Most UK businesses are already using AI, whether or not anyone decided they should. Staff paste text into chatbots, software suppliers switch on AI features, and a team somewhere buys a tool on a company card. The question that follows is simple. What has the business actually written down about it, and who is responsible when something goes wrong?
This guide sets out what regulation applies in the UK, what an AI policy needs to cover, how a policy differs from a governance framework, and who should own the whole thing.
1. What AI regulation applies to a UK business
The UK has not passed a single AI Act. It has taken a principles-based approach, in which existing regulators apply existing law to AI within their own sectors. In practice that means the Information Commissioner’s Office on personal data, the Financial Conduct Authority for financial services, the Competition and Markets Authority on markets and consumers, and so on for health, communications and other regulated areas.
Three things follow from that.
Existing law already applies. UK GDPR, equality law, consumer protection and sector rules all cover the use of AI today. A tool does not escape them because it is new.
EU rules can reach UK companies. The EU AI Act applies to organisations outside the EU that place AI systems on the EU market or whose AI outputs are used there. A UK firm with European customers may be in scope without ever opening an EU office.
Customers and boards ask anyway. Even where no rule demands it, procurement questionnaires, insurers and investors increasingly ask what controls a business has over its AI use. “We are waiting for the law” is not a satisfying answer.
2. What an AI policy should cover
An AI policy is the written statement of how your organisation will and will not use AI. It should be short enough that people read it and specific enough that they can act on it. A workable policy covers:
- Purpose and scope. Which tools, which teams, and whether it covers AI built into software you already own.
- Permitted and prohibited uses. Plain examples beat abstract principles. Say what staff may do, what needs approval and what is off limits.
- Data rules. What information may never be entered into an external AI tool, especially personal data, client confidential material and commercially sensitive information.
- Human oversight. Where a person must review AI output before it is used, particularly for decisions that affect customers, employees or money.
- Suppliers and procurement. How AI tools and AI features from third parties are assessed before they are bought or switched on.
- Transparency. When you will tell staff, customers or regulators that AI has been used.
- Incidents. How a problem is reported, who investigates it and how it is learned from.
- Review. Who updates the policy and how often, since the technology moves faster than most annual cycles.
3. A policy is not a governance framework
A policy states intent. A governance framework is the machinery that makes the intent real, and many businesses have the first without the second.
A framework usually includes an inventory of where AI is used, a way of sorting uses by risk so that effort goes where harm could be greatest, an approval route for new tools, monitoring once systems are live, and a record that shows decisions were made deliberately. Without these, a policy is a document that nobody can check against.
This is why the search for help often starts as “AI policy” and turns into “AI governance framework development”. The policy is the easy part. Making it operate day to day is the work.
4. Who should own AI governance
Ownership is where most organisations stall, because AI touches everything and so belongs to nobody. The common defaults each fail in a predictable way. Left with IT, it becomes a technical control and misses the business risk. Left with legal, it becomes a document review and misses how the tools are really used. Left with a single enthusiast, it falls apart when they move on.
The better question is who should own AI governance in a company, and the answer has three parts.
One accountable executive. A named senior person answers for AI risk to the board, with the authority to say no. In smaller businesses this is often the CEO, COO or CIO.
A small cross-functional group. Technology, legal, data protection, HR and the business units that use AI meet regularly to approve uses, review incidents and keep the inventory current.
Independent challenge. Someone without a stake in the projects tests whether the controls are real. For many mid-sized firms that means an external adviser rather than a new full-time hire, which is why searches for an outsourced AI governance officer are growing.
If you bring in outside help, a few questions separate useful advisers from vendors in disguise. Do they sell software that they will then recommend? Can they show governance work in organisations of your size and sector? Will they leave behind something your own people can run? And do they report to the board, or only to the project team?
5. Mistakes to avoid
Copying a template. A policy lifted from the internet describes someone else’s business, and staff can tell.
Banning rather than guiding. Blanket bans push use out of sight. People keep using the tools on personal accounts, and the business loses all visibility.
Forgetting the AI you already have. Features switched on inside existing software are AI use too, and they are often where personal data is exposed.
Writing it once. A policy with no review date is out of date by the time it is approved.
Treating it as a compliance exercise. The aim is to use AI with confidence. Rules that nobody follows protect nobody.
Making the decision
Before you commission anything, check whether you can answer three questions in a sentence each. Where is AI being used in the business today? Who is accountable for it at board level? And what happens if one of those uses goes wrong tomorrow? If any answer is vague, that is where to begin.
Alchemy Consulting provides AI policy and governance framework development for UK businesses, from the first inventory through to board reporting. When you assess the suppliers whose tools your policy will cover, our research on the AI safety gap scores nine leading AI providers across four safety pillars, set against the EU AI Act and the Product Liability Directive.
