Senior-led cybersecurity and IT practice, London Call 020 3886 3001 WhatsApp We respond within one business day

AI Governance and Policy

AI governance that lets your firm adopt AI with confidence

AI governance is the set of policies, roles, approvals and controls that decide how an organisation uses AI, and Rhentech builds and runs it for London firms. It gives the chief executive a defensible answer for clients, insurers and regulators, and gives staff a clear, safe way to use AI to grow the business.

Free initial consultation Book a free consultation
Call020 3886 3001 MessageWhatsApp

30 minutes, free of charge. We respond within one business day.

  • Built for regulated firmsPolicy written for your regulator and sector, not a generic template.
  • ISO/IEC 42001 structuredOrganised to the international AI management system standard, ready for certification if you want it.
  • Senior-ledA senior consultant owns the programme from workshop to board report.

What does an AI governance programme include?

Seven components, delivered as a programme and then run as a managed routine.

  1. 01

    AI use policy

    A written AI use policy your staff can follow: approved tools, what data may and may not go into them, when output must be checked by a person, and how to report a mistake without blame. Drafted for your sector and approved by your board.

  2. 02

    Roles and accountability

    Who owns AI risk, who approves a new tool, and who responds when something goes wrong. Agreed and recorded before an incident forces the question.

  3. 03

    Tool and vendor approval

    A short, repeatable intake for new AI tools and AI features in existing software: security, data handling, retention, training rights, data location and exit terms. Approvals in days, not months.

  4. 04

    AI risk register and impact assessments

    Every AI use case is recorded with its data, its owner, its risk rating and its controls. Higher-risk uses get an impact assessment before they go live.

  5. 05

    Regulatory and standards alignment

    ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, risk assessments and controls an organisation uses to govern AI. We align your programme to it, and to UK GDPR, ICO guidance on AI and data protection, the EU AI Act where your AI reaches EU users, and your sector regulator.

  6. 06

    Staff AI literacy

    Role-based training so people understand what the tools can and cannot do, how to protect client data, and how to check output. Short, practical and recorded as evidence.

  7. 07

    Monitoring and board reporting

    Monitoring of approved and unapproved AI use, with a quarterly report to the board on adoption, incidents, risk and value. Governance becomes a managed routine, not a one-off document.

What you're being asked to demonstrate

The five regulatory threads UK regulated organisations most often need to address. Refreshed quarterly.

  1. EU AI Act (Reg. 2024/1689)

    Current state (May 2026)
    High-risk system rules, Article 50 transparency obligations and Commission enforcement powers for GPAI all enter into force 2 August 2026; prohibitions, AI literacy and GPAI provider rules are already live.
    Upcoming milestone
    2 August 2027: Article 6(1) high-risk classification rules apply in full, and GPAI models placed on the market before 2 August 2025 must achieve full compliance.
    What it means for a UK regulated organisation
    UK organisations placing AI on the EU market, acting as deployers there, or whose AI output is used in the EU need an AI inventory, risk classification, conformity assessments for high-risk use cases, and Article 50 transparency labelling.

  2. UK pro-innovation framework

    Current state (May 2026)
    Principles-based and sector-led: no horizontal AI Act, with five cross-cutting principles delegated to existing regulators and the AI Growth Lab cross-economy sandbox consultation opened 21 October 2025.
    Upcoming milestone
    The King's Speech 2026 confirmed intent to legislate for frontier-model providers but no Bill has yet been introduced; the Regulating for Growth Bill is expected to carry sandboxing powers.
    What it means for a UK regulated organisation
    No single UK "AI law" to comply with, but every existing regulator now has explicit AI expectations, so the compliance map must run regulator-by-regulator across ICO, FCA, PRA, MHRA, SRA, CMA and Ofcom.

  3. ISO/IEC 42001:2023

    Current state (May 2026)
    Voluntary certifiable AI Management System (AIMS) standard, with major certification bodies fully operational and first-wave certifications complete.
    Upcoming milestone
    Continued accelerating adoption through 2026 to 2027 as procurement clauses propagate, with ISO/IEC 42006 (audit requirements) maturing in parallel.
    What it means for a UK regulated organisation
    Not a legal requirement but rapidly becoming a procurement gate; organisations with ISO 27001 already in place can typically certify in 6 to 9 months.

  4. NIST AI RMF (US, voluntary)

    Current state (May 2026)
    The core framework plus Generative AI Profile (NIST AI 600-1) are widely adopted as the reference taxonomy for AI risk, with a Critical Infrastructure Profile concept note released 7 April 2026.
    Upcoming milestone
    Critical Infrastructure Profile and AI Agent Interoperability Profile both expected late 2026.
    What it means for a UK regulated organisation
    Voluntary in the UK but referenced explicitly by the ICO, NCSC and AI Safety Institute as the working risk taxonomy. UK organisations with US enterprise customers are increasingly asked for NIST AI RMF mapping.

  5. Sector overlays (UK)

    Current state (May 2026)
    ICO statutory ADM Code in preparation under DUAA s.80; FCA Mills Review reporting summer 2026; PRA AI supervisory priorities live; MHRA AI-as-Medical-Device framework due 2026; SRA AI policy webinar held February 2026.
    Upcoming milestone
    Treasury Select Committee has asked the FCA for comprehensive AI guidance by end 2026; MHRA National Commission report due summer 2026.
    What it means for a UK regulated organisation
    Sector regulators are moving from "principles" to specific enforcement signals in 2026: legal, finance and healthcare organisations should expect direct supervisory questions on AI governance within current examination cycles.

The regulatory position as of May 2026.

How does an AI governance engagement work?

Three entry points. Most firms start with a briefing or workshop, then build, then run.

  1. Half-day or one-day

    Executive briefing or policy workshop

    Your leadership team agrees its position on AI: where it should create value, what risk it will accept, and the principles the policy will follow.

  2. Milestones agreed in writing

    Governance programme

    We draft the policy, roles, approval process and risk register, align them to the standards that matter to you, and launch them with training.

  3. Monthly retainer

    Monitoring and review

    Ongoing monitoring, vendor approvals, policy updates and quarterly board reporting. It can be combined with managed IT under one relationship.

Book a free consultation

What do leaders ask about AI governance?

Not answered here? Ask it on the call.

What is AI governance?

AI governance is the set of policies, roles, approval processes and controls that decide which AI an organisation uses, for what, with which data, and under whose accountability. Good governance speeds adoption, because staff know what is allowed. It also gives you evidence when a client, insurer or regulator asks how AI is controlled.

Is there a UK AI law we must comply with?

There is no single UK AI Act. AI is regulated through existing law and regulators, including UK GDPR and the ICO, the FCA and the SRA. The FCA published the Mills Review on AI in retail financial services on 6 July 2026, which signals closer attention to AI in supervision.

What changed in the EU AI Act in 2026?

The AI Omnibus, Regulation (EU) 2026/1744 published on 24 July 2026, moved obligations for stand-alone high-risk AI systems to 2 December 2027 and for high-risk AI in regulated products to 2 August 2028. Article 50 transparency duties still applied from 2 August 2026. UK firms whose AI reaches EU users should use the extra time to finish their inventory and classification.

Do we need ISO/IEC 42001 certification?

Not by law. It is increasingly requested in procurement, and building to it makes certification a short step if a client asks. We structure your programme to the standard and you decide whether to certify.

How long before we have a working AI policy?

The executive briefing or policy workshop is a half or full day. A first policy, roles and approval process follow as a programme with milestones agreed in writing at the start. We do not publish a standard timetable, because it depends on how many teams and tools are in scope.

Can AI governance run alongside our managed IT?

Yes. The monthly governance retainer covers monitoring, vendor approvals, policy updates and board reporting, and it can be combined with Rhentech managed IT. Technical controls such as data-loss prevention and conditional access then enforce the policy, not just describe it.

Free consultation

Make AI an advantage your board can defend.

A 30-minute call with a senior consultant about where your firm stands on AI and the fastest route to a working policy. We respond within one business day.

Book a free consultation

Or call 020 3886 3001 or message us on WhatsApp.