Skip to content

Get the monthly AI briefing: what matters for your business, in plain English.Subscribe

Menu

ExplainerAI GovernanceGetting Started

AI governance vs compliance: what’s the difference?

Governance and compliance are often treated as the same thing. They are not, and mixing them up leads businesses to invest in the wrong thing first.

Phil Evans

Co-Founder & CEO

The two terms are often used as if they meant the same thing. They do not, and confusing them leads businesses to invest in the wrong thing first.

This article separates the two ideas, shows how they fit together and explains why governance is the investment to make now, whatever happens to the rules.

Two words, two jobs

Compliance is about meeting obligations set by someone else: laws, regulations, contract terms and the standards a client insists on. It answers a precise question. Are we meeting the rules that apply to us, and can we prove it?

Governance is about how a business directs and controls its own use of AI. It answers a wider question. Are we using AI in the way we intend, for purposes we have chosen, with the right people accountable and the right checks in place? ISO/IEC 38507, the international standard on the governance of AI, is written for an organisation’s governing body and is concerned with ensuring AI’s “effective, efficient and acceptable use”.

Finance offers a familiar comparison. A company’s financial controls, such as who can approve spending, how money is tracked and who reviews the numbers, are governance. Filing accurate accounts at Companies House and returns to HMRC is compliance. Good controls make compliance straightforward. Filing on time, on its own, says little about whether the money is well managed.

  • The question it answers. AI governance: How should we use AI, and are we in control of it? AI compliance: Are we meeting the obligations that apply to our AI, and can we show it?
  • Who sets it. AI governance: The business itself, through its strategy, risk appetite and values. AI compliance: External parties: legislators, regulators, contracts and clients.
  • What it covers. AI governance: Every use of AI, including value, quality and reputation. AI compliance: Only the uses and duties that a particular rule covers.
  • Who owns it. AI governance: The board and senior leadership. AI compliance: Usually specialist functions such as legal, risk and data protection, with the board accountable.
  • How it changes. AI governance: Continuously, as tools, people and uses change. AI compliance: When the rules change, often to fixed deadlines.
  • What it produces. AI governance: Decisions, ownership, policies, controls and monitoring. AI compliance: Evidence: records, assessments, notices and declarations.
  • What failure looks like. AI governance: Unapproved tools, unclear ownership, AI spend with no measurable return. AI compliance: Missed duties, fines, failed audits and lost tenders.

Where the confusion costs money

Mixing the two up tends to produce one of two problems.

  • Compliance without governance. A policy is written to satisfy a regulator or a client questionnaire, then filed and forgotten. In Ayinde v Haringey (June 2025), the High Court made the point directly: guidance on its own is not enough, and those with leadership responsibilities must take practical and effective measures to make sure it is followed. IBM’s 2026 data breach study found that only 29% of the organisations it studied ran regular audits for unsanctioned AI. A policy nobody checks is paperwork, not control.
  • Governance without compliance. AI use is sensibly managed, but a specific legal duty is missed. A UK firm with sound internal controls may not realise that the EU AI Act’s transparency rules, in force since 2 August 2026, can require a customer chatbot used by people in the EU to make clear that they are dealing with AI, or that the Act’s AI literacy duty has applied since February 2025. Good governance should catch this, because knowing which rules apply is part of the job.

How they work together

It helps to think of them as layers. Governance is the system, and compliance is one of the things that system has to deliver. A governed business knows what AI it uses, who owns each use and what each one is for. When a new rule arrives, it can tell quickly which uses are affected and who needs to act. A business without that foundation has to start from scratch every time.

The leading frameworks are built the same way. ISO/IEC 42001, published in December 2023, sets requirements for an AI management system for organisations of any size that develop, provide or use AI. The US National Institute of Standards and Technology’s voluntary AI Risk Management Framework treats “govern” as a cross-cutting function that informs everything else. In the UK, the government’s AI Management Essentials self-assessment tool focused on organisational processes rather than individual AI products; in December 2025 the government said it would not publish the tool and would instead develop guidance on foundational governance measures, aimed particularly at SMEs.

UK regulators take a similar view. “Accountability and governance” is one of the five principles that the government asked regulators to apply to AI. The FCA says it does not plan to introduce extra regulations for AI, and points instead to existing rules, including senior managers’ accountability and the Consumer Duty. For many UK firms, then, the compliance question for AI is largely whether their existing governance has been extended to cover it.

The same applies at board level. Directors’ duties under the Companies Act 2006, including the duty in section 174 to exercise reasonable care, skill and diligence, make no exception for decisions about AI. For listed companies, the UK Corporate Governance Code now asks boards to declare the effectiveness of their material internal controls for financial years beginning on or after 1 January 2026. Boards that rely on AI in material processes will need to consider how it fits within that declaration.

One rule change, two responses

The EU’s July 2026 amendments to the AI Act moved the start date for the high-risk rules covering uses such as recruitment and credit scoring from August 2026 to December 2027. Consider how two businesses might respond.

The first had treated the Act as a compliance project with a fixed deadline. When the date moved, the project lost its urgency, the budget was reallocated and staff assumed the problem had gone away. Meanwhile, nobody was tracking the new AI tools that teams had adopted in the meantime.

The second had built governance first: an inventory, named owners and a regular review. For this business, the change affected its timetable but not its direction. It updated its plan and carried on, and when the next client questionnaire arrived, the answers were already there.

This scenario is illustrative and does not describe any particular business.

Why invest in governance now

  • Compliance targets keep moving. The EU dates shifted in July 2026, and the UK has no AI statute, with none expected before late 2027 at the earliest. Building only to a fixed rulebook means rebuilding each time it changes. Governance keeps its value whichever way the rules move.
  • You cannot comply for AI you do not know about. IBM’s 2026 study found shadow AI, meaning staff use of unapproved tools, involved in 43% of the security incidents studied. Every compliance obligation starts with knowing what is in use.
  • One foundation serves many demands. A single inventory, a named owner and one evidence trail can support UK GDPR accountability, EU AI Act duties, client due diligence and insurance proposals. Without that foundation, each demand becomes a separate exercise.
  • It pays even where no rule applies. Governance is what turns AI spending into value that can be measured, which is a separate argument we make in our article on the business case for AI governance.

A quick test: governed, or just compliant?

  1. Could you list every AI tool in use across the business, including AI features in software you already own, within a day?
  2. Does each use of AI have a named owner who can say what it is for?
  3. Do staff know what they may and may not put into AI tools, and would you know if that was ignored?
  4. When a rule changes, is there an agreed way of working out which uses it affects?
  5. Does the board see regular information on AI use, risk and value, rather than only when something goes wrong?

A “no” to any of these points to a governance gap, whatever your compliance documents say.

Practical first steps

  1. Separate the two on paper. Keep a short register of the obligations that apply to your AI use, and a separate record of the decisions you have made about how AI will be used. Seeing them side by side shows where each is thin.
  2. Build the inventory once. One list of AI tools, uses, owners and data serves both governance and compliance. Update it when tools are added, not once a year.
  3. Put a senior name against it. Governance needs an owner with the authority to make decisions, not just to record them.
  4. Make policy work at the point of use. Keep rules short and specific, tell people where to find them and check from time to time that they are being followed.
  5. Review on a schedule and on a trigger. Set a regular review date, and also review whenever a rule, a major tool or a client requirement changes.

Compliance tells you where the floor is. Governance decides how you build on it.

Sources checked October 2026. Regulatory positions, particularly on the EU AI Act and UK AI policy, may change and should be re-checked before reliance. Figures from IBM’s 2026 report are taken from independent summaries of the full report, which is available from IBM on registration.

This article provides general information and does not constitute legal advice. Businesses should take qualified advice on how specific obligations apply to them.

References

Standards and frameworks

UK law, regulation and policy

EU AI Act

Data

ShareLinkedInEmail

Keep learning

Practical GuideAI Governance

The AI governance starter guide for mid-sized firms

A practical, no-jargon guide to putting AI governance in place in a 50 to 250 person firm. Five building blocks, who owns what, and where to start.

Phil Evans

Co-Founder & CEO · 14 Oct 2026

Getting Started

Put it into practice

The AI Jargon Buster

Starter PackAI Adoption

The AI Jargon Buster

Twenty words you will hear in every AI conversation, in plain English. What each one actually means, and a way to picture it

Isaac Ward

AI Practitioner · 14 Oct 2026

Free downloadGetting Started

Stay informed

A short monthly briefing on the AI developments that actually matter for your business. No sales pitches.

Monthly. Unsubscribe in one click. We never share your details.