// in this post
AI governance comes down to five jobs. This piece names them, says who in a business of 50 to 500 people should hold each one, and sets out the one-hour quarterly review that stops the whole thing going stale. You'll finish with one decision to make this week: who owns AI.
The Office for National Statistics found that 30% of UK businesses were using at least one AI technology in its survey that closed on 4 October 2026, rising to 38% among businesses with ten or more employees. A Deloitte UK survey of 25,000 workers, run in May and June 2026, found that 31% of the people using generative AI at work were doing it without their employer knowing. If you run a business of a few hundred people, the safe assumption is that AI is already in use and that some of it isn't on anyone's list.
Governance is what answers the next question: who is responsible for all of it, and how would you know? It isn't the same thing as a policy. A policy says what staff may and may not do. A strategy says what the business is trying to achieve with AI. Governance is the machinery that holds both in place: who decides, what's running, what happens when something breaks, and when you look again.
Why nobody is going to hand you a checklist
The UK still has no comprehensive AI law, as Lewis Silkin noted in September 2026. Existing regulators apply existing law instead, guided by the five principles in the government's 2023 AI white paper: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. Look at the fourth one. Accountability and governance is one of the five tests regulators are expected to apply, and it only works if someone inside your business has been given the job.
Here is how that lands in practice.
Data protection. The ICO says a data protection impact assessment is required where processing is likely to result in a high risk to people, and its list includes innovative technologies, including AI, when combined with another high-risk factor. The automated decision-making rules also changed this year. Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026. Significant decisions made only by automated means are now allowed more widely, as long as you tell people, give them a way to get a human to review the decision, and let them contest it (Bratby Law's summary). The stricter rules for special category data stay. The ICO's guidance on all this is still a draft out for consultation.
Financial services. The FCA says it doesn't plan to introduce extra AI-specific regulation and will rely on existing rules, including the Senior Managers regime, which puts accountability on named individuals (FCA, page updated 2 October 2026).
The EU. The AI Act can reach a UK business whose AI system's output is used in the EU (Article 2). The Digital Omnibus on AI came into force on 27 July 2026. It moved the high-risk rules for stand-alone systems, such as recruitment and credit scoring, from 2 August 2026 to 2 December 2027. The duty to support staff AI literacy has applied since February 2025 and was softened, not removed.
You might expect the government to fill the hole with a checklist. It tried. In November 2024 the Department for Science, Innovation and Technology put out a self-assessment tool called AI Management Essentials for consultation, aimed partly at smaller firms. In its response on 6 February 2026 it said it would not publish the tool and would produce narrower guidance for smaller firms instead, with no delivery date. So the official SME checklist doesn't exist yet. You'll have to build the working version yourself, and it has to keep up with rules that are still moving.
The five jobs
| Job | What it means | Who should hold it | How you know it's working |
|---|---|---|---|
| Owner | One named person accountable for AI across the business | The COO, operations director or MD | Three managers give you the same name |
| Register | A list of every AI tool and use, with its owner and data | The owner, fed by IT and whoever handles data protection | You can say what's running and what data it touches in ten minutes |
| Approval route | How a new tool or use gets a yes, a no or a yes with conditions | The owner decides, with data protection consulted on high-risk uses | A request gets an answer within a week |
| Incident route | Who is told, how fast, and what happens next | The owner, with everyone able to report | Anyone can say what they'd do at 4pm on a Friday |
| Review rhythm | A fixed quarterly check on the first four jobs and the strategy | The owner runs it, the MD or CEO attends | The next one is in the diary |
The "how you know" column is my own working test, not a standard. Use it as a quick audit.
1. The owner
Name one person. McKinsey's State of AI report, published in March 2025 from a survey run in July 2024, found that CEO oversight of AI governance was one of the factors most closely linked to higher self-reported bottom-line impact from generative AI. That's a correlation from a survey that is now two years old, so don't build a business case on it. The more useful finding is how rarely it happened. Only 28% of respondents whose organisations used AI said their CEO oversaw AI governance, and 17% said their board did. Governance was often shared, with two leaders in charge on average.
Shared ownership sounds safe. In practice each of the two assumes the other one holds the register. My view is one name, with others supporting. In a business of 50 to 500 people the owner is usually the COO, the operations director or the MD, because the owner needs the authority to say no to a team and the reach to find out what teams are doing. IT can rarely do both on its own. If you're FCA regulated, check first who already holds the relevant senior management responsibilities, since the FCA says the Senior Managers regime is relevant to the safe use of AI.
2. The register
A register is a list of every AI tool and every AI use in the business. People call it paperwork until the day they need it. It lets you answer "which AI tools have touched this customer's data?" without a week of emails, and it gives the owner something concrete to review.
| Tool or use | Owner | Data it touches | Approved for | Tier | Next review |
|---|---|---|---|---|---|
| Meeting notes assistant (illustrative) | Head of Operations | Internal discussion, some personal data | Internal summaries only | 2 | January 2027 |
| CV screening add-on (illustrative) | HR Director | Applicant personal data | Not yet approved | 3 | n/a |
| Chat assistant on company licences (illustrative) | IT Manager | Internal documents | Drafting and analysis, no client data | 1 | January 2027 |
Plan for the first version to be incomplete. Deloitte's 31% is the reason: some of what's running won't be on your list until you ask. Ask everyone, say plainly that you're asking so you can approve things and not to punish anyone, and treat each unlisted tool as information about what your approved tools don't do. Of the 3,562 Deloitte respondents who paid for their own tools or used unapproved ones, 21% said those tools outperform what their company provides.
3. The approval route
Not every use needs the same scrutiny, so scale the review to the risk. Three tiers cover most businesses of this size.
| Tier | What it covers | What it needs |
|---|---|---|
| 1 | Drafting, summarising and searching with public or non-sensitive information, in a tool on the approved list | The owner's standing approval. Nothing per use. |
| 2 | Anything customer-facing, anything using confidential business or personal data, any tool connected to your systems | A named reviewer checks the vendor's terms (where data goes, whether it trains models, how long it's kept), a human checks output before it leaves the building, and the tool goes on the register |
| 3 | Decisions or scores about individuals (recruitment, performance, credit, access to a service), regulated advice, and AI agents that take actions | The owner signs off, you check whether a DPIA is needed, and there's a documented human review step |
For tier three, the ICO says a DPIA is required for extensive automated evaluation of people where the decisions have legal or similarly significant effects. Under the new automated-decision rules, the test is whether a human is involved in a meaningful way, not just nominally. The ICO's draft guidance is where to look for how it will read that. For agents, which act rather than just answer, the failure modes are covered in the piece on agent risks and guardrails.
Checking is already common but rarely formal. The Department for Science, Innovation and Technology's AI adoption research, published in January 2026 from fieldwork in spring 2025, found that 84% of businesses using AI applied at least some checking to outputs, but only a few said they had a specific procedure for it. A written tier is the procedure.
Give every request an answer within a week. If the route is slow, people don't wait. They use the tool anyway, which is how tools end up on the unlisted side of that 31%.
4. The incident route
Decide in advance what counts and who hears first. Four examples: personal data pasted into a tool that isn't approved, a wrong AI output reaching a customer, an agent doing something nobody asked it to, and a vendor changing its terms. If you want to see what these look like in practice, 10 real-life AI horror stories has examples.
Everything goes to the owner the same day. The owner decides whether it's a personal data breach. If it is, and there's likely to be a risk to people, the ICO must be told without undue delay and within 72 hours of you becoming aware of it. If you decide it isn't reportable, the ICO still expects you to document and justify that decision. The clock starts when the business becomes aware, so a report sitting unread in someone's inbox is a risk in itself.
Make reporting cost nothing. If the person who reports gets blamed, the next one won't.
5. The quarterly review
Put one hour in the diary every quarter, with the owner running it and the MD or CEO in the room. Five items, in this order:
- The register. What's been added, removed or changed hands.
- Incidents and near misses. What happened, and what changed because of it.
- Requests. What was approved, what was refused, and how long each took.
- What's changed outside. Rules, vendors and the tools themselves.
- The strategy. Are the use cases still the right ones, and are the numbers moving? The strategy piece covers what goes in that document.
Item four is the reason it's quarterly. In 2026 the automated-decision rules changed in February, the government dropped its SME tool the same month, the EU moved its high-risk dates in July, and the ICO's guidance on automated decisions is still a draft. A review held every January would have been out of date by February.
The ICO's own internal AI use policy is a useful model. Version 1.1, published in August 2025, assigns accountability to a named board, logs governance decisions, requires approved tools and human review of outputs, and carried a review date of August 2026. The regulator built in the review.
What proportionate looks like
For a business of 50 to 500 people I'd keep the whole thing small: one owner, one register in a shared spreadsheet, a three-tier approval route, a one-page incident route and a quarterly hour. If that sounds like too little, a small system that gets run beats a large one nobody opens.
ISO/IEC 42001, published in 2023, is the international standard for an AI management system, and it's open to organisations of any size. Because the UK has no AI Act, nothing in AI law requires you to certify. I'd get these five jobs running before spending money on an audit. If a customer or a tender asks for the standard later, you'll have a head start.
The decision for this week
Name the owner. Tell them it's theirs. Put the first review in the diary before the end of the quarter.
If you'd rather build this with someone, a Discovery engagement writes the AI strategy, the usage policy and this governance together with your people, so they are documents your teams use, not ones that sit on a shared drive. Get in touch if you'd like to talk it through first.
FAQ
What is AI governance in a business?
The arrangements that decide who is accountable for AI, what is running, how a new use gets approved, what happens when something goes wrong, and when all of it gets reviewed. A policy tells staff what to do. Governance makes sure someone is responsible for the policy, the tools and the outcomes.
Who should own AI governance in a small or mid-sized business?
One named senior person with the authority to say no to a team. In most businesses of 50 to 500 people that is the COO, the operations director or the MD, supported by IT and whoever handles data protection. In McKinsey's 2025 survey, only 28% of respondents whose organisations used AI said their CEO oversaw AI governance, and it was often shared between two leaders. Shared ownership is where tasks get dropped.
How often should AI governance be reviewed?
Every quarter, for about an hour. In 2026 alone the UK's automated decision-making rules changed in February, the government shelved its SME self-assessment tool the same month, and the EU moved its high-risk AI deadlines in July. An annual review would have been out of date within weeks.
What is an AI register, and do I need one?
A list of every AI tool and use in the business, with who owns each one, what data it touches, what it's approved for and when it was last reviewed. It's what lets you answer 'which AI tools have touched this person's data?' without a week of emails, and it's the first thing an owner needs to review. Expect the first version to be incomplete: a Deloitte UK survey in 2026 found 31% of generative AI users at work were using it without their employer's knowledge.
Does a UK business need ISO 42001?
No. ISO/IEC 42001 is the international standard for AI management systems, and it is open to organisations of any size, but the UK has no AI Act that requires certification. Get the five jobs in this piece running first. If a customer or tender asks for the standard, you will have a head start.
Does the EU AI Act apply to a UK business?
It can. Article 2 covers providers and deployers outside the EU when the output of their AI system is used in the EU. Since the Digital Omnibus on AI came into force on 27 July 2026, the high-risk rules for stand-alone systems such as recruitment and credit scoring apply from 2 December 2027, but the duty to support staff AI literacy has applied since 2 February 2025.