Artificial intelligence is now part of everyday work across many UK companies. Office for National Statistics research published in July 2026 put usage at around 35 per cent. The figure covers businesses with at least 10 employees using one AI technology. It stood at around 12 per cent during late 2023.
Large language models were the most common technology recorded in June 2026. Around 18 per cent of businesses reported using them at work. The figures show why company rules now need to catch up quickly.
A useful starting point for responsible AI is a complete internal system register. Your register should show every tool currently approved across the company. It should also identify each tool’s purpose and name the internal owner.
The Department for Science, Innovation and Technology recommends maintaining an AI system record. Its AI Management Essentials guidance was updated during February 2026.
Businesses can include these practical details in the record:
- supplier and product name;
- department using the system;
- information entered into the service;
- people affected by its output;
- approval date and next review date;
- known limits and previous incidents.
This record gives managers a clear view of actual internal use. It can also expose unofficial tools before sensitive information reaches them.
Clear AI governance needs named responsibility rather than broad ownership by technology teams. The ICO advises organisations to assign operational roles for systems processing personal information. Senior management should also understand the risks linked with higher-impact systems.
Your company can classify systems according to possible harm or business impact. Meeting summaries need less scrutiny than recruitment screening or customer credit decisions. A three-level process can keep the review proportionate for each use case.
Low-risk tools can receive basic approval after security checks are completed. Medium-risk systems need documented testing before wider staff access begins. High-risk systems should receive specialist review before operational deployment begins.
Practical AI risk management should test failures before real customers encounter them. Your team should examine inaccurate outputs and possible bias during testing. Security weaknesses and personal-data exposure also need separate testing before launch.
Use difficult examples during testing rather than carefully selected successful cases. Teams should record failure rates against agreed measures before approving wider deployment. Testing evidence also gives managers something concrete to review later.
Data protection needs attention before employees upload information into external services. ICO guidance updated in February 2026 says privacy starts during system design. It should continue throughout the processing lifecycle after deployment.
Staff need simple rules covering information that cannot enter external tools. Customer records may need restrictions under your existing privacy controls. Employee files and confidential contracts can require tighter access rules.
Supplier checks should answer these questions before signing contracts:
- Where will company information be stored?
- Can prompts train the supplier’s underlying models?
- How long will submitted information remain stored?
- Which subcontractors can access submitted company information?
- How can your organisation delete stored information?
- What happens after a supplier security incident?
Business AI products can depend on several outside providers behind one interface. Your procurement team should understand those relationships before approving regular use.
Human oversight also needs a defined process with named reviewers. Government guidance says people should retain responsibility for decisions supported by automated systems.
Reviewers need authority to challenge recommendations before they affect customers or employees. Higher-impact decisions need clear instructions about when people must intervene.
Your reviewer should know which evidence requires checking before approval. Staff should also record overrides when they reject automated recommendations.
Those records can reveal recurring problems during later performance reviews. Repeated overrides may point towards weak data or poor system performance.
Training should focus on situations employees encounter during normal working days. Finance teams need different guidance from marketing staff using writing assistants. Your training should cover approved tools and restricted company information.
Employees also need a simple route for reporting incorrect outputs. Managers should know who receives reports involving privacy or security incidents.
AI adoption should include regular checks after a system reaches employees. The ONS found only 10 per cent of adopting businesses used AI extensively. The June 2026 finding covered businesses employing at least 10 people.
Companies can track errors and complaints through existing reporting processes. Human overrides should also form part of routine performance reviews. Clear thresholds can tell managers when access needs temporary suspension.
External AI consulting can support companies without specialist knowledge in technical testing. It can also help procurement teams question complicated supplier claims. Final ownership should still remain with named leaders inside the business.
The practical aim is keeping useful technology within clear company boundaries. A system register gives businesses a sensible place to begin. Risk checks and privacy rules can then support safer daily use.
Human review adds another safeguard when automated outputs affect important decisions. Regular monitoring then gives leaders evidence for deciding where wider use makes sense.
