Your board knows AI is being used in the business, but it is not sure what, by whom or whether anyone is checking. You do not need a new committee or a thick policy to fix that. You need a short list of what is in use, an agreed view on how much risk you will accept, and a few good questions asked regularly. This guide shows a small or mid-sized board how to do that.
Key takeaways
- Start with a simple AI register: what tools you use, for what, who owns each, and what could go wrong.
- Agree a risk appetite in plain words, for example "AI may draft, but a person approves anything sent to a customer".
- Ask the same few questions every quarter, so the board sees change over time.
- Oversight is the board's job. The work itself belongs to managers or an outside lead.
Why oversight matters even in a small firm
AI is now in ordinary software: email, accounts, customer service tools. Staff often start using it without anyone deciding to. That is not wrong, but it means the board may be carrying risks it has never looked at, such as customer information pasted into a free tool, or an automated reply that promises something you cannot deliver.
Directors have legal duties, and Companies House publishes guidance on being a director.1 We do not interpret those duties here; if you are unsure what they mean for AI, take professional advice. What follows is practical good practice, not a statement of what the law requires.
Step 1: build an AI register
An AI register is a list of every AI tool or system the business uses. A spreadsheet is fine. For each entry, record:
| Column | Example |
|---|---|
| Tool or system | Chat assistant in our office software |
| What it is used for | Drafting customer emails |
| Owner | Operations manager |
| What information goes in | Customer names and order details |
| What could go wrong | Wrong facts sent to a customer |
| Control in place | A person reads every email before it is sent |
| Last reviewed | 14 November 2026 |
The register is where most boards discover surprises. Ask managers to include tools staff use on their own initiative, without blame. People will only tell you what they use if it is safe to do so.
Step 2: agree your risk appetite
Risk appetite means how much risk the board is willing to accept in return for the benefit. Write it in plain sentences the whole business can follow. For example:
- AI may draft, summarise and suggest. A person approves anything that goes to a customer, a supplier or a regulator.
- We do not put customer or staff personal information into tools that are not on our approved list.
- We trial new AI uses on low-risk tasks first, and expand only when they have worked for a set period.
- Any AI that can take actions on its own, such as sending payments or changing records, needs board sign-off.
Our article on AI security for small businesses covers the security side in more depth.
Step 3: ask good questions
These questions work for most boards. Ask them every quarter:
- What has changed in the AI register since we last met?
- Which AI uses are saving time or money, and how do we know?
- Has anything gone wrong, or nearly gone wrong? What did we change?
- Are our suppliers adding AI to products we already use? Did we agree to that?
- Who would notice if an AI tool started giving wrong answers?
- Are we still inside our risk appetite? If not, should we change the behaviour or the appetite?
For questions to put to your suppliers, see AI supplier security questions.
Step 4: decide how reporting works
Keep it short. A one-page update each quarter is enough for most firms: the register changes, any incidents, the answers to the questions above, and any decisions the board needs to make. Name one manager who owns the update. In a larger business, an audit or risk committee may take on the detail and report up.
Frameworks you may hear about
You do not have to follow a formal framework. Some boards find one useful as a checklist.
- AI Management Essentials (AIME). The Department for Science, Innovation and Technology (DSIT) consulted on a self-assessment tool for organisations' AI management practices, with the consultation closing on 29 January 2025. Its government response, last updated 6 February 2026, says DSIT will not publish the version it consulted on and is instead developing guidance on foundational AI governance aimed at SMEs.2 Check the gov.uk page for the current position.
- The UK Corporate Governance Code. The Financial Reporting Council's 2024 Code applies to companies in certain listing categories, on a "comply or explain" basis, from financial years beginning on or after 1 January 2025.3 Most SMEs are not covered by it, but some boards borrow its approach to risk and internal controls.
Who does the work
The board oversees; it does not run the AI programme. Someone needs to own the register and the reporting. In a small firm that is often an operations or finance manager. If nobody has the time or the experience, you might bring in a fractional chief AI officer, or add independent challenge with an AI non-executive director.
- Started an AI register, including tools staff use on their own
- Written a risk appetite in plain sentences
- Added the quarterly questions to the board agenda
- Named one manager who owns the quarterly AI update
- Taken professional advice if unsure about directors' responsibilities
Sources
-
Companies House, "Being a company director", last updated 11 September 2026, https://www.gov.uk/guidance/being-a-company-director, accessed 2026-11-14. ↩
-
Department for Science, Innovation and Technology, "Guidance for using the AI Management Essentials tool: government response", last updated 6 February 2026, https://www.gov.uk/government/consultations/ai-management-essentials-tool/outcome/guidance-for-using-the-ai-management-essentials-tool-government-response, accessed 2026-11-14. ↩
-
Financial Reporting Council, "UK Corporate Governance Code", published 22 January 2024, https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/, accessed 2026-11-14. ↩