All services Every engagement has a fixed, published price. Book a strategy call
AI governance, explained for boards rather than technologists: what it is, why it cannot be delegated, and the seven questions that reveal within one meeting whether your organisation has control of its AI.
Ask ten executives what AI governance is and you will get ten answers, most of them involving the word ethics and none of them usable in a board meeting. Meanwhile the questions keep arriving: from regulators phasing in the EU AI Act, from enterprise customers sending AI questionnaires, from insurers asking what is in production, and from auditors who have noticed that decisions once made by staff are now being made by software.
This guide gives boards a working definition and, more usefully, the seven questions that reveal within one meeting whether an organisation has its AI under control. It is written by a UK practice that builds and assesses AI governance for a living, so it favours evidence over principles and names the answers that should worry you.
The short answer. AI governance is the system of decisions, controls and evidence that lets an organisation say what AI it runs, who approved it, what each system is allowed to do, and how it would know if something went wrong. If those four statements cannot be evidenced, the organisation does not govern its AI. It merely uses it.
AI governance is the operating capability that keeps artificial intelligence under management control. In practice it stands on four working parts.
First, a live inventory: a maintained record of every AI system in use, including models your teams built, AI features switched on inside vendor products, and the unapproved tools staff quietly rely on, usually called shadow AI. Second, risk tiering: each use classified by the harm it could do and, for anyone serving EU customers, mapped against the EU AI Act categories from prohibited to minimal risk. Third, an approval path: a named route by which new AI uses are proposed, examined and approved or refused, before they reach production rather than after. Fourth, monitoring and evidence: someone watching how systems behave, a rehearsed route for incidents, and a record a regulator, customer or insurer could read.
A board does not need to understand transformer architectures to govern AI, just as it never needed to understand double entry bookkeeping to govern money. It needs to know the four parts exist, work, and produce evidence.
It is not an ethics statement. Principles about fairness and transparency are easy to publish and impossible to audit on their own. It is not a policy PDF: a policy without an inventory is a promise without a memory, because nobody can say what the policy applies to. It is not a one-off review that ages the moment a team switches on a new AI feature inside software you already own. And it is not an IT matter, because the risks land on the whole business: a discriminatory hiring model is a legal and reputational problem, a hallucinated answer to a customer is a commercial one, and confidential data pasted into a public chatbot is a security incident regardless of which department did it.
Three reasons, in ascending order of discomfort.
First, accountability does not delegate. Directors remain responsible for the decisions their organisation makes, and AI systems now make some of those decisions autonomously and at scale. Software that acts is a business actor, and boards govern business actors.
Second, the law has started arriving. The EU AI Act entered into force in August 2024. Its bans on certain practices have applied since February 2025, obligations for general purpose AI models since August 2025, and most duties for high risk systems phase in through 2026 and 2027. Penalties for prohibited practices reach 35 million euros or 7 per cent of worldwide turnover, whichever is higher, and the Act applies to UK organisations whose systems serve EU customers. The UK has no single AI statute, but existing regulators, data protection law and directors&rsquo. Duties already reach AI behaviour.
Third, the market asks before regulators do. Enterprise customers now send AI questionnaires alongside security ones, insurers ask what is in production before renewing cover, and acquirers ask in due diligence. The organisations that answer with evidence win the work. The ones that answer with a policy PDF are remembered for it.
Each question comes with what a strong answer looks like and what a weak one sounds like. One meeting, seven questions, and you will know where you stand.
Everything else depends on this. If the organisation cannot list its AI, every other assurance is a guess. The list must include built systems, bought systems and the AI features embedded in existing software, plus a view of shadow AI.
The Act tiers systems by use rather than by technology. Recruitment screening, credit decisions, safety functions and similar uses carry the heaviest duties: risk management, data quality, human oversight, logging and documentation.
Governance is proved by refusals. A gate that has never turned anything away, or asked for conditions, is decoration.
The question that separates governance from theatre. Policies state intent. Evidence proves behaviour.
Models drift, data changes and vendors push updates. The failure mode is silent degradation discovered by a customer, a journalist or a regulator.
Staff use public assistants because they work. Contracts, client data and source code end up in prompts wherever there is no approved alternative.
Committees advise. Owners answer. Somewhere a single senior person should feel this risk in their objectives and their budget.
Boards do not need a framework diagram. They need to know these five parts exist and can be inspected.
| Part | What it does | First sign it is missing |
|---|---|---|
| Live inventory | Records every AI use: built, bought and embedded, including shadow AI. | The list has to be assembled whenever someone asks for it. |
| Risk tiering | Classifies each use by potential harm and EU AI Act category. | Every system is treated with the same level of care. |
| Approval path | Examines new uses before production, with authority to refuse. | Nobody can name the last use case that was turned away. |
| Monitoring and incident route | Watches behaviour, defines thresholds, rehearses failure. | Problems are discovered by customers rather than dashboards. |
| Evidence pack | Proves all of the above to regulators, customers and insurers. | The only artefact anyone can produce is the policy. |
The EU AI Act is law: it tells you what your obligations are, by risk tier and by date. The practical work it demands starts with an inventory and classification, which is why our EU AI Act readiness checklist and guide to mapping AI systems both begin there. ISO/IEC 42001 is a certifiable management system standard: the way to prove to customers and regulators that your governance runs as a system rather than a collection of good intentions, and how it interlocks with the Act is covered in our EU AI Act and ISO 42001 guide.
The order matters: governance first, certification second. An ISO 42001 implementation built on a missing inventory certifies the theatre rather than the control.
A board can set this in motion with three moves, none of which requires a transformation programme.
First, ask question one and set a date. The request for a complete AI inventory, with owners and approval status, forces the first control into existence. If you want a verified picture of the wider position first, the free AI governance readiness scorecard rates all fourteen areas of AI governance in about five minutes.
Second, commission a short, bounded assessment. Our AI Governance QuickScan takes two weeks and finds every AI use including shadow AI, tiers each one against the EU AI Act, and returns a plan the board can read, from £15,000 + VAT. If your exposure is primarily regulatory, the EU AI Act Readiness Assessment from £18,000 + VAT maps every system to its obligations and deadlines.
Third, name the owner. Then decide how the capability runs: built in house, stood up for you as a working AI Governance Office from £30,000 + VAT, or retained month by month through AI Risk-as-a-Service from £8,000 a month.
And if you already hold the inventory, the tiering and a refusal on record, you do not need us. That is what good looks like.
AI governance is how an organisation knows what AI it runs, who approved it, what each system is allowed to do, and how it would find out if something went wrong, with evidence behind each of those statements rather than a policy alone.
There is no single UK AI statute, but the obligations are real: the EU AI Act applies to UK organisations whose AI serves EU customers, UK data protection law governs AI that processes personal data, sector regulators apply existing rules to AI behaviour, and directors&rsquo. Duties cover decisions made by systems the company chose to run.
AI governance is the working capability: inventory, risk tiering, approvals, monitoring and evidence. ISO/IEC 42001 is the international standard for managing it as a certifiable system. You can govern AI without the certificate. You cannot honestly hold the certificate without the governance.
At Intelance the prices are published: a two week AI Governance QuickScan from £15,000 + VAT, a working AI Governance Office stood up from £30,000 + VAT, ongoing AI Risk-as-a-Service from £8,000 a month, and an EU AI Act Readiness Assessment from £18,000 + VAT. ISO/IEC 42001 implementation is a fixed fee scoped to your organisation.
Ask for the AI inventory with owners and approval status, and set a date for it. If the answer takes longer than a fortnight or arrives incomplete, commission a two week assessment and appoint a single senior owner for AI risk. Everything else builds from there.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance