Data & AI
Cyber Security
View more blogs
AI governance is often overlooked as organisations race to develop and deploy solutions at pace and scale. Too often, consideration is given to governance only retrospectively, once solutions are already in place, rather than being embedded from the outset.
In this blog, Sam Brennan-Ogle, Solutions Architect at Opencast, explores why governance is critical not only to the successful delivery of AI but also to ensuring ethical and responsible practice. He also examines the potential consequences of overlooking governance for AI solutions, end users and organisations.
Context
In August 2026, the Bank of England’s governor issued a warning to the G20 that organisations would need to strengthen their existing cyber security approaches across their digital estates to prepare for current and emerging threats within the AI space.
As AI models become more powerful and cyber-attacks increasingly involve AI, this warning is not new. However, we can all appreciate that the potential impact is significant and growing.
The question organisations may need to ask themselves is: if you have rushed out an AI solution over the last two to three years without undertaking the appropriate security checks, following robust development approaches, or addressing solution gaps, how do you manage that risk and potential impact when the horse has already bolted?
From the Bank of England's perspective, this warning was not only about the impact on individual organisations if a cyber-attack involving an AI model or tool were to occur. It was also a warning about the wider impact such an event could have on financial markets, not just in the UK but across the world.
This is an excellent example of a "what if" scenario that could happen. To ensure the appropriate steps are taken to avoid these potential risks, organisations should implement robust governance frameworks that set clear standards and blueprints for expectations, safety mechanisms, and controls when building and deploying AI solutions. This should be achieved by working collaboratively across stakeholders and delivery teams to ensure solutions align with responsible and ethical standards.
In this blog, I want to identify some frameworks that can be followed, along with practical steps that architects should implement within projects where no established framework or standard exists for the delivery of AI-related solutions.
What happens if we don’t do this?
You could, of course, deliver an excellent product that meets the scope identified by the business. However, by not following governance processes, you may be unable to demonstrate that the solution meets both functional and non-functional requirements. This leaves open questions around whether future issues could arise and whether the business has had clear oversight and understanding of the solution it has approved and released. The potential impacts could include financial, reputational, security and ethical risks.
Additionally, without internal governance in place, organisations risk losing visibility and control over how AI is being used across the business. By failing to establish a clear framework for expectations, processes, implementation standards, development practices, and approved tools, organisations increase the likelihood of inconsistent adoption and unmanaged risk.
What is the solution?
Within the UK, frameworks such as the international standard ISO/IEC 42001 and the UK Government’s AI Playbook exist and can be adopted and implemented as guiding standards.
These frameworks provide guidance on the steps that should be followed to ensure AI solutions are implemented, maintained, and governed in line with ethical and responsible standards.
Some common recommendations that should be implemented include:
Establish a Governance Board
Set up a board with clear terms of reference, ensuring that solution designs, model maintenance, the implementation of new tools, and any project with an AI element undergo the appropriate level of scrutiny and review. Additional areas that should be considered include legal, security, procurement, and compliance requirements.
Ownership and Responsibility
Establish clear ownership and accountability, not only from a project perspective but also for deployment, maintenance, and security. If responsible individuals or teams are not identified, there is a significant risk that solutions will be deployed and subsequently left without proper oversight or support.
AI Risk Assessments
As AI models and tools continue to mature, new risks emerge relating to areas such as data, security, usability, and compliance. Organisations should therefore regularly monitor which AI models are being used, how they are being used, and by whom. This enables ongoing assessment of whether risks to users and the organisation remain acceptable or are increasing, and whether those tools continue to align with organisational strategy and standards.
Data Controls
One of the most common concerns surrounding AI is "Where is the data going?" or "Where has it come from?". As a result, governance should be in place around data management, covering both the information being fed into AI models and the outputs they generate. Alongside this, organisations should ensure compliance with relevant legislation and regulations, including UK GDPR.
Human Control
It would be easy to assume that someone is checking all of the above. However, to ensure any AI solution behaves as intended, there should always be appropriate human oversight. This allows organisations to remain confident that AI-driven processes and automations are operating in line with business standards, ethical expectations, and governance requirements in a controlled and measurable way.
What steps should you take next?
AI models and tools are developing at a rapid pace, which means it can be difficult to anticipate what will emerge next.
In addition, AI-related legislation is being introduced around the world. This means organisations need to remain vigilant and fully aware of how these laws may impact their AI development activities, the tools they use, and their broader compliance obligations. They must also continue to monitor the evolving landscape as new AI models and technologies enter the market.
AI governance is just one part of the solution. While it provides organisations and project teams with a framework to manage current and future AI initiatives, additional measures such as AI strategies, policies, staff training, and ongoing education are equally important. Together, these help ensure teams can succeed while reducing the risk of future issues arising from the misuse or poor management of AI technologies.
Artificial intelligence is not going away. Therefore, it is essential for organisations to establish the right processes, governance frameworks, and strategies to guide how AI is developed, deployed, maintained, and used. By taking a proactive and structured approach, organisations can maximise the benefits of AI while managing the associated risks and positioning themselves for long-term success.
OpenPerspectives is our platform for Opencast people to share their thoughts and perspectives on modern digital delivery. It offers practical insight into user-centred design, engineering excellence, product leadership, data-driven decision making and building expert capabilities, grounded in real-world experience.
Related Content
View more blogs