Where to start with AI governance when it lands on your desk
A practical first move for the person who has just been asked whether the organisation is on top of its AI, before anyone spends money.
Someone forwarded an article, or a client sent a due-diligence questionnaire, or a board member asked it out loud in a meeting: are we on top of our AI? If you are the person who now has to answer, the job feels bigger than it is. Here is where to start.
Find out what actually reaches you
Most of the worry about AI rules is worry about the wrong rules. The EU AI Act is the one people name, but whether it binds a UK organisation depends on where its AI activity reaches. Being based in the UK does not settle it. Parts of the Act are already in force, and the heaviest obligations are still a couple of years out.
So the first answer you need is narrow: does it apply to us, and if it does, what applies now. The EU AI Act check works that out for your systems, and the overview explains the timeline after the July 2026 omnibus, which a lot of older material still gets wrong. Everything else can wait on that answer.
Write down what you already run
Governance starts with a list. Before you can decide anything, you need to know which AI tools are in use across the organisation, including the ones nobody signed off. That second set, the tools people reached for because they were faster than waiting, is usually where the real exposure sits. There is a separate note on handling shadow AI once you have found it.
Put the decisions somewhere they hold
Once you know what applies and what you run, the decisions need a home: who may use which tools, what data must never go into them, who signs off on new ones. Written down, those become a policy people can actually follow. The AI policy generator drafts one from your answers, tailored to your sector and the tools you named.
See where you stand against a standard
If a customer or your own board wants assurance rather than a promise, ISO 42001 is the management-system standard for AI. The readiness check shows how far off you are and which gaps to close first, without pretending certification is a weekend job.
Where this stops
When you reach a point that needs a legal conclusion, take what you have found to your own adviser. The value of doing this first is that you arrive at that conversation knowing what applies and what you run, instead of paying someone to tell you where to look.