AI governance in London: what boards are actually asking for

In financial services, insurance, legal and public bodies across London, the AI conversation moved from capability to accountability in under two years. The interesting meetings are no longer about what a model can do. They are about who owns the consequence when software takes an action on the firm's behalf.

That shift is why AI governance work in the UK now lands with risk, compliance, legal and the board at the same table as engineering. The people signing the approval are the people who will be asked to explain it.

Three things separate a governance programme that holds from one that does not. First, decision ownership written down: which decisions the system owns, which it recommends, and which it must never touch. Second, an evidence trail produced by the system itself rather than reconstructed afterwards. Third, an escalation path that is exercised, not documented.

Frameworks help. The EU AI Act, ISO 42001 and the UK's regulator-led approach all point the same way: demonstrable control over automated decisions. But a framework is a shape, not a system. The work is wiring the shape into the software that acts.

We work with UK organisations on the part that is hardest to buy off a shelf: turning a governance intent into runtime controls, logs and receipts inside the systems already in production. Sometimes that is a review with a remediation plan. More often it is engineering.

We run this work remotely with UK clients and in person in London when the programme needs it, from our registered base in the DIFC, Dubai.