The scale problem
A biased decision no longer affects one person
A biased human decision affects one applicant. A biased model affects every applicant at once, at machine speed, and keeps doing it until somebody measures it.
AI Governance
What AI Governance is, and why it matters
AI Governance is the set of decisions, checks and records that make sure the AI your organisation uses does what you intend, keeps doing it, and can be explained when someone asks.
Run the way you run safety
Every risk has an owner, and every decision leaves evidence
It is not an ethics committee and it is not a document library. It is how the work is controlled, the same way health and safety is.
The black box problem
If you cannot explain it, you cannot defend it
When a decision cannot be explained to the person it affects, nobody can be held to account for it. Regulators, tribunals and customers all ask the same question, and “the model decided” is not an answer.
The exposure problem
New failure modes your existing controls miss
Adversarial inputs, model drift, inference attacks that re-identify anonymised data, and safety failures in physical systems. ISO/IEC 27001 controls were not designed to catch any of these.
Every AI tool you use needs an owner, a control and evidence.
Where things stand
Where UK organisations stand now
AI adoption has run ahead of AI Governance almost everywhere. The rules are arriving unevenly, and faster in some places than others. An organisation that puts a management system in place now meets those rules ready, rather than in a rush.
In force in the EU
The EU AI Act applies to UK firms too
If you place AI systems on the EU market, or your AI output is used in the EU, the Act reaches you wherever you are based. Its obligations are tiered by risk, and the higher tiers require documented governance, risk management and human oversight. An ISO/IEC 42001 management system produces that evidence.
Developing in the UK
The UK is regulating through existing regulators
Rather than one AI act, the UK has so far worked through the regulators you already answer to, such as the ICO, FCA, MHRA and HSE, applying existing powers to AI. The obligations arrive through your sector, not on a single commencement date, and sooner than most boards expect.
Commercial pressure
Procurement is moving faster than the law
The practical deadline is rarely legislative. It is the AI questionnaire in a tender pack, the insurer's renewal form, or a customer's supplier assurance review. A certificate answers all 3 at once.
In short: a management system takes months to build and days to evidence. Start before the request arrives, not when it does.