308: The Legal and Governance Landscape: GDPR, the EU AI Act and Data Responsibility with Colin Cosgrove and Amber Foster

Most coaches using AI couldn't tell you exactly where their client data actually goes - which platform, which server, whether it's used to train a model. In the third episode of AI, Ethics and Trust in Coaching series, host Smaranda Dochia talks with lawyer and AI governance practitioner Amber Foster, and leadership coach, and technology and compliance specialist Colin Cosgrove to unpack what GDPR and the EU AI Act really mean for coaches, coaching providers, and the organisations that hire them. Rather than treating compliance as a box-ticking exercise, Amber and Colin reframe it as the foundation of client trust starting with a deceptively simple question: where is AI actually touching your coaching practice, and what happens to the data once it gets there?   

 

Beyond the legal frameworks, Amber and Colin keep coming back to principles — both the EU AI Act's own principle-based approach, and the personal ethics coaches bring to their work. They push coaches to go beyond "is this compliant?" and ask "does this align with my own values and how I want to show up for clients?" That said, the conversation stays firmly practical: they walk through how to map data flow, what to actually look for in an AI tool's terms and documentation, and why transparency and informed consent can't be a one-off conversation: tools and clients’ wishes change, and so should the contracting around them. They also tackle the trickier territory of organisational coaching, where a use case that looks low-risk one-to-one can become high-risk the moment it sits inside an HR system with multiple stakeholders.

 

This episode is essential listening for any coach, L&D professional, or organisational leader using AI in their practice. Where inaction will put you at risk, this episode will provide the information you need to get started to ensure both you and your clients are protected, and ethical.

 

You will learn

 

·       There are two sets of principles and one question: the EU AI Act is principle-based, and so is good coaching; the real test is whether your AI use lines up with both?

·       GDPR and the EU AI Act set legal minimums; genuine trust with clients requires transparency and consent that go further.

·       Context changes risk: a coaching use case that's low risk individually can become high-risk once it operates inside an organisational or HR system.

 

“As soon as you start to receive data about people, that's when you need to switch on and start to think about this.” 

 

Don’t forget to subscribe, rate, and leave us a review! Your feedback helps us bring you more valuable content.

 

For the episode resources and guest bio, please visit: 

https://www.associationforcoaching.com/page/dl-hub_podcast-channel-AI-ethics-trust-in-coaching-legislation-gdpr-eu-ai-act-governance