The Governance Gap: the state of AI governance in UK organisations

Governance has not moved at the speed of adoption. Around a quarter of UK directors are concerned their organisation has no AI policy, strategy or data-governance framework — even as 62.5% use AI personally and 49.4% say their organisation uses it (IoD Policy Voice, March 2025). Board knowledge is improving but low: 66% of boards report limited-to-no knowledge or experience of AI, down from 79%, while 31% say AI is still not on the board agenda at all and a third of directors are dissatisfied with the time their board gives it (Deloitte, Governance of AI, global).

Ownership is the sharpest gap. Only 17% of organisations say the board owns AI-governance oversight, with 28% placing it with the chief executive (McKinsey, State of AI 2025, global); and while 93% of organisations use AI, just 7% have fully embedded AI governance (Trustmarque, 2025, vendor research). Formal assurance is rarer still: around 350 organisations worldwide held an ISO/IEC 42001 certificate by spring 2026, two years after the standard was published (Atoro), and BSI became the first UKAS-accredited certifier only in November 2025 (BSI, Nov 2025). There is movement — board-level AI-risk oversight at Fortune 100 firms tripled from 16% to 48% across 2025 (EY Center for Board Matters, global) — but from a very low base.

The consequences are already visible in the record. Documented AI incidents rose to 233 in 2024, up 56% year on year (Stanford HAI, 2025 AI Index, global), and again to 362 in 2025, a further 55% increase (Stanford HAI, 2026 AI Index, global). As deployment widens, the count of things going publicly wrong widens with it.

Beneath the reported incidents runs a quieter risk: shadow AI, the use of AI tools outside any policy or oversight. Vendor research suggests 77% of employees paste data into generative-AI prompts, and 82% of that activity happens through personal accounts beyond the organisation’s controls (eSecurity Planet / LayerX, vendor research); separate analysis found around 11% of the content pasted into ChatGPT is confidential (Cyberhaven, vendor research). These figures come from security vendors and should be read as indicative rather than definitive — but the direction is consistent, and it points at data leaving governed systems every day.

Put the two halves of this report side by side and the gap is stark. On the adoption side: 44% of large UK businesses using AI, 95% of councils, 76% of charities and teachers, 75% of financial-services firms. On the oversight side: 17% of organisations where the board owns AI, 7% with fully embedded governance, and roughly 350 ISO 42001 certificates in the entire world. Organisations have adopted AI far faster than they have learned to govern it.

That distance — between deployment speed and the accountability, policy, risk management and assurance needed to deploy safely — is the governance gap. It is not an argument against AI. It is the work that turns AI from an exposure your board cannot answer for into a capability it can. The organisations that close it first will be the ones still standing when a regulator, an ombudsman or an incident asks them to show their working.