What AI governance is
AI governance is the set of rules and records that decide how a business uses AI: which tools are approved, what data can go into them, who checks the output, and who is accountable. For a business of 5 to 250 staff it can be a short policy, a register and a review routine. It does not need a committee.
Why a small business needs it
Someone in your business is already using AI for work, probably on a personal account. Client names, contract terms or staff details may have gone into a tool nobody approved.
Governance is how you find that out and make it safe. Done well, it makes AI easier to use, because staff know what is allowed instead of guessing.
Start with our free UK AI policy template. It covers what most businesses need on day one.
What we put in place
- An AI acceptable use policy in plain English: approved tools, data that must never go in, and what a person must check.
- An AI use register: every tool and system that uses AI, what it does, what data it touches and who owns it.
- A simple risk check for each new use, and a data protection impact assessment where personal data is involved.
- Human checkpoints for anything that affects a customer, an employee or a regulated decision.
- Logging on the AI systems we build, so any answer can be traced to its input and model version.
- A review routine: who looks at the register, how often, and what triggers a fresh look.
The rules that apply in the UK
The UK has no single AI law. These are the rules most likely to touch a UK business using AI.
| Rule | Who it affects | What it means in practice |
|---|---|---|
| UK GDPR and the Data Protection Act 2018 | Anyone putting personal data into AI | A lawful basis, transparency, and a DPIA for high-risk processing. Limits on decisions made solely by automated means. |
| ICO guidance on AI and data protection | Anyone processing personal data with AI | How the regulator expects fairness, accuracy and explainability to be handled. |
| FCA Consumer Duty and SM&CR | FCA-regulated firms | Good outcomes for customers and a named senior manager accountable for how AI is used. |
| EU AI Act | UK firms selling AI systems into the EU, or whose AI output is used there | Obligations scale with risk. Most small UK firms using AI tools internally have little direct exposure. |
| UK government AI principles | Everyone, through the sector regulators | Safety, transparency, fairness, accountability and contestability, applied by each regulator in its own area. |
How it runs
A fixed-price engagement, usually a few weeks, often alongside the Workflow Audit.
Find out what is in use
A short survey and conversations with each team show which AI tools are used today and for what.
Write the policy and register
Drafted with whoever owns IT and data protection, starting from our template and cut to fit your business.
Check the risky uses
Anything involving personal data, customers or regulated decisions gets a risk check and, where needed, a DPIA.
Hand over the routine
An owner, a review date and a short checklist for approving new AI uses.
Questions about AI governance
What is an AI governance framework?
An AI governance framework is the policy, records and routines that decide how a business uses AI and who is accountable for it. For most small and mid-sized UK businesses that means an AI use policy, a register of AI use, a risk check for new uses and a regular review. ISO/IEC 42001 is the international standard for larger programmes.
Does the EU AI Act apply to UK businesses?
Sometimes. It applies to UK firms that place AI systems on the EU market or whose AI output is used in the EU, whatever the size of the firm. A UK business using AI tools only for its own UK operations has little direct exposure, though suppliers may pass obligations on by contract.
Do we need an AI policy?
Yes, if anyone on your team uses AI tools for work. A short policy says which tools are approved, what data must never go into them and who checks the output. Our free [UK AI policy template](/resources/ai-policy-template) is a starting point.
When do we need a data protection impact assessment for AI?
When the AI processing is likely to result in a high risk to people's rights, which the ICO says includes many uses of new technology with personal data. If AI will make or shape decisions about customers or staff, assume a DPIA is needed.
Can staff use ChatGPT or Copilot with client data?
Only on a business plan with the right settings, and only for the data your policy allows. Business tiers of the main tools say they do not train on your data, but the policy still needs to say what can go in. For the most sensitive data, a [private AI platform](/services/secure-ai-platform) keeps it in your own cloud.
Get your AI use on paper
On a free call, tell us which AI tools your staff use and what worries you. If our template and an afternoon will do, we will say so.