What Is AI Governance? The One-Page Version for a Business With No Compliance Department

AI governance used to be something banks did, in a room, with a committee. Then chatbots turned up inside Word, Outlook, the CRM and every browser tab your staff have open, and the question landed on businesses that have no compliance department to hand it to.

Tuesday, 3.40pm, a four-partner accountancy practice in Leeds. A trainee has a client's management accounts open and a filing deadline at five. He pastes the lot into a free chatbot and asks it to write the commentary. It does, in about nine seconds, and it is genuinely good.

Nobody did anything wrong, exactly. There was no rule to break. That is the whole problem, in one afternoon.

The scale of it, in UK numbers

This is not a fringe scenario. The Office for National Statistics found that self-reported AI use in UK businesses with 10 or more employees rose from around 12% to around 35% between late 2023 and June 2026 — almost tripling in under three years. Adoption varies sharply by sector: 58% in information and communication, 13% in construction.

The governance side has not kept pace. The government's Cyber Security Breaches Survey 2025/2026 found that around a third of businesses (31%) were using AI, adopting it or actively considering it — and that of that group, only 24% reported having cyber security practices or processes in place to manage the risks from it.

Read that the other way round: roughly three in four UK businesses touching AI have no process for what it might do. For a practice of nine people, that is not negligence. It is that nobody has had a spare Tuesday to think about it.

Three ways it goes wrong before anyone notices

The data leaves. A client's figures pasted into a consumer chatbot are now being processed by a third party you have no contract with, that your privacy notice does not mention, and that your client did not agree to. If those figures identify anyone, that is a UK GDPR problem, not an IT preference.

A decision arrives that nobody can explain. Six months in, a customer asks why they were put to the back of the queue, or declined, or quoted more. "The system worked it out" is not an answer you can give them, and under UK data protection law it is not one you are allowed to give either.

Something goes out that nobody read. AI writes confidently whether or not it is right. The failure mode is not gibberish, which anyone would catch. It is a plausible paragraph with one wrong number in it, on your letterhead, sent to a client.

None of the three needs a committee to prevent. They need someone to have written a page.

AI governance is the set of rules and checks that decide who may use which AI tool, on what data, for which decisions, and what a human must verify before anything is acted on. It is the operating discipline around AI, not a philosophy of it — and crucially, it is written down.

Most of the confusion comes from three terms being used as though they were one thing. They are three layers of the same stack, and knowing which one you are short of tells you what to do next.

The IEEE Standards Association puts the relationship neatly: ethics sets the direction, governance ensures follow-through. Plenty of small businesses have the ethics. Almost none have the follow-through, because follow-through is admin, and admin loses to fee-earning every single time.

The four questions your version has to answer

Strip away the frameworks and every AI governance system, from a bank's to a builder's, answers the same four questions. Yours needs to answer them on one page.

1. Which tools are approved? Name them. Anything not on the list needs asking about first.
2. What data may go into them? And, more usefully, what never may.
3. Which decisions need a human? Before the output goes anywhere near a customer.
4. Who is responsible? One name, and somewhere for people to raise a problem.

If you can answer those four, you have AI governance. If you cannot, you have AI.

Which rulebooks actually apply to a UK business

In the UK, one set of rules applies to almost everyone and the rest are conditional or voluntary. This is the part where most articles reach for the EU AI Act and skip the one that will actually reach you first.

The ICO one is worth reading properly, because it is short and it is the one with teeth. Where you make a solely automated decision with legal or similarly significant effects on someone, the ICO requires you to give individuals information about the processing, introduce simple ways for them to request human intervention or challenge the decision, and carry out regular checks to make sure your systems are working as intended.

That third duty is the one everybody forgets. Setting an AI system up carefully is a one-off. Checking it still behaves six months later is governance, and it is the difference between a policy and a filing cabinet.

The one-page AI policy, and exactly what goes on it

Here is the artefact. Six lines, written once, reviewed twice a year. It is deliberately short, because a policy nobody reads governs nothing.

That is the whole thing. Before you write it, spend half an hour on the inventory: ask everyone which AI tools they already use, and make it explicitly blameless. You will find two or three you did not know about. That is not a discipline problem, it is people trying to get their work done — and it is the most useful half hour in this article.

We build AI agents for UK small businesses, and we run several on ourselves: the chat agent on this page, the pipeline that publishes these articles, our own inbox automation. So the questions above are not theoretical for us. They are decisions we have to make in writing before anything goes live.

Four of them, every time.

The default is draft, not send. Our Email Manager categorises an inbox and writes replies in the client's own tone. Sending is a separate decision. Anything carrying a commitment, a date, a price or a complaint waits for a person, because the cost of a wrong send is not symmetrical with the time it saves.

Escalation is defined before launch, not after the first problem. An AI Receptionist answers what is on its approved list, books, reschedules and takes messages. Clinical or legal advice, price negotiation, and anyone who sounds unhappy get routed to a human with the transcript attached. The list of what it must not attempt is written before it takes its first call.

Everything is logged. Every conversation leaves a transcript. Not to watch anyone — because "carry out regular checks to make sure that your systems are working as intended" needs something to check, and memory is not evidence.

Data has a stated home. What is processed, where it goes, how long it stays. It is written in our privacy policy in the same words we would use with a client, because those two have to match.

The last row is the one that matters. An agent that knows what it does not know is worth more than one that is right slightly more often, and building for that is a design choice made early — which is much of what creating an AI system actually involves.

An honest limit, because it belongs here: governance will not make a weak model accurate, and it will not stop AI being wrong. What it decides is which of its answers are allowed out of the building unread, and that turns out to be the question that determines whether the thing is an asset or a liability. Accountancy practices, where we have done a fair amount of this kind of work, tend to grasp it faster than most — they already live by review layers and sign-off.

Frequently asked questions

What is AI governance in simple terms?

AI governance is your written answer to four questions: which AI tools staff may use, what data may go into them, which decisions need a human to sign off, and who is accountable when something goes wrong. For a small business it is one page, not a committee.

What are examples of AI governance?

An approved-tools list. A rule that client financials never go into a public chatbot. A requirement that AI-drafted emails are read by a person before sending. A named owner and a quarterly review date. A line in your privacy notice saying where AI is involved.

What is AI ethics, and how is it different from AI governance?

AI ethics is the principles — fairness, transparency, not causing harm. AI governance is the machinery that makes those principles happen: who decides, who reviews, what gets logged. As the IEEE puts it, ethics sets the direction and governance ensures follow-through.

What is responsible AI?

Responsible AI is the middle layer: ethics turned into working practice. It is the testing, documentation, bias checks and monitoring that sit between a principle and a deployed system. Ethics says what should happen, responsible AI is how, and governance is who answers for it.

Does a small business really need an AI policy?

If your staff use AI on anything involving customers, money or personal data, yes — and one page is enough. The point is not compliance theatre. Nobody can follow a rule that was never written down, and the ICO expects you to have thought about it.

Does the EU AI Act apply to UK businesses?

It can. The Act applies to organisations outside the EU that place an AI system on the EU market or put one into service there. A UK firm serving only UK customers is generally outside it; a UK firm whose AI-powered service is used by EU clients is not.

What does AI mean in the context of security?

Two things at once. AI is a new attack surface — staff moving data into tools you cannot see, and models that can be steered by their own inputs. It is also a defence, spotting odd patterns faster than people do. Governance keeps the first from outrunning the second.

What are the benefits of artificial intelligence for a small business?

Time back on repetitive work: calls answered out of hours, email sorted and drafted, leads qualified before you speak to them. The gain is largest where the work is high-volume and rule-based. Governance is what lets you take those benefits without taking the risks along with them.

Where to start, on an ordinary Tuesday afternoon

Do the inventory first, and say out loud that nobody is in trouble. Half an hour, one question to each person: which AI tools are you using? The answer is almost always longer than the owner expects, and you cannot govern a list you do not have.

Then write the six lines. Not a document — six lines, on one page, in the words your team actually uses. Name an owner, put a review date six months out in the diary, and send it round once.

Then pick the single decision in your business where an AI output reaches a customer without a person seeing it, and put a human there. If you only ever do one thing from this article, that is the one that pays for itself. Most firms find the benefits of artificial intelligence get larger, not smaller, once the risky edge is fenced off, because people stop quietly hedging and start using the thing properly. It is the same pattern behind most of the AI automation UK SMBs are adopting this year.

Back to Leeds, same practice, a Tuesday in the autumn. The trainee still has the management accounts open and still has a deadline at five. He uses the approved tool, on the firm's account, with the client's identifying details stripped out, because the page pinned by the kettle says so. The partner reads the commentary before it goes. It takes forty seconds longer than the version that nearly went wrong in the spring.

If you want a second opinion on where the human checkpoints belong in your own setup, talk to us — we will tell you honestly which parts of your process are ready for an agent and which are not. Or ask the chat agent on this page: it runs under the rules described above, which makes it the demonstration as well as the sales pitch.