Common questions about AI governance

AI governance is the set of decisions, responsibilities and rules that determine how an organisation uses AI: who can approve a tool, what data may go into it, who checks the output, and who answers when something goes wrong.

Size does not remove the need. A ten-person charity using AI with beneficiary data carries many of the same risks as a larger body, with fewer people to catch mistakes. Good governance for a small organisation is short and practical: named ownership, a plain-English policy and a regular board conversation. It does not need to be heavy.

Using them is not the problem. Using them without anyone deciding how is. Staff often adopt AI tools faster than organisations write rules for them, frequently on personal accounts and with no record of what data goes in. This is known as shadow AI, and it is a common gap.

The risks are confidential or personal data leaving the organisation, unchecked output reaching clients or beneficiaries, and a board that cannot say what is in use. The fix is rarely a ban. It is a list of approved tools, clear rules on data and a named person responsible. The AI Check shows where you stand in a few minutes.

All three have a role, but different roles, and confusing them is where things go wrong. The board is accountable for oversight: setting risk appetite and asking for evidence that AI is being used safely. Management owns delivery: the policy, the tool register, training and incident handling. The IT team supports, but should not carry the accountability alone, because most AI risk is about judgement and data rather than infrastructure.

Every organisation needs a named individual, often called an AI Governance Lead, with a clear line to the board. Accountability cannot be delegated to a tool or a supplier.

The UK has no single, general AI statute. Existing law applies to AI use: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, supervised by the Information Commissioner's Office (ICO), the data protection regulator, for personal data and automated decision-making (with the Data (Use and Access) Act 2025 rules on automated decisions in force since 5 February 2026); the Equality Act 2010 where AI influences decisions about people; and employment, consumer and intellectual property law.

Sector regulators such as the Financial Conduct Authority (FCA) for financial services, the Care Quality Commission (CQC) for health and social care, and Ofcom for communications apply their own expectations, and government expects regulators to apply five non-statutory, cross-sectoral AI principles within their own areas. For charities, the Charity Commission has said it does not expect to issue AI-specific guidance and expects trustees to apply their existing duties, with human oversight and an AI policy; its 2026 sector risk assessment says trustees remain responsible for safeguards, oversight and risk management. The picture is still evolving, so governance should be built to adapt. This is general information, not legal advice.

Possibly. The European Union (EU) AI Act reaches beyond the EU's borders: it can apply to UK organisations that place AI systems on the EU market or whose AI output is used in the EU. Most small and medium-sized businesses and charities are deployers, meaning users of other people's AI tools, and their obligations are lighter. Under the EU's recent amending law, the AI Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), deployers must take measures to support their staff's AI literacy, a softer duty than the original requirement to ensure a sufficient level.

Most transparency obligations for generative AI (tools that produce text, images or audio) have applied since 2 August 2026, and the main rules for high-risk AI systems have been deferred to December 2027 and August 2028. The timetable has already changed once, so check current dates. If you have EU clients, staff, suppliers or beneficiaries, confirm where you stand rather than assuming you are exempt, and take legal advice on any specific system.

No UK law makes directors or trustees personally liable simply for using AI. But existing duties apply to AI as they do to any material risk. Company directors must exercise reasonable care, skill and diligence under the Companies Act 2006, and charity trustees must act with reasonable care and skill, avoid exposing the charity to undue risk, and cannot delegate overall responsibility for it.

If AI causes harm and the board had no oversight, no policy and no record of asking questions, it is much harder to show it acted reasonably. The practical protection is evidence: minutes showing the board discussed AI, a named lead, a risk assessment and a policy. Individual exposure depends on the facts and the type of organisation, so take legal advice where it matters.

Short and usable beats comprehensive and ignored. A good policy covers which tools are approved and how to request a new one; what data must never be entered into unapproved tools; the requirement for a person to review any AI output before it affects someone or leaves the organisation; when AI use must be disclosed; how to report a mistake or incident; and who to ask.

Staff guidance should fit on one page, in plain English, backed by brief training. Review it at least annually, because the tools change fast.

Treat AI tools as you would any other processor of personal data. Before use, decide the lawful basis, check what the supplier does with inputs (some tools use them to train models, which may conflict with your obligations), and complete a Data Protection Impact Assessment (DPIA), the formal risk check for personal data. The Information Commissioner's Office (ICO) guidance says AI use will in most cases involve high-risk processing, so a DPIA will usually be legally required, and that is especially so when vulnerable people or sensitive data are involved.

Charities should take particular care with beneficiary information, health data and safeguarding records. Minimise what goes in, anonymise where possible, tell people how AI is used and keep human oversight of any decision that affects them. The ICO publishes guidance on AI and data protection.

Decide in advance what working means, then measure it. Useful measures include hours saved on defined tasks, quality or error rates, cost avoided or reinvested, and the effect on service. Compare against a baseline taken before the tool arrived, and count the costs that are easy to forget: licences, training, checking time and risk management.

Governance is what makes this credible. It gives the board figures rather than anecdote, and a basis for deciding what to scale and what to stop. See The AI Dividend for the argument in full.

CLEAR is HK Strategy Advisory's AI governance framework: Compliant, Lawful, Ethical, Accountable, Responsible. Each dimension is a question a board should be able to answer with evidence. The Ways Into Work case study shows it applied in a UK charity.

The way in is the AI Check, which leads to a complimentary Executive AI Governance Review: a personally written summary of your priority governance risks, returned within three to five working days. If it is useful, a 30-minute conversation is the next step.