Executive Summary
AI is no longer a technology question.
It is a governance question — and boards are now accountable for the answer.
What this paper is
This insight paper sets out what AI governance and ethics mean in practice for SME boards, founder-led businesses, and leadership teams. It is designed to be read in under 20 minutes, used as a board discussion paper, and kept as a practical reference. AI is no longer a technology story. It is reshaping how organisations hire, serve customers, manage risk, and make decisions — often faster than governance structures can keep pace. This paper exists to help close that gap.
Why 2026 is the inflection point
The pace of AI adoption has outrun the pace of AI oversight. Organisations that moved quickly to deploy AI tools are now facing the governance questions they deferred. The UK government has published cross-sectoral AI principles that regulators are actively applying. The EU AI Act came into force in 2024 and carries significant penalties for organisations within its scope. The regulatory environment is evolving, and organisations that build governance frameworks now will be better placed than those that wait for external pressure to force the issue. Directors and trustees should assume that existing duties on oversight, risk, and reasonable care already apply where AI becomes material to decisions, operations, or stakeholder outcomes. The purpose of this paper is to help boards understand what good looks like — and take the first steps toward it.
What you will find inside
A clear explanation of what AI governance and ethics actually mean. The HK Strategy Advisory CLEAR Framework — five governance dimensions for practical adoption. A board responsibility checklist. Eight governance questions every leadership team should be able to answer. And a practical implementation path you can start tomorrow.
The Scale of the Challenge
- 78%of organisations now use AI in at least one business function — up from 55% a year earlierMcKinsey State of AI, 2025 (1,993 respondents, 105 nations)
- 1 in 5companies has a mature governance model for AI agents — oversight is lagging adoption sharplyDeloitte State of AI in the Enterprise, 2026 (3,235 senior leaders, 24 countries)
- €35m or 7%maximum EU AI Act fine — whichever is higher. Applies to UK organisations in EU marketsEU AI Act, Article 99 (in force August 2024)
- 31%of boards globally say AI is not yet on their agenda — despite near-universal AI use in their organisationsDeloitte Global Boardroom Survey, 2025 (695 board members, 56 countries)
Section 01
What AI Governance and Ethics Actually Mean
Governance is the structure that ensures AI is used responsibly within your organisation. It covers who decides what AI can and cannot do, who is accountable when it goes wrong, and how decisions made by AI are reviewed, challenged, and corrected.
Think of it like financial governance: you wouldn't run a business without financial controls. AI governance is the equivalent layer for AI-enabled decisions.
Ethics is the standard of behaviour you apply to how AI is used. It asks whether AI is fair, transparent, and used in ways that respect the people it affects — your employees, customers, and wider communities.
Ethics sets the values. Governance creates the structures that embed those values into daily operations. You need both. One without the other fails.
The Difference in Practice
Who approved the use of this AI tool, and under what conditions?
Is this AI system making decisions that are fair to all affected parties?
Does our board have visibility of every AI system in use across the business?
Can our customers understand how AI is affecting decisions made about them?
The UK Regulatory Landscape — What Boards Need to Know
The UK government has published five cross-sectoral AI principles — Safety, Transparency, Fairness, Accountability, and Contestability. These are not yet statutory requirements, but regulators including the ICO, FCA, CMA, and Ofcom are applying them as the standard of expected practice.
The EU AI Act came into force in August 2024. UK businesses operating in EU markets, serving EU customers, or whose AI outputs are used within the EU are within scope. Maximum fines reach €35 million or 7% of global turnover, whichever is higher.
The UK regulatory landscape for AI is evolving rapidly. Organisations that build governance frameworks now will be significantly better positioned than those that wait for external pressure or regulatory intervention to compel action.
The Data (Use and Access) Act 2025 creates a more permissive framework for some solely automated decisions while still requiring safeguards and transparency where AI is used to process personal data.
Section 02
The HK Strategy Advisory CLEAR Framework
Five dimensions for responsible AI governance
Together these five dimensions form a complete methodology for building responsible AI governance in any organisation.
- COMPLIANT
Operate within the UK's five cross-sectoral AI principles — Safety, Transparency, Fairness, Accountability, and Contestability — as well as UK GDPR and sector-specific regulation. Regulators including the ICO, FCA, CMA, and Ofcom are actively applying these principles. Compliance is not a one-off exercise; it requires ongoing monitoring as guidance evolves.
- LAWFUL
Every AI system deployed within your organisation must have a clear legal basis. This means understanding data protection obligations, contractual liability, and director duties under the Companies Act 2006. The EU AI Act is now in force, and the UK regulatory environment is evolving. Organisations that address their legal obligations now are in a stronger position than those that act only when compelled.
- ETHICAL
Apply clear values to every AI decision: fairness, honesty, transparency, and respect for human dignity. Ethics asks not just whether AI is legal, but whether it is right. This means testing for bias, being transparent with those affected by AI decisions, and never using AI in ways that compromise the trust of your employees, customers, or stakeholders.
- ACCOUNTABLE
Assign named ownership of AI at board level. Accountability means someone is responsible — not a team, not a system, not a vendor. It means maintaining audit trails for AI-influenced decisions, establishing escalation routes when AI produces unexpected outcomes, and ensuring that a human can always review, challenge, and override any AI output. Accountability without oversight is not accountability.
- RESPONSIBLE
Take proactive ownership of AI risk across your entire operational footprint — including third-party tools, embedded AI features in software, and supply chain dependencies. Responsible AI governance does not wait for a failure before acting. It anticipates risk, assesses impact, and builds mitigation into how AI is adopted from the outset. Responsibility is the principle that binds all others together.
Section 03
Board & Leadership Responsibilities
Directors have a legal duty to promote the success of the company under Section 172 of the Companies Act 2006. Those existing duties apply equally where AI becomes material to business decisions, risk, or internal controls. The UK Corporate Governance Code 2024 reinforces board responsibility for risk management and material internal controls. Where AI systems materially influence business decisions or operations, boards should consider whether those systems fall within that oversight responsibility. Automation does not remove legal responsibility. It increases the need for structured oversight.
Five Board Responsibilities for AI Governance
- Understand AI Exposure
Boards must know which AI systems are operating across the business — including third-party tools and software with embedded AI features. An AI inventory is the starting point. You cannot govern what you cannot see.
- Assign Accountability
Appoint a named board member or senior leader with responsibility for AI governance. In smaller organisations, this may be the CEO or COO. What matters is that accountability is explicit, not assumed.
- Establish Oversight Structures
Create documented policies covering AI approval, use, risk assessment, and review. Audit trails for AI-influenced decisions are not just good practice — they are your legal protection if a decision is challenged.
- Build Board Literacy
Directors do not need to be technical experts. But they must be equipped to ask the right questions, challenge assumptions, and scrutinise AI risk reports. Regular board briefings on AI developments are now a governance standard, not a luxury.
- Monitor and Report
AI governance should be a standing board agenda item. This includes reviewing AI incidents, near-misses, regulatory developments, and any significant change in how AI is being used across the business.
Section 04
Eight Governance Questions Every Board Should Answer
Use these eight questions as a governance health check. If your board cannot confidently answer them, you have identified the gap you need to close. This is not a compliance exercise — it is a risk management tool.
- Do we have a complete inventory of all AI systems in use across our organisation?
- Is there a named board member accountable for AI governance?
- Do we have a documented AI policy covering approval, use, and review?
- Can we explain how AI-influenced decisions are made to those affected by them?
- Do we carry out risk assessments before deploying any new AI system or tool?
- Are our AI systems free from demonstrable bias in the decisions they influence?
- Do we have a process for reporting and reviewing AI errors or incidents?
- Are we monitoring changes in UK and EU regulation relevant to our AI use?
AI Ethics: Five Questions for Leadership Teams
Are outcomes consistent and unbiased across different groups of people?
Do people know when AI is involved in decisions that affect them?
Is data used by AI systems collected and processed with full consent and legal authority?
Can a human always review, challenge, or override any AI decision?
Have we assessed — and mitigated — the ways this AI could cause harm?
Section 05
A Practical Implementation Path
Good AI governance does not require a large budget or specialist in-house technical capability. It requires clarity, structure, and leadership commitment. The path below is designed for organisations starting from scratch — and for those who want to strengthen what they already have.
01 Audit & Understand
Complete an AI inventory — list every AI tool and system in use
Map where AI influences decisions affecting people
Identify gaps against the HK Strategy Advisory CLEAR Framework
Brief board and senior leadership team on governance responsibilities
02 Policy & Structure
Draft an AI Use Policy covering approval, boundaries, and review
Establish an AI risk register
Create a simple decision log for AI-influenced business decisions
Assign board-level accountability for AI governance
03 Embed & Monitor
Add AI governance as a standing board agenda item
Conduct quarterly AI risk reviews
Run staff awareness and acceptable use training
Monitor UK and EU regulatory developments and update policy accordingly
What Good Looks Like: Indicators of a Governance-Ready Organisation
- A complete AI inventory is maintained and reviewed at least annually
- A named board member holds accountability for AI governance
- An AI Use Policy is in place, communicated, and understood by staff
- AI risks appear on the board's risk register
- The board receives regular updates on AI regulatory developments
- Staff are trained on acceptable AI use and can raise concerns
Conclusion & Next Steps
AI governance is not a future priority. It is a present responsibility.
Boards and leadership teams that treat AI as a purely operational matter — something handled by technology teams — are misreading the risk. The question of how AI is used, who is accountable for it, and whether it operates within ethical boundaries is a board-level question. It always has been. The arrival of powerful, widely accessible AI tools simply makes the stakes visible.
The organisations that get ahead of this are not necessarily the most technically sophisticated. They are the ones whose leadership teams have asked the right questions, put structure around the answers, and embedded accountability at the top.
Three Things to Do This Quarter
Put AI on the board agenda
Add AI governance as a standing item. Assign a board member to lead it. Make it a priority, not an afterthought.
Build your AI inventory
List every AI tool in use across your organisation. You cannot govern what you cannot see.
Benchmark against the CLEAR Framework
Take this paper to your next board or leadership meeting. Use it as the start of your governance conversation.
Work With HK Strategy Advisory
If this paper has raised questions about how your organisation governs AI, we can help. HK Strategy Advisory works with SME boards, founder-led businesses, and leadership teams to build practical, credible AI governance frameworks — from initial audit to full board-level implementation.
Contact us to arrange an AI Governance Review.
This paper is provided for general informational and educational purposes. It does not constitute legal, regulatory, or professional advice. Organisations should seek appropriate professional guidance for their specific circumstances.