Deploying AI? What UK organisations should have in place
Most organisations are not building AI. They are buying it, switching it on inside tools they already own, or discovering their people are already using it. Regulators, insurers and courts are now asking those organisations the same question: can you show your working?
When people talk about AI regulation, they tend to picture the companies building the models. In practice, most of my clients sit on the other side of the table. They deploy AI: a contract review tool, Copilot across Microsoft 365, a screening tool in HR, an agent wired into the practice management system. The expectations on deployers are firming up quickly.
The signals are coming from several directions at once. The ICO is asking how organisations govern automated decisions and AI agents. The FCA and the Bank of England expect firms to evidence how they test and monitor the models they rely on. The EU AI Act places specific duties on deployers of high-risk systems, and individual member states are adding rules of their own. Insurers are revisiting cyber wordings and asking about AI at renewal.
Different bodies, one test. Not whether you have a policy, but whether you can produce the evidence that it works.
Below is the list I work through with clients. Not every item applies to every organisation, but if you deploy AI in the UK (and especially if you have EU clients, staff or operations), these are the things you should expect to be asked for.
Know what you have
An AI inventory, with risk tiering
Cover the AI you have bought, the AI you have built, and the AI that arrived embedded in software you already use. Include agents, and the “shadow” tools staff have adopted on their own. Then tier each entry by risk. Two flags matter most:
- anything that would count as high-risk under Annex III of the EU AI Act if it were used in the EU, such as recruitment, creditworthiness, insurance pricing or access to essential services
- anything in the UK that makes solely automated decisions with legal or similarly significant effects on people
For agents, go further. Record which systems, data and external services each agent can reach, what it is allowed to do without a human approving it, and the risk assessment carried out before it was switched on. These are the questions the ICO has started asking of AI developers, and it is now asking them of the organisations that deploy their tools.
A named senior owner
Someone at board level (or a Senior Management Function holder, in regulated financial services) who owns AI risk. Give it a standing agenda item, and make sure the minutes show challenge, not just briefing. A regulator reading your board minutes is looking for evidence that someone asked difficult questions.
Set the rules for use
An acceptable use policy and a literacy programme
A clear policy on what staff may and may not do with AI, backed by training, with records, and with contractors included. For EU exposure this supports the AI literacy expectation in Article 4 of the AI Act. It is also, increasingly, what insurers ask to see.
Documented human oversight
For automated decision-making under Articles 22A to 22D of UK GDPR, write down for each type of decision who reviews the outcome, what authority they have to change it, and how you evidence that the review actually happens.
European data protection regulators have made the test explicit: if the human decision is in practice determined by the automated result, it is not meaningful oversight. A reviewer who approves every recommendation the system makes will struggle to show otherwise.
Impact assessments
A DPIA for any AI use involving personal data, structured so that a Fundamental Rights Impact Assessment (FRIA) can be layered on top where the EU AI Act requires one: public bodies, providers of public services, and credit and insurance use cases.
Keep the evidence
Logs, testing and change records
For higher-risk systems, keep inputs, outputs and human overrides for at least six months, which is the EU AI Act minimum for deployers of high-risk systems. Record model versions and changes, test before and after deployment, and keep a log of incidents and near misses.
The Bank of England has signalled that this kind of evidence should underpin standards for deploying AI. It is also the first thing an auditor or a claims handler will ask for.
Vendor due diligence and contract terms
Most of your AI risk sits inside someone else’s product. Your contracts should cover the provider’s instructions for use, audit rights, incident notification, exit, and assurances about training data. In financial services, add the requirements of DORA and the PRA’s outsourcing expectations in SS2/21.
Transparency artefacts
Tell people when they are dealing with a chatbot. Label synthetic and deepfake content. Notify workers where AI is used in managing them. In the public sector, publish Algorithmic Transparency Recording Standard (ATRS) records.
Be ready when something goes wrong
An incident process that knows about AI
One AI failure can start several clocks at once: a personal data breach under UK GDPR, reporting under NIS or the Cyber Resilience Act, DORA for financial entities, the FCA’s Consumer Duty, and your insurers’ notification conditions. Map them before the incident, not during it.
An insurance map
For each policy, know:
- which cyber clause variant applies
- whether an AI exclusion, sublimit or affirmative endorsement has appeared at renewal
- whether any affirmative cover extends to your own use of AI, or only to attackers using AI against you
- what your broker’s questionnaire asks for, and whether you can answer it with evidence
Some insurers now offer cover for an organisation’s own AI failing, including system shutdown and regulatory defence, but terms vary and wordings are not always published. Whether regulatory fines are insurable at all depends on the jurisdiction.
A country view if you operate in the EU
National rules are diverging ahead of the AI Act’s own deadlines. Italy has made AI logs, technical documentation and oversight records disclosable in litigation and brought AI within corporate criminal liability, and is restricting solely automated decisions in hiring, dismissal and performance management. Poland’s AI authority is gaining fining powers. Spain’s data protection regulator has shown it will step in before an AI hiring tool goes live, not after.
If you have staff or clients in a member state, check its position rather than assuming the AI Act timetable is the one that applies.
Hold it all together
A management system
ISO/IEC 42001 gives you a container for everything above: scope, roles, a risk methodology, controls, internal audit and management review. Certification is available through UKAS-accredited bodies.
I would position it internally as governance discipline rather than legal compliance. A 42001 certificate does not, on its own, demonstrate compliance with the EU AI Act or UK GDPR. What it does do, is make the evidence mentioned above routine, rather than a mad scramble when someone asks for it.
Where to start
If the list above feels daunting, start with these three things, the rest will follow naturally.
Tells you what you are dealing with.
Makes someone accountable for it.
Tells you where you are already exposed.
My Preparing for an AIMS series works through ISO/IEC 42001 clause by clause, starting with the inventory and organisational context. The next article here looks at tooling: what you need to evidence all of this, and how much of it you may already own.
If you would like an impartial view on where your organisation currently stands, get in touch.
This article is general information, not legal advice.
