Guides to inventorying, assessing and controlling AI use for UK firms with 25 to 250 people. Framework-agnostic, and mapped to ISO 42001 and the EU AI Act where it matters.
Your teams are already using AI, whether or not anyone decided they could.
AI governance is how a firm decides where AI can be used, who is accountable for each use, and how its risks are found and controlled. It covers the tools your staff adopt, the AI built into products you buy, and any AI you build into your own.
For a firm of 25 to 250 people, the pressure arrives from two sides. Enterprise customers now ask about AI in their security questionnaires, and the EU AI Act places obligations on firms whose AI systems or their outputs reach the EU.
A policy nobody can map to a system governs nothing.
ISO/IEC 42001 gives you a management system to run it. The guides here work with or without certification.
Every guide in this vault maps to a level. Start where you are.
The principles, risks, policy and regulation every AI programme starts from.
Register AI use, assess each use case, keep humans in the loop and build literacy.
Map controls, monitor AI in production, prepare for audit and govern AI agents.
Accountability for AI belongs to a named person, not a committee. In a firm your size that is often the person already responsible for security or compliance, working with the teams that use AI day to day.
Each AI use case needs an owner in the team that runs it, accountable for its risks and its human oversight.
Leadership sets the boundaries: which uses are allowed, which need approval and which are off-limits.
Start with the register. You can't govern what you haven't found.
Short answers to the questions we hear most from firms putting their first AI governance in place.
It is the set of policies, roles, processes and controls a firm uses to make sure its use of AI is safe, lawful and aligned with what the business is trying to do. It covers AI you use, AI you buy and AI you build.
It can. The Act applies to providers placing AI systems on the EU market and to deployers in the EU. It also reaches providers and deployers outside the EU where an AI system's output is used in the EU. A UK firm selling into the EU should check its position: see the EU AI Act.
The UK has no single AI law. It has taken a principles-based approach, in which existing regulators such as the ICO and the FCA apply cross-sector principles within their own remits. Data protection law already applies to any AI that processes personal data.
Not by law. ISO/IEC 42001 is a voluntary, certifiable standard for an AI management system. It is worth pursuing when customers ask for it or when AI is central to what you sell: see ISO 42001.
With an AI register. Find every AI system and use case in the business, including AI inside the tools you already pay for. Then agree a policy, assign owners and assess the highest-risk uses first. The NIST AI RMF is a useful free reference for structuring the work.
Every guide in one place. Filter by level.
Work with a Trust Architect to inventory your AI use, assess the risks and put controls in place that your board and your enterprise customers can rely on.