Members answer for every automated decision a council makes about a resident.

The UK AI Disclosure Audit 2026

What council annual governance statements actually say about AI

Twelve of the 30 English councils we read, in annual governance statements and annual reports with a period end on or after 31 December 2024 and read on 4 September 2026, mention artificial intelligence at all. That is the lowest rate of the five sectors we studied: education 29 of 29, NHS trusts 20 of 28, charities 20 of 30, housing associations 17 of 30. Read it with care. Blind double coding covered four councils and the two coders disagreed on three of them, in the same direction, with the second coder finding AI mentions the first did not, so the council figures are the least reliable of the five sectors.

• Two of those 30 councils set out a standalone AI risk with a stated mitigation, and 2 of 30 mention AI only inside another risk such as cyber or information governance.
• One of 30 names a director or member as owning AI, and 2 more name a committee whose remit covers it. Four of 30 refer to an AI or acceptable use policy.
• Six of 30 tie data protection language, such as a DPIA or UK GDPR, to their use of AI, the highest of the five sectors: housing associations 2 of 30, NHS trusts 1 of 28, universities 1 of 29, charities nil of 30.
• Six of 30 describe a named AI system or a specific use case.
• One of 30 had an AI item on a public board or committee agenda in the period; public minutes were found for all 30, so no council is recorded as not applicable here. Across the whole study that indicator is 10 of 147, or 10 of 73 where minutes were found, and it is the study's weakest, because board papers are not fully searchable within our fetch budget, so treat it as unverified.
• East Sussex County Council is one of the study's two exemplars, on a published rule: top five by total score in its sector, and a named board-level owner of AI in its documents. It is named only as good practice.

The Algorithmic Transparency Recording Standard already asks central government and encourages councils to publish what their algorithmic tools do. The annual governance statement is where a council explains whether its control framework is fit for purpose. If AI is in casework or triage, both documents should show it. Where we say something is not there, we mean it was not found in the documents we read.

• For each AI tool affecting residents, can we show how the Public Sector Equality Duty was discharged, with documented due regard and a check for bias against protected groups, and is it recorded in ATRS form?
• Where AI informs benefits, social care or casework, is there genuinely meaningful human involvement, and can a resident be told a decision was made, make representations and contest it as the Data (Use and Access) Act 2025 requires?
• Which AI tools are procured from suppliers, and can we inspect, explain and stand behind their decisions in court, or have we outsourced accountability we cannot recover?
• Have we completed DPIAs for tools using sensitive social care, safeguarding and special category data, and is any of that data leaving our control into third-party or generative AI systems?
• Who at member level owns AI risk, and do our scrutiny and audit committees have the literacy and assurance to challenge these systems rather than relying on officers and suppliers?
• If an automated tool made a wrong or discriminatory decision about a vulnerable resident tomorrow, how would we detect it, who would be accountable, and how would we defend it to the public, the EHRC and a court?

Taking these to a meeting? Print the one-page board pack.