrate it quickly — which, in front of a regulator, a works council or a shipper's auditor, is uncomfortably close to not being compliant at all.

Evidenced is the stage most operators believe they are at and very few actually reach. The distinguishing property is speed of proof: any obligation — a DSAR, an audit question, a shipper's procurement questionnaire, a works-council query about a new model — is answered from living systems rather than assembled by a task force. The DPIA register says which assessments exist, when each was last reviewed and what triggered the review. The transfer map names every route out of the EU or UK and the mechanism that covers it. Nothing depends on the one person who remembers.

The economics of governance invert here. Below this stage, every external question costs weeks and interrupts engineering; the operator experiences data protection as a tax. At stage 4 the marginal cost of answering approaches zero, and governance starts winning commercial work: shipper procurement teams increasingly score data-handling posture, works councils approve new AI uses faster when the last three answers were crisp, and the operator can sign Article 28 terms with confidence because it knows what its own chain does. Evidence built once is sold many times.

What still limits stage 4 is that the trust is institutional, not yet structural. Customers, drivers and regulators trust the answers because the answers have been good — but each new AI use case still triggers the full explanation from first principles, and the approaching EU AI Act deadlines add classification, logging and human-oversight documentation on top of the GDPR pack. The move to stage 5 is folding those into one operating rhythm so that governance travels with the model lifecycle instead of chasing it.

Trusted is narrower and more operational than the word suggests. It does not mean the operator is loved; it means the governance system is credible enough that external parties extend it the benefit of the doubt, and internal parties stop routing around it. Shippers accept the evidence pack instead of sending their own questionnaire. The works council starts from 'show us the DPIA delta' rather than from opposition. Engineers reach for the pseudonymised join because it is the paved road, not because someone will check. The system has become cheaper to follow than to bypass — which is the only condition under which governance survives contact with peak season.

The AI Act is the stage-5 proving ground. Algorithmic management of workers sits in the regulation's high-risk category, which brings registration, risk management, logging, data-quality and human-oversight obligations on a statutory timetable. A trusted operator meets these substantially from its existing GDPR evidence — the DPIA extends to a fundamental-rights view, the decision logs already exist, the oversight roles are already named — and treats the residual gap as a scoping exercise rather than a programme. Operators below stage 4 will experience the same deadlines as a second, parallel compliance build.

Sustaining stage 5 is a change-management discipline, and it is where regression begins if attention lapses. Networks add countries; vendors add sub-processors and model features; a new customer demands person-level tracking the current design deliberately cannot produce; a model quietly gains a purpose its LIA never balanced. Each is small, and each invalidates an assessment somewhere. The stage-5 operator ties governance review to those events — new vendor, new country, new purpose, new model version — rather than to the calendar, and treats a governance regression with the seriousness of a service regression.