AI strategy and discovery
Control, not prohibition: AI governance that unlocks value instead of blocking it
The single loudest frustration in every discovery programme we run is the same: AI tools are blocked, so staff use personal accounts. The concern behind the block is legitimate. The block is the wrong answer. We design the governed-access model, the policy and the responsible-AI framework that let a business open AI safely, and we align it to the EU AI Act.
Why a blanket block is the costliest mistake
Proprietary production data, process parameters, intellectual property and customer data all need protecting, and submitting sensitive material to a consumer-grade AI tool is a real risk. Any recommendation to open access has to answer that concern directly.
But a blanket block does not prevent AI use; it displaces it. Across every workshop we have run, staff describe using personal ChatGPT and Claude accounts "outside work" to get the job done, with the business having no visibility or control at all, which is precisely the data-leakage risk the block was meant to prevent, made worse. At the same time the block forfeits the two cheapest, highest-value opportunities in almost every business, the productivity assistant and content tooling, both ready today and held back only by access. The block trades a controllable risk for an uncontrollable one and pays for it in lost value.
How to open AI safely
Enterprise licences with no-training terms
The enterprise tiers of Claude, Microsoft 365 Copilot and ChatGPT contractually commit that business data is not used to train the models. This directly answers the concern behind most blocks; we confirm the exact terms at contracting.
Data classification and DLP
Clear rules on what may and may not be shared, backed by data-loss- prevention controls, so sensitive material is protected regardless of the tool.
Sanctioned tools and phased, role-based access
A sanctioned-tool list, access opened by role and use case rather than all at once, and an approval route for new tools.
Usage policy and AI literacy
An acceptable-use policy and the training to go with it, so staff know how to use the tools safely. AI literacy has been a regulatory requirement since February 2025.
Responsible-AI principles
Fairness, transparency, accountability, privacy and safety, applied to tool selection, vendor evaluation and use-case assessment, with sector-specific sharpening for safety-critical, customer-facing or workforce-affecting uses.
Four fields on every use case
Risk category, data protection, human oversight and transparency, added to your existing evaluation template so governance is part of every decision rather than a gate at the end.
What applies, and to whom
The Act applies to UK businesses whose AI systems are placed on the EU market, used in the EU, or affect people in the EU, which covers most manufacturers and many service businesses. Its risk-based approach is the useful part: most everyday uses are minimal risk; customer-facing chatbots are limited risk and carry a transparency duty, so users must know they are interacting with AI; safety components and systems affecting people's access to services or employment are high risk, requiring documentation, risk management and human oversight. AI literacy for staff has applied since 2 February 2025.
For a UK business the practical work is modest if it is done early: inventory and classify AI systems by risk, apply the transparency and oversight controls where they are required, keep the documentation, and monitor for bias and drift. We map each use case in a roadmap to its risk category as standard, which is why the four governance fields exist. Where ISO 42001 (the AI management-system standard) or the ICO's guidance on AI and data protection are relevant, we align to them rather than inventing a parallel framework.
It reinforces the governance you already have
None of this competes with existing structures; it is their practical content. Where a business has an AI working group, an IT governance board or a technology-assessment process, we add responsible-AI considerations to it: a risk classification and mitigation plan in the evaluation, workforce impact and compliance value in the value tree, compliance and audit cost in the total cost of ownership, and a responsible-AI check in strategic fit. Four fields, one policy, one sanctioned-tool list, and the decision that turns a good set of ideas into delivered value.
About AI governance
Does the EU AI Act apply to a UK-only business?
If none of your AI systems are used in the EU or affect people in the EU, its obligations do not apply directly. Most businesses selling into Europe, or with EU customers, suppliers or staff, are in scope for at least some systems. Its structure is good practice regardless, and UK regulators' guidance points the same way.
Which risk category are customer-facing chatbots?
Limited risk, with a transparency duty: users must be told they are interacting with AI. We also add prompt-injection guardrails and a handover to a person as standard.
Do we need ISO 42001?
Not usually, unless customers or tenders ask for it. Its structure is a sensible shape for an AI management system, and a governed- access model built as above is most of the way there.
Can you write our AI usage policy?
Yes, and we do it with your IT, HR and legal functions in the room, so it reflects your data classification and employment terms rather than a template.
What about staff already using personal AI accounts?
Treat it as evidence of demand, not misconduct. The governed-access model gives them a sanctioned route; the policy and training explain why it matters. Enforcement without an alternative just drives use further underground.
Replace the block with a model that works
The governance decision is the one that unlocks everything else in an AI programme. Make it well.