Use AI safely, without slowing progress
Hartz AI runs AI governance health checks and builds governance frameworks for UK SMEs. This work is led by Rivka Abecasis, Consulting AI and Data Governance Lead. She puts in place the governance, agreements and policies an organisation needs to use AI and personal data with confidence.
The UK's AI regulation white paper (2023) (opens in a new tab) set out five principles for regulators such as the ICO to apply to organisations using AI. Many businesses still have no written AI policy. Hartz AI turns those principles into proportionate policies, risk assessments and training your team can actually use.
AI governance is the set of policies, risk assessments and oversight processes that control how a business builds, buys and uses AI. Hartz AI provides governance health checks, risk registers, policies and staff training for UK SMEs, aligned to UK GDPR and the EU AI Act.
Trusted by organisations across the UK
What is AI governance and why does your business need it?
AI governance is the set of policies, processes and responsibilities that help your organisation use artificial intelligence safely, ethically and in line with the law. A full governance review at Hartz AI covers more than 40 risk areas, depending on your sector.
Without governance, AI adoption creates invisible risk. Staff paste confidential data into public tools. Automated decisions go unchecked. Regulatory obligations under UK GDPR and emerging AI frameworks get missed until a breach forces the conversation. Of UK businesses that use AI, 17% have a policy or guidelines on its use, and only 5% have a formal written policy, according to DSIT (June 2026) (opens in a new tab).
Good governance is proportionate to the organisation. For SMEs, that means light but deliberate controls, not an enterprise-scale programme. What UK regulation currently expects is set out in the next section.
What does UK regulation currently require for AI governance?
Last reviewed: October 2026.
The UK has no AI-specific law (opens in a new tab). AI is regulated in the setting where it is used, through existing laws and existing regulators such as the ICO, the FCA and Ofcom.
In 2023 a government white paper (opens in a new tab) set out five principles for those regulators to apply: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. The principles are not law, and the current government has kept the same approach. They make a practical checklist for your own governance.
Where AI uses personal data, UK data protection law applies (opens in a new tab) and the ICO enforces it. In plain terms, you need a lawful basis for using the data. You need a data protection impact assessment where the use is likely to result in a high risk to people. And where a significant decision about a person is made with no meaningful human involvement, you need safeguards: tell the person, let them make their case, and give them a route to a human review and to challenge the decision. Stricter rules apply where sensitive categories of data are used. The rules on automated decisions changed in February 2026 (opens in a new tab). That change came from the Data (Use and Access) Act 2025, and the ICO expects to publish its final guidance on automated decision-making in winter 2026 (opens in a new tab).
The EU AI Act (opens in a new tab) sorts AI by risk: banned practices, high-risk systems, systems with transparency duties, and minimal risk. It can apply to a UK business that places an AI system on the EU market, or whose AI output is used in the EU. Its duties are being phased in over several years, so check the current dates if this applies to you. Even if you work only in the UK, its risk levels are a useful way to sort your own AI use.
What does an AI governance framework look like for an SME?
An SME governance framework has four components: an acceptable use policy, a risk assessment process, team training, and a named person responsible for AI decisions. It does not need a committee, a dedicated department, or a six-figure budget.
Your acceptable use policy defines which AI tools are approved, what data can be shared with them, and where human review is required. It should be written in plain English and be short enough that staff read it. Staff who never read it cannot follow it.
Risk assessment means evaluating each AI tool against a short checklist: what data does it access, what decisions does it influence, what happens if it gets something wrong, and who is accountable. Where a tool uses personal data in a way that is likely to result in a high risk to people, a data protection impact assessment is also needed. The ICO's DPIA guidance (opens in a new tab) sets out how.
A practical way to group AI risk is into four types: data risk, decision risk, model risk, and third-party risk. Data risk covers what information a tool can access or leak. Decision risk covers how much AI output shapes a real outcome for a customer or employee. Model risk covers accuracy, bias and hallucination. Third-party risk covers supplier security and contract terms. Scoring each AI tool against all four gives you a proportionate, repeatable process rather than a one-off exercise.
If a client or tender asks for certification, the standard to know is ISO/IEC 42001 for AI management systems. BSI announced in November 2025 (opens in a new tab) that it had become the first certification body accredited by UKAS to certify against it.
Training helps your team understand the policy and spot common risks like data leakage through public AI tools, hallucinated outputs presented as fact, and bias in AI-generated recommendations. Our AI Governance Framework service puts all four parts in place.
What are the risks of getting AI governance wrong?
The risks fall into three categories: regulatory, operational, and reputational. For many SMEs, operational risk - staff unknowingly leaking data or making flawed decisions based on AI output - is the most immediate and likely concern.
Regulatory risk is mainly about data protection law. If AI uses personal data without the right basis, safeguards and records, the ICO can investigate and take enforcement action. The ICO publishes the enforcement action it takes. (opens in a new tab)
Operational risk materialises when staff use public AI tools for confidential work, rely on AI-generated content without verification, or deploy AI in customer-facing processes without adequate testing. These failures are far less likely with basic governance controls in place.
Reputational risk grows as customers and clients become more aware of AI use. Businesses that cannot show responsible AI practices face harder questions from procurement teams, regulators and the public. In our experience, the first to ask is rarely the regulator. It is a client's procurement team before they sign, or an insurer at renewal. Early governance means the answers already exist when they ask.
How do you start building AI governance in your organisation?
Start by finding out where you stand. Four questions will tell you.
- Do you know every AI tool your people use, including the ones nobody approved?
- Is it written down what staff may and may not put into those tools?
- Do you know which uses of AI affect people, personal data or decisions that matter to the business?
- Has anyone been trained on any of this?
If you cannot answer yes to all four, that is where governance starts. Governance that lives only in a policy document and never reaches your people is governance in name only. A governance health check answers these four questions with evidence and tells you what to do first.
Can AI tools write your risk assessment for you?
ChatGPT and similar tools can draft a starting template for an AI risk assessment, but they cannot see your actual tools, data flows, or contracts. Treat AI-generated drafts as a first pass that a named person then checks against what your business really does.
A risk assessment is only as good as the facts in it: which system, which data, which decision and who is accountable. An AI tool can suggest headings. It cannot supply those facts, and it cannot judge which risks matter most to your business.
If you would rather have this done properly than patch together AI-drafted documents, our governance services are set out below.
Illustrative example: an SME before and after
Before Hartz AI
- Written AI policyMissing
- Use of public AI toolsUntracked
- AI risk awarenessLow & informal
After an AI Governance Framework
- A clear, practical AI policy, written so everyone can understand it
- Risk register and approval rules for new AI tools
- Team training on safe, responsible AI use
How does Hartz AI help with AI governance and compliance?
What we help you put in place
Governance and compliance at Hartz AI is led by Rivka Abecasis, Consulting AI and Data Governance Lead. She turns regulation, standards and good practice into manageable steps, and gives you the rules, records and evidence to say yes or no to AI with confidence.
When your people are already using AI
AI Policies & Guardrails
Plain-English policies written for how your organisation actually works, so your people know what they may and may not do with AI and personal data.
- Which AI tools are approved
- What data can be shared with them
- Where human review is required
When you need to know where you stand
Risk Assessments & Records
A clear, written picture of where AI and personal data are used in your organisation, which uses carry real risk, and what has been decided about each.
- AI risk register & impact assessment support
- Register of approved AI tools
- AI tool and supplier assessment
When a client or an insurer asks
Training & Evidence
So that when a client's procurement team, an insurer or your own board asks how you manage AI and personal data, you have your answer ready.
- AI governance training for leaders & teams
- A record of who has been trained on what
- A document set for client and insurer due diligence
What AI governance services does Hartz AI offer?
Start with a health check, put a framework in place, or have ongoing support. Every engagement is scoped to your organisation, your sector and what you already have in place.
AI Governance Framework
A 4-6 week sprint to create or refresh your AI policy, usage rules and internal guidance, from £7,500 + VAT depending on headcount. Built in plain English, with examples your team can actually use.
- Workshops with key stakeholders
- Draft & iterate policy documents
- Internal launch & Q&A session
AI Compliance Health Check
A focused look at your current and planned AI use-cases, highlighting key risks and proposing proportionate controls, from £3,500 + VAT.
- Workshops with process owners
- AI risk register & prioritisation
- Control recommendations & roadmap
AI Governance & Compliance Training
Interactive sessions that help your teams understand what 'good' looks like when using AI, and how to spot when something isn't right.
- Custom scenarios for your sector
- Clear "do / don't" examples
- Follow-up resources and playbooks
Fractional AI Compliance Officer
A steady partner to sense-check new AI ideas, support board conversations and keep your guardrails up to date. Essentials £1,250 per month + VAT, Managed £2,000 per month + VAT, Embedded £3,000 per month + VAT.
- Regular check-ins with leadership
- Review of new tools and use-cases
- Updates as regulations evolve
AI Project & Vendor Assurance
Independent, plain-speaking review of AI projects and suppliers, so you can ask sharper questions and negotiate better terms.
- Review of vendor claims & limitations
- Data, privacy and security considerations
- Red-flag list and mitigation options
Custom Governance & Risk Programme
A joined-up programme that blends policy, training, risk assessments and advisory support over several months.
- Tailored roadmap for your organisation
- Mix of workshops, sprints & advisory
- Designed to build internal capability
Do SMEs really need AI governance?
If your people use AI, yes. It needs to be proportionate, not large.
There is no official SME template to copy. In February 2026 the government said it would not publish its AI Management Essentials tool (opens in a new tab) and plans future guidance aimed at SMEs.
Who this is forOur governance work is built for:
- UK start-ups and SMEs starting to use AI at scale
- Professional services firms handling sensitive client data
- Charities, membership bodies and education providers
- Leaders who want confidence before saying "yes" to AI
- Organisations that have been asked by a client or an insurer how they manage AI
You don't need a specialist in-house team. We start from where you are and design something that's realistic for your size, sector and risk appetite.
Governance that fits your organisation
Plain-English First
We avoid jargon and write in language your teams can actually use, not just file away.
Proportionate, Not Overbuilt
We focus on the few things that matter most for you, rather than recreating a big-tech governance function.
Capability, With Support When You Want It
We aim to leave your people able to run governance day to day, with ongoing support there to keep it current.
Common questions
What do people ask about AI governance?
A practical first step
Book a governance call
Tell us how your organisation uses AI and what you want to get right. We will tell you which service fits and what it would involve. Plain English. No pressure.
This page is general information, not advice. See our terms.