Guide
AI governance is the set of decisions, controls and evidence that let an organisation use AI without losing control of the risks. Here is a framework you can actually run, and the UK and EU rules it has to satisfy in 2026.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
AI governance answers four questions for every AI system an organisation uses or builds: who is accountable for it, what it is allowed to do, how we know it is behaving, and what happens when it does not. It sits alongside data governance and information security rather than replacing them. Data governance looks after the data itself; security looks after who can reach it; AI governance looks after the decisions and outputs the models make with it, including the ones made by tools your staff adopted without asking.
It is not a policy document. A policy that nobody can point to in a live system is a statement of intent. Governance exists when a named person can show you the inventory, the risk rating, the test results and the last incident for a given use case.
The UK has chosen a principles based approach. There is no single UK AI Act; instead the existing regulators apply the government’s five principles (safety, transparency, fairness, accountability and contestability) within their own remits, so the ICO polices personal data in AI under UK GDPR, the FCA polices its use in financial services and so on. UK GDPR already requires a data protection impact assessment for high risk processing and gives people rights around solely automated decisions, and the ICO has published detailed guidance on explaining AI decisions.
The EU AI Act applies to any organisation that places an AI system on the EU market or whose system’s outputs are used in the EU, which catches many UK firms. Its obligations phase in between 2025 and 2028: prohibited practices and AI literacy from February 2025, general purpose model rules from August 2025, transparency duties for chatbots and generated content from August 2026, and, after the delay agreed in 2026, the detailed requirements for high risk systems from December 2027, or August 2028 where the AI sits inside a regulated product. ISO/IEC 42001, the AI management system standard, has become the common reference point for showing that governance exists, and procurement teams in regulated sectors are starting to ask for it.
Inventory and classification. A single register of every AI use case, including vendor features switched on inside existing software, each rated by the harm it could do to customers, staff, the business or the public. Most organisations find two to three times more AI in use than they expected.
Accountability. A named owner for each use case, a senior accountable executive for AI overall and a route to the board that reports something more useful than the number of pilots. The committee is less important than the names.
Risk assessment per use case. Proportionate to the rating: a one page check for a drafting assistant, a full assessment covering data, model, bias, security, vendor and legal exposure for anything that touches customers, money or employment decisions.
Data and privacy controls. What data each system may see, where it is processed, what is retained, whether it trains a vendor model, and the DPIA where one is needed. This is where most of the real risk lives.
Human oversight. Who reviews outputs, at what sample rate, with what authority to stop the system, and how a customer or colleague contests a decision.
Testing, monitoring and incidents. Acceptance tests before go live, ongoing monitoring of accuracy and drift, and an incident process that treats a bad AI output the way you would treat a data breach: logged, assessed, fixed and learned from.
Vendors and documentation. Contract terms that cover data use, model changes, audit rights and exit, and a record of all of the above that an auditor, regulator or acquirer can follow without you in the room.
The first month is discovery: build the inventory, rate it, and agree the accountable names. The second is design: write the controls at the level each rating needs, choose the standard you are aligning to and fix the vendor terms that matter most. The third is operation: run the first assessments on the highest rated use cases, stand up monitoring for anything already live and give the board its first honest report. Nothing in that sequence requires stopping the AI work already under way, and in our experience a programme that has a working framework moves faster afterwards, because the arguments about what is allowed have already been had.
Writing the policy and stopping. Creating a committee with no authority over budgets or go lives. Blocking everything, which drives use underground and makes the inventory fiction. Governing the tools you bought and ignoring the AI features that arrived inside the software you already had. And treating governance as a gate at the end of delivery rather than part of it: across the fifteen or so AI programmes we have delivered, the governance work was never what slowed delivery down. Its absence was.
Related reading: AI readiness, governance and implementation consultancy, the free AI readiness check, where to start with AI when your business feels lost.
Data governance controls the quality, ownership and use of data. AI governance controls the systems that make decisions or produce outputs from that data, including their accuracy, fairness, oversight and accountability. You need both, and AI governance fails quickly without the first.
Yes, if they place an AI system on the EU market, use one in the EU, or produce outputs that are used in the EU. Many UK firms with European customers or group companies are caught, and the high risk obligations are the ones to plan for.
For regulated sectors, public sector supply chains and anyone selling AI enabled services to large customers, increasingly yes, because buyers are starting to ask for it. For everyone else, aligning to it without certifying is a sensible way to structure the framework.
A senior executive with authority over budgets and delivery, supported by legal, data protection, security and the business owners of each use case. It should not sit with IT alone, and it should not sit with the vendor.
If you want a framework that your board, your auditors and your delivery teams can all live with, we can build it with you in weeks rather than quarters.