The word, “governance”, gets used a lot, so we’re unpacking the big question “what does good AI governance actually look like?”
Our last piece on AI and risk focused on the point that insurers are asking harder questions about the cover you already have, rather than building a new policy specifically for AI risk. For most “AI adopters” how that conversation goes is largely reliant on if you can show you’re governing AI use at all.
So, here’s what it involves in practice.
Most businesses underestimate how much AI they’re already using, because a lot of it isn’t thought of as a typical “AI project”. It can creep up on you as a new feature update in a tool you’re already using. This could be that your CRM has introduced AI lead scoring that’s switched on by default, a help desk platform with an AI chatbot, or a design tool with AI image generation. A lot of the time this can just appear in a software update without you noticing or actively implementing.
The first real step in governance is a register that captures all of it, both the AI tools you deliberately bought in, as well as the ones that come in undetected. For each one, you want to know: what it does, what data it touches, whether it makes or influences a decision about a customer or employee, and who in the business owns it.
Governance that belongs to “the business” belongs to no one. The businesses that handle this well have one named individual, not necessarily a dedicated AI role, often someone already in compliance, operations or IT, who has the authority to say no to a deployment and the job of keeping the register current. That person doesn’t need to vet every prompt, they just need to be someone who can answer “where are we using AI, and why” at short notice.
A short, plain-language policy covering what AI can be used for, what it can’t, what data can go into it, and when a human has to check the output before it goes anywhere near a customer or a decision. An insurer or a regulator asking “do you have an AI policy” wants to see something down on paper, and “we trust people to use good judgement” isn’t an answer that holds up at renewal or under scrutiny.
This is the part we flagged last time as an “immutable activity record”, and it’s worth spelling out why it matters so much. If an AI tool produces bad advice, a biased outcome, or a decision someone later disputes, the question is usually what did the system see, what did it output, and did a human review it. If the honest answer is “we think so”, you’re relying on memory. If you can pull a log, you’re relying on evidence.
If AI is embedded in a platform you didn’t build, the exposure still exists, it’s just shifted. Vendor due diligence now needs an AI-shaped question in it - does this platform use AI, on what data, can you turn features off, and what does the vendor’s own contract say about liability if its AI gets something wrong. Existing supplier contracts, especially older ones, were mostly written before this question existed, which means a lot of businesses have AI risk sitting in agreements that never mention it.
There’s no single UK AI law, and there probably won’t be one soon. Instead, AI is being regulated through the rules you’re already subject to, which is arguably harder to track. A few that matter right now:
→ Changes to UK data protection law (the Data (Use and Access) Act) now allow fully automated decisions about people in more situations, but only where there’s genuine human review available and the process is formally documented.Someone (not necessarily a legal team) in the business needs to know it exists and to be able to say, in plain terms, which of it applies to you.
The theme running through all of the above is the same. It’s not enough for your AI use to be reasonably well managed, you need to be able to show it. A risk register that exists only in someone’s head, a policy that was agreed once and never updated, a vendor contract no one’s reread since the AI feature was added, none of that stands up to the kind of question a broker, an insurer or a regulator now asks.
This is why we keep bringing the conversation back to the broker question. Good governance reduces the chance of something going wrong and changes the conversation you have when something does. If you walk into renewal with a register, a named owner, a policy and a log, you’ll be in a much stronger proposition than if you walk in with “we use a bit of AI, informally”.
If you haven’t built any of this yet, start with the register and everything else can follow. Every business’s position is different, if you want to talk through what AI governance should look like for yours, and how it feeds into your cover, get in touch!
Disclaimer: This content has been produced for general information purposes and should not be taken as formal advice. You should always seek specific professional advice before acting on any of the information given.