The AI governance gap: Why every organisation needs a framework

Artificial intelligence has moved from experiment to everyday operations. Employees use it to draft documents, analyse data, serve customers and make recommendations. Organisations use it to automate processes and build new products. But adoption is now running ahead of governance, and that gap is becoming a board-level risk. 

Recent UK data shows how quickly the landscape has changed. Around 35% of UK businesses with 10 or more employees now report using at least one AI technology, up from roughly 12% in late 2023. Among larger businesses, adoption reaches 49%. Yet governance has not matured at the same speed. Deloitte found that fewer than half of generative-AI users say their organisation has a GenAI policy, while more than half either say no policy exists or do not know whether one does. [1] 

That combination of widespread use and limited formal control is why AI governance can no longer be treated as an IT issue. 

The governance gap is the real risk 

Most organisations do not face a shortage of AI tools. They face a shortage of clarity - who approved the tool, what data can be entered into it, who reviews its outputs, how errors are handled, and who is accountable when something goes wrong. 

AI can introduce bias, privacy failures, security exposure, intellectual-property leakage, inaccurate outputs and loss of human oversight. These risks are not hypothetical. They arise when staff use unapproved tools, when suppliers embed AI into software, or when AI-generated output feeds a business decision without appropriate review. 

The encouraging news is that UK leadership is beginning to respond. KPMG’s 2026 research found that 64% of UK organisations now place accountability for AI-informed decisions at C-suite level or above, and 80% are strengthening policies, processes and controls. Governance is becoming a leadership responsibility, not an optional technology add-on. [2] 

ISO/IEC 42001: good practice, with or without certification 

ISO/IEC 42001 is the international standard for an Artificial Intelligence Management System (AIMS). It provides a structured way to govern AI across its lifecycle by identifying AI use, assigning ownership, assessing risk, setting controls, monitoring performance, and improving over time. The standard is now adopted in the UK and Europe as BS EN ISO/IEC 42001:2026. 

Its value does not have to depend on certification. Certification can be powerful, particularly where customers, regulators or procurement teams require independent assurance. But even without pursuing a certificate, implementing ISO/IEC 42001 gives an organisation a practical governance framework. It helps answer questions boards, auditors, insurers and customers increasingly ask: 

• Do we know everywhere AI is used across the organisation? 

• Who owns each AI system, tool or use case? 

• What risks have been assessed, and what controls mitigate them? 

• How do we manage data, confidentiality and third-party AI suppliers? 

• Where is human oversight required? 

• How would we detect, investigate and respond to an AI-related incident? 

• Can we evidence all of this if challenged? 

In that sense, ISO/IEC 42001 is becoming what ISO/IEC 27001 is for information security, a recognised management-system approach that turns scattered controls into accountable, repeatable governance. 

Every organisation needs an AI policy 

An AI policy is no longer a ‘nice to have.’ It is the minimum control that tells people what responsible AI use looks like in your organisation. A useful policy should be short, practical and enforceable.  

It should cover: 

• Which AI tools are approved, restricted or prohibited. 

• What information may and may not be entered into AI systems. 

• Rules for customer, employee and confidential data. 

• Human review requirements for decisions affecting people, money, safety or legal rights. 

• Transparency expectations, including when customers interact with AI. 

• Procurement and supplier due diligence requirements. 

• Incident reporting and escalation routes. 

• Training and AI literacy expectations. 

The policy should also be supported by training. The EU AI Act already requires providers and deployers to take measures to develop AI literacy among staff and others operating AI on their behalf, acknowledging that governance fails when people do not understand the tools they use. [3] 

“We are not in the EU” is not a safe assumption 

UK organisations often assume the EU AI Act does not apply because they are not established in the EU. That assumption can be wrong as the act has extraterritorial effect. It can apply to organisations outside the EU that place AI systems or general-purpose AI models on the EU market, or that use the output of an AI system in the EU. A UK business using AI to screen candidates for EU roles, support EU customers, produce content consumed in the EU, or supply AI-enabled services to EU clients may therefore need to consider its obligations. [4] 

The timetable is also no longer distant. From 2 August 2026, enforcement began for several parts of the act, including prohibited practices, transparency requirements and rules for general-purpose AI models. From 2 December 2027, obligations for high-risk AI systems apply, including risk management, data governance, logging, documentation, human oversight, robustness, cybersecurity and accuracy requirements. [5] 

For many UK organisations, the immediate priority is not to panic about every provision. It is to establish whether they are a provider, deployer, importer or distributor, map AI use that touches the EU, and put governance in place before obligations harden. 

What 2027 may look like 

By 2027, AI governance is likely to become a normal part of organisational operations much as cyber security, privacy and financial controls already are. 

Expect to see: 

• Procurement questions become standard. Customers will increasingly ask suppliers how AI is governed, what data is used, where human oversight sits, and whether controls align with ISO/IEC 42001. 

• High-risk obligations take practical effect. From December 2027, organisations operating relevant high-risk AI systems in or for the EU will need documented risk management, traceability, oversight and robustness controls. [6] 

• AI literacy becomes a baseline expectation. Staff will need to understand not only how to use AI, but when not to use it and when human judgement must remain in control. [7] 

• Boards demand evidence, not assurances. “We have an AI policy” will no longer be enough; organisations will need inventories, risk assessments, ownership records, monitoring and incident-learning processes. 

• Governance becomes a competitive differentiator. Organisations that can demonstrate controlled, transparent AI use will be better placed to win trust, tenders and partnerships. 

The practical starting point 

Organisations do not need to solve AI governance in one project. A sensible starting point is to: 

1. Create an AI inventory covering tools, use cases, data flows and suppliers.
2. Approve or refresh an organisation-wide AI policy.
3. Assign clear executive ownership and operational responsibilities.
4. Conduct risk assessments for higher-impact AI use cases.
5. Define human oversight, review and escalation controls.
6. Train staff and embed AI literacy into onboarding and annual training.
7. Align controls with ISO/IEC 42001, using certification as an optional later step.

AI will continue to change quickly. The organisations that succeed will not necessarily be those that adopt the most tools first. They will be those that can adopt confidently, knowing where AI is used, who is accountable, how risk is controlled, and how to evidence responsible practice. 

References:

[1] https://www.ons.gov.uk/businessindustryandtrade/business/businessservices/articles/artificialintelligenceinukbusinesses/2023to2026 

https://www.ons.gov.uk/businessindustryandtrade/business/businessservices/articles/artificialintelligenceinukbusinesses/2023to2026 

https://www.deloitte.com/uk/en/issues/generative-ai/genai-workforce-survey-leadership-training.html 

[2] 
https://kpmg.com/uk/en/media/press-releases/2026/09/uk-businesses-shift-ai-focus.html 

[3] 
https://ai-act-service-desk.ec.europa.eu/en/resources 

[4] 
https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act 

[5] 
https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act 

https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai 

https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act 

[6] 
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai 

[7] 
https://ai-act-service-desk.ec.europa.eu/en/resources