Skip to content

Get the monthly AI briefing: what matters for your business, in plain English.Subscribe

Menu

AnalysisAI GovernanceBuilding Capability

The business case for AI governance

AI governance is usually filed as a compliance cost. The evidence says it is an investment, and that the cheapest time to make it is now.

Phil Evans

Co-Founder & CEO

Most businesses file AI governance under compliance cost. The evidence suggests it belongs under investment, alongside and digital transformation strategies, and that the cheapest time to make that investment is now.

This article sets out what ungoverned AI is already costing businesses, how good governance speeds up adoption and opens commercial doors, and why waiting tends to make the bill bigger rather than smaller.

In the wrong column

Ask a board where AI governance sits and the answer is usually “risk and compliance”: a cost line, sized to the minimum needed to keep a regulator content. That made sense when AI meant a handful of pilots. It makes much less sense now that AI sits inside everyday software, client work and decisions about people.

Stripped of jargon, governance is a set of answers to a few practical questions. What AI are we using? Who may use it, on what data and for what purpose? Who checks the output? How would we know if something went wrong? A business that can answer those questions quickly can move faster with AI, not slower. A business that cannot is carrying a risk it has not priced.

What ungoverned AI already costs

The cost of getting this wrong is no longer theoretical.

  • Breaches. IBM’s 2026 Cost of a Data Breach study of 602 organisations found that shadow AI, meaning staff using AI tools the business has not approved, was involved in 43% of the security incidents studied, up from 20% a year earlier. Of the organisations breached, 68% had no AI governance policy, up from 63%. For context, IBM puts the average cost of a UK data breach at £3.13 million.
  • Losses. EY’s 2025 Responsible AI survey of 975 senior leaders at organisations with annual revenue above US$1 billion found that 99% had suffered financial losses from AI-related risks, and 64% had lost more than US$1 million. EY puts the average loss at US$4.4 million, a figure it describes as conservative. These are very large organisations, so the figures should not be read across directly to smaller firms, but the direction of travel is clear.
  • Liability. In Moffatt v Air Canada (2024), a Canadian tribunal held the airline liable for wrong information given by its website chatbot and rejected the argument that the chatbot was responsible for its own actions. The decision does not bind UK courts, but it shows clearly where liability tends to land: with the business whose AI gave the answer.
  • Professional duty. In Ayinde v Haringey (June 2025), the High Court in England, dealing with fictitious cases cited in court, said that those with leadership responsibilities, such as managing partners and heads of chambers, must take practical and effective measures to ensure everyone providing legal services understands their obligations when using AI. The court added that guidance on its own is not enough.

Governance as an accelerator

The more interesting evidence sits on the other side of the ledger. Governance is increasingly part of what separates the businesses getting value from AI from those that are not.

It gives people the confidence to use AI

The 2025 global study of trust in AI by KPMG and the University of Melbourne found that only 42% of people in the UK are willing to trust AI, and 80% believe AI regulation is required. At work, 38% of UK workers surveyed admitted using AI in inappropriate ways, while only 27% of UK respondents said they had any AI education or training.

People who do not know the rules tend either to avoid the tools or to use them out of sight. Clear, simple rules and short, practical training make the approved route the easy one, and that is where adoption, and the return on licences already paid for, comes from.

It is linked to better returns

McKinsey’s State of AI survey, published in March 2025, found that CEO oversight of AI governance was one of the elements most correlated with higher self-reported bottom-line impact from generative AI. For larger companies, it was the element with the most impact on EBIT attributable to generative AI. Only 28% of respondents said their CEO was responsible for AI governance.

EY’s survey points the same way: organisations using measures such as real-time monitoring and oversight committees reported statistically significant, positive effects on revenue growth and cost savings. Both findings are correlations rather than proof of cause, but they are consistent with each other.

It opens commercial doors

Insurers, clients and regulators are all asking sharper questions. Writing about the London market, Slaughter and May report that underwriters increasingly ask how firms deploy and control AI, not just whether they use it, with questions covering acceptable use policies, staff training and human review. They suggest that firms with strong controls may secure better terms.

The market is moving in both directions. In the US, Berkley has introduced absolute AI exclusions on its directors’ and officers’, errors and omissions and fiduciary liability products. In London, the specialist insurer CFC has gone the other way, adding wording to several of its policies that confirms AI involvement does not stop the policy responding. Either way, whether an AI-related claim is covered increasingly depends on the wording, and on being able to show how AI is controlled.

Regulated firms face the same questions from supervisors. The Bank of England and FCA’s 2024 survey found that 75% of UK financial services firms were already using AI, yet 46% of firms using or planning to use it reported only a partial understanding of the AI technologies they rely on, largely because of third-party models. The government has been clear about why this matters: its 2024 report on AI assurance describes it as essential to “unlocking widespread adoption in both the private and public sectors”.

It stops expensive projects failing

Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls. Two of those three reasons are governance questions: knowing what value a project is meant to deliver, and what controls it needs, before money is spent building it.

Two firms, one questionnaire

Consider two professional services firms of similar size. Each receives the same questions, perhaps from an insurer at renewal or from a large client’s procurement team: which AI tools do you use on client data, where does that data go, and who checks the output?

The first firm keeps a simple register of its AI tools, has a one-page policy and can show that staff have completed short training. It answers in an afternoon. The second firm has never asked. It spends several weeks finding out, discovers tools nobody approved, and then has to decide what to disclose and how to explain it. Both firms use AI. Only one of them can prove it is in control, and that is the one that keeps moving.

This scenario is illustrative and does not describe any particular firm.

Why waiting costs more

Waiting for the rules to settle is an understandable instinct. The evidence suggests it is an expensive one.

  • The exposure is growing. Shadow AI’s involvement in breaches more than doubled in a year, while the share of organisations studied that run regular audits for unsanctioned AI fell from 34% to 29%.
  • Many duties already apply. Where AI processes personal data, the UK GDPR accountability principle already requires a business to be able to demonstrate compliance. For businesses within the reach of the EU AI Act, the AI literacy and transparency duties already apply, and the rules for high-risk uses such as recruitment and credit scoring arrive in December 2027.
  • Retrofitting is harder than designing in. Every month without an inventory, more tools, data flows and working habits become embedded. Untangling them later, after a client question, a claim or an incident, means doing the same work under time pressure, usually at greater cost.
  • Insurance renews every year. New exclusions and proposal questions tend to arrive at renewal. A business that can describe its controls when asked is in a stronger position than one assembling answers afterwards.

None of this needs to be heavy. A small business may need little more than an inventory, a short policy, basic training and a named owner. A regulated or larger business will need more: ongoing monitoring, documented assessments and evidence that stands up to audit. What matters is that governance is proportionate, and that it is in place before someone asks for it.

Building the case in your business

  1. Start with what you already spend. Total your AI licences and subscriptions, and count how many people actually use them. That is the investment governance protects, and the baseline for measuring return.
  2. Find the gap between the approved list and the real one. Ask teams, anonymously if necessary, which AI tools they actually use. The difference is your unpriced exposure.
  3. Ask your broker one question before renewal. Does our cover respond to claims where AI was involved, and what will underwriters want to know about how we control it?
  4. Prepare the answers clients will ask for. Which tools touch client data, where that data goes and who checks the output. Keep the answers in one place and up to date.
  5. Put a senior name against it. Both the McKinsey findings and the High Court’s comments in Ayinde point to leadership. Governance owned at the top tends to be governance that works.
  6. Train for confidence, not just compliance. Short, role-specific guidance on what is permitted, what must never be entered into AI tools and when human judgement is required.
  7. Measure both sides. Track adoption and value alongside incidents, so governance is judged on what it enables as well as what it prevents.

For most businesses, the question is no longer whether to govern AI. It is whether to do it now, on their own terms, or later, on someone else’s.

Figures checked against the sources listed below in October 2026. Survey findings reflect the samples and methods described by each publisher, and several are correlations rather than evidence of cause. Figures from IBM’s 2026 report are taken from IBM’s published releases and from independent summaries of the full report, which is available from IBM on registration.

This article provides general information and does not constitute legal, insurance or financial advice. Businesses should take qualified advice on their own circumstances, including on the terms of their insurance cover.

References

Cost and exposure

Liability and professional duty

Adoption, trust and value

Insurance and regulators

EU AI Act

ShareLinkedInEmail

Keep learning

Put it into practice

The AI Jargon Buster

Starter PackAI Adoption

The AI Jargon Buster

Twenty words you will hear in every AI conversation, in plain English. What each one actually means, and a way to picture it

Isaac Ward

AI Practitioner · 14 Oct 2026

Free downloadGetting Started

Stay informed

A short monthly briefing on the AI developments that actually matter for your business. No sales pitches.

Monthly. Unsubscribe in one click. We never share your details.