Yes absolutely. In 2026, most UK companies utilising AI should recognise the importance of AI governance not only as a technical matter but as a board-level risk with legal and commercial implications. The UK presently does not have an AI-specific statutory regime comparable to the EU AI Act, but AI usage is regulated through existing law, and the practical risk for UK businesses is not whether or not the company uses AI but how, for what purpose, what data it processes, whether human oversight is employed, and whether the business can identify and mitigate risks.
This article may be of interest to Startups, SMEs and Growing Companies, Digital and High-Growth Companies, Investors, and Law Firms and Modern Practices implementing AI tools.
Key Takeaways
AI governance for UK businesses has become a practical compliance issue regardless of a lack of one overarching UK AI Act.
Directors should understand what AI tools their companies implement, what data is being processed and where the human oversight is required.
AI can present risks in data protection, recruitment and HR, contracts, copyright, cybersecurity and confidentiality.
There could also be UK-EU AI Act interaction, exposing UK businesses to the obligations where AI systems or AI outputs are used in the EU.
Internal AI governance, vendor diligence, staff training, and contract review are becoming necessary steps to take.
Businesses should not rely on AI vendors alone; AI deployment is usually associated with liability remaining with the business itself.
What Directors and Founders Often Get Wrong
Founders and directors can misunderstand AI risk insofar as it concerns using AI systems and tools exclusively as a technical matter and not as a legal and commercial one.
That is not quite correct.
An AI tool can be deployed anywhere throughout a business process, from customer service to recruiting and hiring, from marketing to internal management information. Each use case presents unique challenges.
Take, for example, an AI-driven customer service chatbot – there might be various legal concerns there, including data privacy, consumer, or contractual issues. Another example is an AI recruitment tool, which may raise data privacy, recruitment, employment and discrimination concerns. A generative AI tool used to create marketing text may also raise copyright and confidentiality issues.
Currently, the UK’s approach to AI governance is largely principle-based and sectoral. The UK Government states that its approach is “pro-innovation”, but that should not be taken to mean that AI is unregulated or low risk. On the contrary, regulators are applying existing legal frameworks to AI systems and tools.
For many businesses, this is not simply a technology question. It is a governance and risk issue that should be reviewed alongside wider corporate structuring, governance and commercial planning, particularly where AI affects contracts, compliance, operations or growth strategy.
Data Privacy and Automated Decision-Making under the UK GDPR
One of the first issues businesses should consider when using AI is data protection.
Depending on the nature of the AI tool, UK GDPR and the Data Protection Act 2018 may apply. Personal data may include customer and client information, employee records, candidate data, behavioural and usage information, call transcripts, financial information and any other information relating to an identifiable individual.
As explained by the ICO, when using AI, organisations must take into account core data protection principles such as fairness, transparency, accuracy, security and accountability.
With the introduction of the Data (Use and Access) Act 2025, UK law has also changed the framework for automated decision-making. The Act aims to support innovation by creating a more permissive framework for solely automated decisions with legal or similarly significant effects, but organisations must still provide appropriate safeguards. These include informing individuals, giving them the opportunity to make representations, allowing them to challenge decisions, and providing human intervention where required.
In practice, businesses using AI tools that process personal data should ask:
Is personal data being processed by an AI tool?
What is the lawful basis for processing that data?
Are individuals being informed about the use of AI?
Does the AI tool make decisions, or does it only support human decision-making?
Is meaningful human review available where required?
Are data transfers and retention periods understood and controlled?
If a business cannot answer these questions clearly, the deployment of AI in that process may be premature.
Recruitment, HR and Discrimination risk
AI is increasingly being used by companies for recruitment, CV screening, productivity monitoring and HR decision-making. These tools may be useful, but they can also create significant risk.
The risk is not limited to data protection. The Equality Act 2010 protects individuals from discrimination connected to protected characteristics. If an AI tool produces a discriminatory outcome, the employer using that tool may face legal, commercial and reputational consequences.
Businesses should consider:
reviewing how the AI tool operates;
checking for bias or unfair outcomes;
ensuring appropriate human oversight (manual review over outcomes);
documenting decision-making;
providing HR and management training;
retaining records explaining why decisions were made.
The important point is that using an external AI tool does not remove the employer’s responsibility for fair and lawful decision-making.
Recent high-profile examples show why this matters. Bolt’s reported decision to remove its traditional HR department and operate with a smaller people operations function attracted attention because it raised a broader question for AI-enabled businesses: if a company reduces or restructures human oversight functions, who remains responsible for employment risk, workplace fairness, complaints, discrimination issues, monitoring and internal escalation? The answer is not solved by changing the team structure. A business may operate more leanly, but the legal and governance responsibilities remain.
Copyright, Content, and IP Concerns in Connection with AI Systems
Generative AI has created considerable uncertainty around copyright, training data, ownership and licensing.
These risks arise whenever businesses use AI tools to produce marketing content, software code, images, designs, reports, product documentation or other commercial materials.
In March 2026, the UK Government published its Report on Copyright and Artificial Intelligence, considering the use of copyright works in the development of AI systems following its consultation on copyright and AI.
Businesses using AI to generate content should consider:
the terms of use of the AI tool;
whether ownership or licensing issues may arise;
whether outputs may reproduce third-party copyright material;
whether confidential information is being entered into the tool;
whether generated content or code can safely be used in commercial services;
whether client contracts restrict or prohibit such use.
This is particularly important for agencies, consultancies, technology businesses, content providers, software developers and professional services firms.
Contracts, Vendors and Customer-Facing AI
Another important risk is contractual liability arising from the deployment of AI tools.
Many businesses integrate AI into customer-facing services or processes but do not update their contracts to reflect that change.
If a customer relies on an AI-generated recommendation, automated response, chatbot answer or predictive output, the business should understand who is responsible if that output is incorrect.
Contracts may therefore need to address:
whether AI is used in the process;
whether the customer must be informed;
who is responsible for errors or incorrect outputs;
whether AI outputs are reviewed by a human;
data security and confidentiality;
liability limitations;
service levels;
audit rights;
vendor obligations if the AI tool changes.
Where businesses use AI in client-facing services, their supplier, client and platform agreements should be reviewed carefully so that responsibility, human oversight, data use and liability are clearly addressed.
EU AI Act and UK Companies
UK businesses should not assume that the EU AI Act is irrelevant simply because they are based in the UK.
Under EU Regulation 2024/1689, the EU Artificial Intelligence Act, providers and deployers outside the EU may be subject to obligations under the Act where AI systems are placed on the EU market or where outputs produced by an AI system are intended to be used in the EU.
A UK business providing AI-enabled products to EU customers, delivering AI-based services to EU clients, supporting EU operations or generating AI outputs for use in the EU may therefore need to consider EU AI Act requirements.
The key point is that cross-border AI obligations should be checked early.
This is especially relevant for clients operating internationally and high-growth digital companies.
Cybersecurity Risks Arising from AI Usage
AI also creates cybersecurity and confidentiality risks.
Employees may use public AI tools and input client data, internal strategy, confidential information, financial information or other commercially sensitive material without appreciating the risk.
AI systems can also introduce vulnerabilities through model manipulation, data leakage, prompt injection, insecure integrations and other technical weaknesses.
To address these concerns, the UK Government has published a voluntary AI Cyber Security Code of Practice, which sets out baseline cybersecurity principles for organisations developing and deploying AI systems.
The National Cyber Security Centre has also warned that cyber risks are expected to increase as organisations try to keep pace with AI-enabled threats.
Businesses should consider:
whether employees are permitted to use public AI tools;
what information must never be entered into an AI platform;
whether there is an approval process for new AI tools;
whether vendors meet appropriate cybersecurity standards;
whether access controls and logging are in place;
how incidents will be handled.
An AI usage policy is now an important safeguard for most businesses.
Finance and Accounting Risks in Connection with Using AI
Businesses are increasingly using AI for finance, forecasting, budgeting, accounting, bookkeeping and reporting.
While AI can help streamline financial operations, businesses should avoid excessive reliance on automated outputs. AI-generated financial analysis may still require human review, source verification and proper audit trails.
Businesses should consider:
whether AI-generated outputs are reviewed before management relies on them;
whether accounting records remain auditable and explainable;
whether VAT, tax and payroll processes are affected by AI;
whether finance teams are properly trained on the limits of the tools they use.
Where AI is used in finance or accounting workflows, businesses should make sure their reporting, tax and VAT processes remain accurate, explainable and supported by proper human review.
Director and Corporate Governance Concerns Relating to AI
AI deployment should not be viewed as an exclusively operational matter. Directors and senior management should understand where AI is being used, what risks it creates and what controls the company has in place.
Under the Companies Act 2006, directors owe various duties to the company, including duties relating to the success of the company and the exercise of reasonable care, skill and diligence.
AI governance should therefore be treated as part of wider corporate governance and risk management.
Practical steps may include:
maintaining an AI register listing the tools used by the business;
introducing an approval process for new AI tools;
carrying out risk assessments for higher-risk use cases;
providing staff training;
conducting vendor due diligence;
reviewing contracts;
checking data protection issues;
putting escalation procedures in place for AI-related incidents.
For board processes, internal records and governance administration, businesses should make sure AI oversight is properly documented as part of their wider company administration and governance records.
Before Moving Forward, Check…
Before introducing or expanding AI tools, businesses should check:
what AI tools are currently used across the business;
whether employees use unauthorised or public AI tools;
whether personal, confidential or commercially sensitive data is processed through AI;
whether the AI tool makes decisions or only supports decisions;
whether human oversight is in place where decisions affect individuals;
whether the tool may create bias, discrimination or unfair outcomes;
whether vendor and client contracts have been updated;
whether AI outputs are reviewed before commercial use;
whether there is a written AI usage policy;
whether the board or senior management has reviewed the key risks;
whether the business has EU or wider international exposure;
whether finance, reporting or operational controls are affected.
Common Mistakes Businesses Make
Considering AI as exclusively an IT matter
AI usually affects legal, commercial, employment, data protection, governance and reputational risk. It should not be left to the technology team alone.
Relying completely on the vendor
While the vendor may supply the AI tool, the business deploying it may remain responsible for how it is used, what data is processed and how outputs affect customers, employees or clients.
Deploying AI without updating contracts
If AI is now part of service delivery, customer support, reporting or decision-making, contracts may need to reflect that operational change.
Allowing employees to use AI without restrictions
Entering confidential or commercially sensitive data into a public AI tool can create serious risk.
Neglecting employment and discrimination risks
Recruitment, HR and monitoring tools can create legal exposure if they produce unfair or discriminatory outcomes.
Thinking of all AI-generated outputs as reliable
AI outputs can be inaccurate, incomplete or misleading. Human review remains important, especially where others may rely on the result.
Ignoring investors’ due diligence concerns
For [Investors], AI governance can become part of commercial due diligence. Strong AI governance may become a point of credibility, not merely a compliance exercise.
Frequently Asked Questions (FAQs)
Is there a UK AI Act?
No. Unlike the EU, the UK currently takes a sector-led approach to AI regulation, relying on existing legislation and regulators rather than one single AI Act. Businesses must still comply with applicable laws, including data protection, equality, intellectual property, consumer and contract law.
Is the EU AI Act applicable to UK companies?
Yes, in some cases. A UK company may fall within scope of the EU AI Act if it places an AI system on the EU market or generates AI outputs intended for use in the EU.
Can using AI create employment risks?
Yes. Recruitment, monitoring and HR AI tools can create data protection, fairness, employment and discrimination risks.
Is there a need for an AI policy?
In many cases, yes. An AI policy can help staff understand which tools may be used, what data must not be entered, when approval is required and how AI outputs should be reviewed.
Who can be held responsible for incorrect AI-generated output?
Responsibility will depend on the facts, contracts, regulatory position and how the AI tool was used. Businesses should not assume that responsibility will sit solely with the vendor.
Can employees use ChatGPT or other public AI tools at work?
Only where the business has clear rules dealing with confidentiality, data protection, cybersecurity and approval processes.
Should startups be concerned about AI governance?
Yes. Startups often adopt AI quickly to improve speed and reduce costs, but early-stage governance can help reduce risk and improve credibility with customers, partners and investors.
When Do I Need Help?
Businesses should seek support before implementing AI in higher-risk areas, including recruitment, employee monitoring, customer-facing AI systems, regulated services, financial decision-making, sensitive data processing and client deliverables.
How We Can Help
At Sterling Legal Solutions, we assist Startups, SMEs and Growing Companies, Digital and High-Growth Companies, Investors, International Clients and Law Firms and Modern Practices with legal, corporate, commercial and business advisory support.
This may include Corporate Legal Advisory in connection with governance and risk structures, Corporate and Commercial Contracts where supplier, client or platform contracts need to reflect AI use, Corporate Services for internal governance and company record-keeping, and Accounting, Tax and VAT Services where AI affects accounting, reporting or compliance functions.
Where specialist data protection, employment, intellectual property, cybersecurity or regulatory advice is required, we can assist in assessing the position and coordinating with appropriate specialists.
Our aim is not to stop businesses from using AI. It is to help them use it in a way that is structured, defensible and commercially sensible.
Disclaimer
This article is provided for informational purposes only and does not constitute legal, regulatory, employment, data protection, tax, cybersecurity or intellectual property advice. AI governance requirements will differ depending on the AI tool used, the data processed, the business sector, customer base, jurisdictions involved and contractual arrangements. Specific advice should be sought before adopting any particular AI governance strategy.