Most UK SMEs lack formal AI governance policies

New research indicates that a significant absence of governance within small and medium-sized enterprises is leaving staff using artificial intelligence tools without clear boundaries regarding data privacy, acceptable usage or quality control. A recent survey reveals that three-quarters of businesses in the United Kingdom operate without a written policy governing these technologies, while thirty per cent have no intention to implement one.

Although twenty-seven per cent of firms maintain informal guidelines, such measures fail to offer the same structural integrity, accountability or legal protection as a formal corporate framework. The study highlights that merely having one client within the European Union triggers the application of the EU AI Act for startups. Consequently, nearly half of UK business leaders admitted they are unaware they could face legal liability concerning the ethical output and integrity of third-party models used internally.

Among SMEs that conducted an audit in the last quarter, fifty-eight per cent spent over ten hours on the process, underscoring the difficulty many organisations face when balancing rapid adoption with necessary resource allocation. This trend persists despite previous reporting from December stating that less than a fifth of UK entities have implemented a comprehensive strategy for artificial intelligence.

Further research conducted by law firm Shoosmiths alongside FT Longitude suggests AI governance remains a low priority, with fewer than one-quarter citing regulatory compliance as a primary concern compared to forty-four per cent among European counterparts. The findings suggest that while adoption is widespread, the necessary strategic and structural foundations remain largely unaddressed across the sector.