By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - the practical platform helping businesses implement and maintain ISO 9001, ISO 14001, ISO 45001 and ISO 27001 through real-world templates, AI-powered tools and expert support. Having spent years implementing and auditing management systems, Russell has seen how quickly technology can move ahead of the controls organisations have put in place to manage it.
There is a good chance that artificial intelligence is already being used somewhere in your business.
Someone may be using ChatGPT to improve an email. A manager might be asking Copilot to summarise a document. Marketing could be generating content with an AI tool, while somebody in finance is experimenting with a spreadsheet assistant. An employee might even be uploading a document and asking an AI system to analyse it without ever thinking of that as an information security decision.
None of this necessarily means the organisation has formally decided to adopt AI.
That is precisely the problem.
One of the most important governance issues businesses are beginning to face is what has become known as "shadow AI": the use of artificial intelligence tools by employees without proper organisational approval, oversight or controls.
It is very similar to the old problem of shadow IT, where employees started using cloud storage, messaging platforms or software applications outside the organisation's approved systems. The difference is that AI can introduce additional questions around information disclosure, accuracy, intellectual property, decision-making and accountability.
For many organisations, the question is therefore no longer whether they should allow AI. It is how they manage something that employees may already be using.
AI adoption is moving faster than AI governance
Recent UK figures illustrate the problem rather well.
The UK Business Data Survey 2026 found that 41% of businesses handling digitised data were using AI for at least one purpose. Adoption was significantly higher among larger organisations, but the technology was already being used across businesses of every size.
More interestingly from a management-system perspective, governance had not kept pace. Among businesses using AI, only 17% reported having either a formal or informal AI policy or guidance, and just 5% had a formal written policy.
That is a considerable gap between adoption and control.
It also reflects what I increasingly see when talking to organisations about information security. AI has often arrived through individual employees rather than a formal technology project. Nobody held a meeting and announced that the business was adopting generative AI. People simply discovered useful tools and started using them.
From an efficiency point of view, that is understandable. These systems can save significant amounts of time.
From a governance point of view, however, it creates an awkward question: how do you manage a technology if you do not actually know how it is being used?
The first risk is often the information being put into the tool
For most businesses, one of the most immediate concerns should be data.
Imagine an employee is preparing a proposal for an important customer. They upload the customer's existing specification into an AI tool and ask it to produce a summary.
Another employee wants help interpreting a contract and copies several clauses into ChatGPT.
Someone in HR asks an AI tool to improve a document containing employee information.
A salesperson uploads meeting notes and asks for a follow-up email.
All of these may appear to be perfectly innocent uses of AI. The difficulty is that information has now left the organisation's normal controlled environment.
What was in the document? Was it confidential? Did it contain personal information? Was the AI service approved? What contractual terms apply to the information submitted? Is the information retained? Could it be used for model training? Where is it processed?
The employee may not know the answers to any of those questions.
That is why banning employees from entering "confidential information" into AI tools can sound much simpler than it is in practice. People first need to understand what information is confidential, which tools are authorised and what types of data are permitted.
This is where information classification, acceptable-use rules and staff awareness suddenly become much more important.
The second problem is trusting the answer
The risk is not confined to what goes into AI. Businesses also need to think about what comes back out.
Generative AI can produce extraordinarily convincing answers that are completely wrong.
That distinction matters because people tend to associate confident language with authority. An answer that is clearly written, detailed and professionally structured can appear trustworthy even where the underlying information is inaccurate.
In consultancy and audit work, I have always placed a lot of emphasis on evidence. If someone tells me a legal requirement applies, I want to know where it came from. If a risk has been assessed in a certain way, I want to understand the reasoning. If a business makes an important decision, there should be some way of demonstrating the information on which that decision was based.
AI does not remove that requirement.
If anything, it makes verification more important.
There is a major difference between using AI to improve the wording of a routine email and allowing it to influence a technical, legal, financial, safety or security decision. The level of human review should reflect the consequence of getting the answer wrong.
That is basic risk-based thinking, and businesses do not need a hugely complicated framework to apply it.
Who is responsible for AI use?
This is another question that many businesses have not yet answered.
IT may think responsibility sits with data protection. Data protection may assume individual departments are responsible. Department managers may assume the software provider has dealt with the risks.
Meanwhile, employees carry on using the tools.
The UK government's new AI Risk Management Toolkit, published in September 2026, makes governance and accountability a central part of managing AI risk. It recommends clear ownership, involvement from senior leadership and continuing reassessment because AI risks and the effectiveness of controls can change over time.
That is a sensible approach regardless of whether an organisation ever chooses to implement a formal AI management system.
Someone needs ownership.
That does not necessarily mean appointing a full-time "Head of AI Governance". In a growing company, responsibility might sit with an existing information security, compliance, IT or senior management role. What matters is that somebody has sufficient authority to decide which tools can be used, establish sensible boundaries and review emerging risks.
Without ownership, AI governance very quickly becomes everybody's responsibility and therefore nobody's responsibility.
Start by finding out what people are actually doing
One mistake I would avoid is writing an AI policy before understanding how AI is currently being used.
Ask people.
You may be surprised by the answers.
Which AI tools are employees currently using? What tasks are they using them for? Are they uploading documents? Are they using personal accounts or business accounts? Are AI features already embedded within Microsoft 365, CRM platforms, design software or other systems? Are teams using AI to make or support decisions?
The UK Business Data Survey found that 21% of businesses using AI already had AI functions integrated into existing business systems. That is another reason why treating AI as simply a list of websites that should or should not be used is becoming increasingly unrealistic.
AI functionality is steadily becoming part of ordinary business software.
The governance question is therefore shifting from "Can staff use AI?" to "Under what circumstances can AI be used, and what controls apply?"
That is a much more sustainable question.
You probably need an AI policy, but don't make it twenty pages long
Once you understand current use, some basic guidance is sensible.
For most businesses, a useful AI policy does not need to be enormous. In fact, if you want employees to follow it, shorter is often better.
It should make clear which tools are approved, what information must not be entered, when outputs need human review, who approves new use cases and where employees should go if they are uncertain.
It should also address responsibility for AI-generated work. If AI drafts something that is subsequently sent to a client, the employee who sends it should not be able to say "the AI wrote it" if it turns out to be wrong.
The organisation remains responsible for its output.
That point may sound obvious, but it is worth establishing early because AI can create a subtle shift in how people think about accountability. The tool may produce the content, but a person or organisation is still choosing to use it.
AI should appear in your risk assessment
If your organisation uses AI in any meaningful way, I would also expect it to begin appearing in risk management.
That does not mean creating a generic risk labelled "AI" and giving it an arbitrary score.
Look at the actual use cases.
An employee using an approved enterprise AI service to rephrase publicly available marketing copy creates a very different risk from a team uploading customer information to an unapproved public tool. Using AI to brainstorm meeting topics is different from using it to recommend whether someone should be hired. Using AI to assist with coding introduces different risks again.
Risk assessment should reflect those differences.
This is where ISO 27001 provides a very useful foundation, because the approach should already be familiar: identify what could go wrong, understand the potential impact and likelihood, consider existing controls, and decide whether additional treatment is required.
If you are reviewing this area, our guide to the ISO 27001 risk assessment template and what it should actually include provides a practical starting point for building that risk thinking into your management system.
What about ISO 42001?
This is also where ISO/IEC 42001 is becoming increasingly interesting.
ISO/IEC 42001 is the international management system standard specifically designed for organisations developing, providing or using artificial intelligence. It applies a familiar management-system approach to areas such as AI risks and opportunities, accountability, transparency and responsible use.
Not every organisation using ChatGPT needs to rush out and become certified to ISO 42001.
That would be an overreaction.
However, organisations making substantial use of AI should at least understand what good AI governance looks like. If AI is becoming embedded in products, customer services, operational decisions or important internal processes, the case for a more structured AI management approach becomes considerably stronger.
This is particularly relevant for organisations that already operate ISO 27001. Information security and AI governance overlap in many places, but they are not identical. ISO 27001 helps protect information. ISO 42001 asks wider questions about how AI itself is developed, deployed, monitored and governed.
For businesses already comfortable with ISO management systems, that makes ISO 42001 a logical framework to understand even if certification is not currently on the agenda.
Don't ignore AI supplied by somebody else
Another potential blind spot is third-party AI.
A business may confidently say it does not develop AI systems while simultaneously relying on suppliers whose products contain significant AI functionality.
That could include recruitment software, customer-service platforms, security products, financial applications, CRM systems, analytics tools or productivity software.
The fact that the AI belongs to the supplier does not automatically remove your governance responsibilities.
What does the system do? What information does it access? What decisions does it influence? What happens to your data? Can AI functionality be turned on or off? Has the supplier explained how it manages relevant risks?
This should increasingly become part of supplier due diligence, particularly where AI is handling sensitive information or influencing consequential decisions.
Again, the level of scrutiny should be proportionate. Nobody needs a forty-question AI assessment for a low-risk piece of software. But significant AI-enabled suppliers should not be adopted without understanding what their technology is doing.
Internal audit should start asking about AI
There is another relatively simple step businesses can take: put AI on the internal audit agenda.
Ask teams which tools they use. Sample how information is being handled. Check whether staff understand the rules. Review whether approved tools are actually the ones being used. Look at important AI-supported processes and see whether suitable human oversight exists.
This is where internal audit can be particularly useful because it often reveals the difference between the policy management thinks exists and what employees actually do.
I've seen that gap many times in other areas of management systems. AI will be no different.
An organisation may have an excellent policy saying only approved systems can be used, but if half the workforce is quietly using personal AI accounts because they are easier or better, the documented control is not effective.
That is exactly the kind of thing an internal audit should find before it becomes a larger problem.
This is not an argument for slowing AI down
None of this means businesses should be frightened of AI.
Quite the opposite.
Used sensibly, these tools can improve productivity, accelerate analysis, remove repetitive work and give employees capabilities that would have been expensive or inaccessible only a few years ago. Recent ONS figures show how quickly adoption is increasing across UK businesses, and that direction is unlikely to reverse.
The danger is allowing adoption to happen without management catching up.
Good governance should make it easier to use AI confidently because employees understand the boundaries. They know which tools are permitted, what information can be used, when an answer needs checking and who to ask when something new arises.
That is far better than either extreme: banning everything or allowing everything.
The biggest AI risk may be not knowing you have one
For many organisations, shadow AI is likely to be their first real AI governance challenge.
Not an enormous machine-learning project. Not autonomous robots. Not some theoretical future technology.
Just employees discovering useful tools faster than company policy can keep up.
The right response is not to panic and it is not to generate a huge AI governance manual.
Find out what is being used. Understand the important risks. Establish ownership. Give people practical rules. Review suppliers. Train staff. Monitor what changes.
Then keep reviewing it, because this is one area where the technology will almost certainly develop faster than the annual management-system review cycle.
In my experience, the best management systems succeed because they give organisations enough control to move confidently rather than preventing them from moving at all.
AI governance should do exactly the same.
The businesses that get this right will not necessarily be those that adopt AI fastest. They will be the ones that understand where AI creates genuine value, where it introduces genuine risk, and how to manage both without losing sight of either.
Explore practical ISO 27001 templates, guidance and implementation support at The Compliance Companion: https://the-compliance-companion.co.uk/