What is a board actually accountable for on AI?
Everything the organisation's AI does, whether or not the board understands it. Directors' existing duties of care, skill and oversight extend to AI without amendment. Accountability does not transfer to the vendor or the model: it lands on the organisation that points AI at a real decision, which means it lands on the board.
This is sharper than it sounds, because most boards now answer for capability they bought rather than built. Nobody in the company trained the model, can read its weights, or can say precisely why it produced one sentence rather than another. Yet the moment the tool acts under the company's name, the board owns the outcome, and "the model decided" is not a defence any regulator will accept. We set out that position in full in Governing the Intelligence Age.
Is there a UK law on AI that boards must comply with?
No single one. The UK has no AI Act and no dedicated AI regulator. Five voluntary principles are applied by the regulators you already answer to, on top of binding law that reaches AI without naming it: UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
The five principles, confirmed in the government response of February 2024, are safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. They are deliberately abstract. They tell a board the outcomes a regulator will look for, not the controls that get there, and the space between the principle and the control is exactly the space the board must fill. Underneath the principles sits law that binds today: the ICO is lead regulator wherever AI touches personal data, and the Data (Use and Access) Act 2025 reformed the rules on significant automated decisions from February 2026. The full picture is in our guide to what UK boards govern instead of an AI Act, and every instrument is listed, dated and sourced in the UK AI Regulation Tracker.
Which framework should a board govern AI against?
ISO/IEC 42001 for the management system, with the NIST AI Risk Management Framework for risk structure. Neither is law. In the absence of a UK statute they are the most concrete, auditable evidence a board can produce that its AI is governed, and they map cleanly onto the five UK principles.
ISO/IEC 42001 produces exactly the artefacts a regulator, a procurement team or an auditor asks for: policies, named roles, risk registers, impact assessments and continual-improvement evidence. NIST's Govern, Map, Measure, Manage structure sits comfortably inside it and gives the board a defensible way to articulate how risk is identified across the AI lifecycle. One point of language matters here: only a UKAS-accredited certification body can certify an organisation to ISO/IEC 42001. A consultancy helps you align and prepare; it cannot issue the certificate. We unpack what the standard concretely asks of a board in ISO/IEC 42001 explained.
What evidence will a regulator or auditor ask to see?
Evidence that operates, not policy that sits. A named accountable owner for each AI system, a completed Data Protection Impact Assessment where personal data is processed, a record of who decided and when, and a risk register that is live, dated and owned rather than reviewed once a year.
The test we put to boards is simple: for each of the five UK principles, name the control that evidences it and the person accountable for it. Accountability means you can prove who decided and when. Transparency means a claim the model makes is checkable against its source. Contestability means a person who disagrees with a decision can have it reviewed and reversed by a human. A risk register updated annually is not evidence of governance; it is a record that governance once happened. We make that argument, and show what a living register looks like, in Make your AI risk register living evidence.
Where should a board start?
With an honest reading of where it stands. Map where AI already operates, including inside supplier systems the board cannot independently test. Name the accountable owner. Confirm which binding regimes apply. Then choose the framework that structures the evidence.
The duties differ by sector: a housing association answers to the Regulator of Social Housing, a financial services firm to the FCA and PRA, a charity's trustees to the Charity Commission. The starting discipline is the same everywhere. The free Board AI Scorecard gives a board that first reading across accountability, policy, risk, data and capability in about two minutes, and the articles below take each duty further.
