AI governance: the risks a director has to own
Your team is already using AI, whether or not you have a policy. Here are the risks that stay with the board, what UK GDPR expects of you, and the small set of controls that cover most of it.
By Gary Kellett6 min read
For directors of UK SMEs who are accountable for data, contracts and reputation.
If you run a business with more than a handful of staff, someone on your team is already using AI. They are drafting emails, summarising documents and tidying spreadsheets. Most of that is harmless and helpful. Some of it involves customer data, employee data or commercial information going into tools you have never looked at. As a director, that risk sits with you.
This is not legal advice, and for anything high-stakes you should speak to a solicitor. It is the practical view I give boards when they ask what they actually need to do.
What stays with the board
You can hand the work to a supplier or an adviser. You cannot hand over the accountability. Four kinds of risk stay at board level.
- Data protection: personal data processed by an AI tool is still personal data, and your business is still the controller.
- Confidentiality: client contracts, pricing and plans pasted into a tool may be stored or used in ways your contracts forbid.
- Accuracy: AI output can be confidently wrong. If it reaches a customer unchecked, the mistake is yours.
- Fairness and decisions about people: using AI to screen candidates, score customers or set individual prices carries legal and reputational weight.
What UK GDPR expects
UK GDPR and the Data Protection Act 2018 apply to AI tools in the same way as to your CRM or payroll. The Information Commissioner's Office (ICO) publishes guidance on AI and data protection, and it is worth a director's half hour. In plain terms, the points that come up most in small firms are these.
Step 1: Know your lawful basis
If a tool processes personal data, you need a lawful basis for that use, just as for any other processing.
Step 2: Check the supplier is a processor, under contract
Business plans of most AI tools offer a data processing agreement. Free consumer versions often do not, and may use your inputs to improve their models.
Step 3: Know where the data goes
Transfers of personal data outside the UK need appropriate safeguards. Ask the supplier where data is stored and processed.
Step 4: Do a DPIA when the risk is high
A data protection impact assessment is required for processing likely to result in high risk to people, which can include new technology used on personal data at scale.
Step 5: Tell people
Your privacy notice should cover AI use that involves personal data.
Watch out: Automated decisions about people
UK GDPR has specific rules on decisions made solely by automated means that have legal or similarly significant effects on a person. The Data (Use and Access) Act 2025 changes some of the detail, so check the ICO's current guidance before you rely on it. My practical rule for SMEs is simple: if a decision materially affects a person, a person makes it, and AI only prepares the information.
The everyday risk: shadow AI
The risk I see most often is not a rogue algorithm. It is a well-meaning member of staff pasting a customer complaint, a payroll export or a tender document into a free tool to save twenty minutes. Banning AI rarely stops this; it just stops people telling you. The better answer is to give them an approved tool on a business plan, with clear rules about what may and may not go into it.
The minimum set of controls
For a firm of 10 to 250 people, I recommend starting with five controls. None of them needs a big programme.
- A one-page AI use policy that says what is allowed, what is not, and who to ask.
- An approved tools list, on business plans with a data processing agreement, and a simple way to request a new tool.
- A named owner at director level who reviews the list and the policy every six months.
- A rule that AI output reaching a customer, a regulator or a contract is checked by a person first.
- A short log of where AI is used in a process that touches personal data, with the lawful basis and whether a DPIA was needed.
That set will not satisfy a regulated bank, but it puts most SMEs in a far stronger position than the typical 'we have not really discussed it'. In regulated industries such as pharma, healthcare and financial services, governance needs to sit inside validated, auditable systems, and I would scope that separately.
Questions to ask any AI supplier
- Will you sign a data processing agreement, and are you acting as our processor?
- Is our data used to train or improve your models, and can we switch that off?
- Where is our data stored and processed, and for how long?
- What happens to our data if we leave?
- How do we get an audit trail of what the system did and why?
If a supplier cannot answer those clearly, that is your answer. The AI policy builder will help you write the one-page policy in about ten minutes, and it is a sensible place to start this week.
Questions directors ask
Does UK GDPR apply to tools like ChatGPT or Copilot?
Yes. If personal data goes into an AI tool, UK GDPR applies as it would to any other system. You need a lawful basis, a suitable contract with the supplier and appropriate safeguards for any transfer outside the UK.
Do I need a DPIA for using AI?
You need a data protection impact assessment where processing is likely to result in a high risk to people. Many everyday uses will not meet that bar, but AI used on personal data at scale, or to make decisions about people, often will. The ICO publishes guidance and a screening checklist.
Should we ban staff from using AI?
A ban rarely works; it usually drives use out of sight. Approve a business-grade tool, set clear rules about what data may go into it, and name an owner.