The EU AI Act is here: a pragmatic plan for UK organisations

Regulation has caught up with AI. The EU AI Act applies extraterritorially, UK guidance continues to mature, and boards are — rightly — asking who owns the risk. The temptation is to respond with either paralysis or box-ticking. Both are mistakes.

Good AI governance is not a brake on delivery. Done proportionately, it is what lets you deploy — because you can answer, credibly, the questions leadership, regulators and clients will ask.

Start with an inventory

You cannot govern what you cannot see. The first step is a living inventory of where AI is used — including the quiet, unofficial adoption already happening in your teams. Each use gets an owner and a risk classification.

Classify by risk, act proportionately

Not every use case needs the same scrutiny. A drafting assistant for internal notes is not a decision system affecting someone’s livelihood. Tier your uses, and put the heaviest controls where the stakes — and the regulatory obligations — are highest.

Make controls part of the system

The most durable governance is technical, not procedural. Audit trails, access controls, content guardrails and evaluation should be properties of the platform your teams use — not policies people are asked to remember. When the safe path is the default path, compliance stops depending on goodwill.

A management system gives that structure a backbone. ISO/IEC 42001, the international standard for AI management systems, is fast becoming the way organisations demonstrate — to regulators, clients and their own boards — that they manage AI risk, ethical use and legal compliance deliberately rather than by accident. We operate to it ourselves, and we help clients stand up and certify their own.

Keep humans accountable

Regulation consistently returns to one principle: a person must remain accountable for consequential decisions. Design for meaningful human oversight, document it, and you satisfy both the letter and the spirit of the rules.

A sensible sequence

• Inventory current and planned AI use.
• Classify each use by risk and assign an owner.
• Apply proportionate controls, embedded in the platform.
• Evaluate high-risk systems before and after go-live.
• Review quarterly as both your usage and the rules evolve.

Compliance is not the goal. Deploying valuable AI with confidence is the goal — and proportionate governance is how you get there without stalling.