Service
AI Governance Consulting for UK Businesses: Safe, Documented AI
AI governance is the set of rules, records and checks that keep your use of AI safe and lawful. HAeX offers AI governance consulting for UK businesses, from builders who know how the systems work. We write your AI policy, DPIA and risk register and brief your staff. We are not a law firm. Price is scoped on a call.
- The advice comes from people who build the AI.
- You get plain documents your staff can follow.
- We flag legal questions for your own adviser.
It is who may use AI, for what, with which data, and who checks the result. It is written down, so everyone follows the same rules.
What is AI governance, in plain terms?
Good governance is not a heavy binder. It is a short policy, a record of risks and a habit of checking. It lets you use AI with confidence and answer a client or regulator who asks.
Does my business need AI governance?
Yes, if staff use AI tools, if you build AI or if AI touches personal data. That covers most firms now.
Even if you have no AI project, staff may paste client data into a public tool. A short policy and a briefing fix that cheaply. Everyone is shipping AI. Few can answer the hard questions about it. We help you be one of the few.
If you advise or broker for clients, see how this works for financial advisers and brokers. Teams rolling out ChatGPT can read about our ChatGPT Enterprise rollout.
What do you actually produce?
We produce four plain documents and a briefing.
AI use policy:
what staff may and may not do with AI.
DPIA:
a data protection impact assessment for any AI that handles personal data at risk.
Risk register:
the risks, their owners and the fixes.
Staff briefing:
a short session on the rules.
Review plan:
when each document is checked again.
See AI risk assessment and AI compliance consulting for the detail. For a free first draft, use our AI policy and DPIA builder.
UK GDPR is the main one, because most AI use touches personal data. The Data (Use and Access) Act 2025 changed the rules on automated decisions. Sector regulators add their own.
Which UK rules apply to AI?
The ICO publishes guidance on AI and data protection. Law, finance, health and recruitment each have regulator guidance too. We explain what applies to you in plain words. For a firm in a regulated field, see our industry pages, such as accountants.
Does the EU AI Act apply to a UK business?
It can, if you sell AI into the EU or your AI output is used there. If neither applies, it may not reach you directly.
The timetable has changed during 2026, so we do not print dates here. Our EU AI Act guide for UK business carries the current position. We check each client's exposure on the call.
What does a worked example look like?
Here is a worked example with assumed figures. It is not a client result.
Say a 30 person firm finds that five staff use public AI tools with client documents. We write a one page policy and a short briefing. We pick one approved tool with the right settings. We record two risks in the register, each with an owner. Staff then know what to use and what to avoid.
We can work through this with your own details on a free call.
We use recognised frameworks as checklists. ISO/IEC 42001 is the AI management standard, and we can map your controls to it.
Do you work to any standard?
We are not a certification body, and we do not claim certification for you. If you need a formal certificate, we say who can issue one. Our advice stays plain: what to write down, who owns it and when to check.
How does an engagement run, step by step?
It runs in four steps.
- 1
Discovery call (30 minutes)
You tell us how AI is used or planned.
- 2
Audit and quote
We list the AI in use, the data it touches and the gaps, then quote in writing.
- 3
Write
We produce the policy, DPIA, register and briefing with you.
- 4
Review
We set a date to check them again, and you can keep us on a care plan.
The free AI readiness assessment is a good first step.
What does AI governance consulting cost, and how long does it take?
Price depends on how much AI you use and how much personal data it touches. We scope it on a free call and quote in writing.
A small firm with a few tools can finish in a short engagement. A firm building its own AI takes longer. Every AI Automation build we do already includes a UK GDPR and data flow note. The AI Booster includes a use policy.
Start with the free 30 minute call. Tell us which AI tools your people use now, and which you plan to add.
What is the next step?
We will say what to write first, and whether you need a full assessment.
Questions that come up
Do I need an AI policy?
If staff use AI, yes. A one page policy is better than none, and our builder gives you a first draft.
What is a DPIA for AI?
It is an assessment of the risks to people from using their data. UK GDPR requires one for high risk processing.
Is ChatGPT allowed under UK GDPR?
It can be, with the right plan, settings and rules. Public, free tools are riskier for client data.
What does an AI ethics consultant do?
They help you decide what you should and should not do with AI, beyond what the law requires.
Can you make us compliant?
We can advise and document. Compliance is yours to own, and legal questions go to your adviser.
Do you offer EU AI Act compliance?
We advise UK firms the Act may reach. See AI compliance consulting.
What happens on the call
- 1
You tell us which AI tools your people use
- 2
We say what to write first
- 3
You leave with a short list of what to automate first and a rough idea of cost
Prefer to talk first? Ring 07435 708864.
What you now know
- What AI governance is
- Whether you need it
- What we produce
- Which UK rules apply
- Whether the EU AI Act reaches you
- What a worked example looks like
- Which standards we use as checklists
- How an engagement runs
- What it costs and how long it takes
- Your next step
Get your AI use written down and checked
The first call is free. We tell you which policies and checks your business needs first.