AI governance and security for UK SMBs

Staff at your business are almost certainly already using ChatGPT, Microsoft Copilot or a similar tool, whether or not a policy says they can. AI governance, in plain English, means a clear, enforced answer to one question: what can and cannot go into an AI tool. Get it right and staff can use AI productively without gambling with client data. This page covers what that involves, the risks that make it urgent, where UK rules currently sit, and how Lanmark builds a policy backed by real technical controls rather than a document nobody reads.

What AI governance actually means for a smaller business

AI governance is three things working together: a written policy on what staff can and cannot do, technical controls that make the policy stick even when someone forgets it, and clear accountability for who owns it.

Most smaller businesses have none of these. Some have a policy, usually a short paragraph borrowed from a template, with no technical enforcement and nobody checking it reflects what staff actually do. That looks reassuring in a board pack and does nothing the day someone pastes a client contract into a public AI tool by mistake. Proper AI governance is proportionate to the size of the business: which tools are approved, what data can go near them, who is accountable, and what happens when something goes wrong.

The real risk is shadow AI, the use you cannot see

Shadow AI is AI use outside any policy or IT oversight, usually staff signing into a free, consumer tool with a personal account on a work device. It is the AI version of shadow IT, except that a single prompt can send out more than an unauthorised app would.

A realistic example: someone at a professional services firm pastes a draft contract into a public AI tool to tidy the wording before a client meeting. Nobody told them not to. The document has now left the firm’s control, with no audit trail and no way to prove what happened.

Most businesses cannot say which AI tools their staff use today, or what has gone into them. Without that visibility, a written policy is a guess dressed up as governance.

Is ChatGPT, or Copilot, safe to use with client data?

It depends entirely on which version. A free, consumer account signed in with a personal login sits outside your business, with no contract covering your data, no guaranteed UK or EU data residency, and no reliable way to stop the provider retaining what was typed in.

A business-grade, tenant-bound tool is different. Microsoft Copilot, used through a work account inside your Microsoft 365 tenant, operates inside your existing security boundary, respects the permissions already set on your files, and sits under Microsoft’s commercial terms rather than a consumer agreement. That structural difference, not the brand on the login screen, is what makes a tool safe or unsafe for client data.

The practical rule: nothing confidential goes into a personal or free AI account, ever. Governance is what tells staff which tools are which.

Where UK rules currently sit

The UK has no dedicated AI law equivalent to the EU’s AI Act. AI use is regulated instead through rules that already apply to your business: UK GDPR and the Data Protection Act 2018 govern any AI processing that touches personal data.

The ICO’s guidance on AI and data protection sets out what lawful, fair and transparent means in practice: a lawful basis, a record of what you are doing, and a data protection impact assessment where the use is likely to be high risk. The ICO notes on that page that the guidance is under review following changes made by the Data (Use and Access) Act, so expect it to be updated.

The Cyber Security and Resilience Bill completed its House of Lords third reading on 2 November 2026 and now returns to the Commons for consideration of the Lords amendments. At third reading, members agreed four government amendments, mainly tidying cross-references, including to the definition of a regulated person. That definition covers operators of essential services, digital service providers, managed service providers and critical suppliers, so the company that runs your IT sits explicitly within it. The Bill is not about AI, but it puts your IT provider inside a regulated security perimeter and tightens supplier due diligence generally. That is the same direction AI governance is travelling: written accountability for who is responsible for what.

One thing to be clear about. Firms regulated by the SRA, the FCA or any other body carry obligations of their own on confidentiality, record keeping and oversight. We do not advise on those obligations and nothing on this page makes a firm compliant with them. What we do is put the technical controls in place and give you the evidence of what they do, so that you and your advisers can make that judgement with something solid underneath it.

Building an AI acceptable use policy staff will actually follow

A policy nobody opens is worse than no policy, because it creates a false sense of control. A policy staff will follow is short and written in language a non-technical member of staff can act on. At minimum:

• The approved tools, named specifically, for example Microsoft Copilot on a work account, rather than a vague reference to “AI”.
• What must never go in: client-identifiable data, personal data, anything under a confidentiality clause.
• What is fine to use AI for: general drafting and research that does not touch confidential material.
• How to report a mistake, a blame-light route for when confidential data has already gone into the wrong tool.
• Who owns the policy, a named person, reviewed at least twice a year.

The technical controls that back up the policy

A policy only works if the controls do not rely on someone remembering it. Four matter most. Access control limits what an AI tool can see to what the signed-in user already has permission to see, enforced through Microsoft Entra ID for most businesses on Microsoft 365. Data loss prevention rules block sensitive information leaving through the wrong channel. Sensitivity labels tag a document as client confidential and travel with the file. Audit logging records who used which AI tool, when, and with what.

These sit alongside managed detection and response, our 24x7 monitoring service, and our broader cyber security services. AI governance extends the security posture you should already have. It is not a separate discipline bolted on.

Where governance fits on the AI Capability Ladder

Lanmark places every AI engagement on the AI Capability Ladder, our framework for how far a business has progressed with AI. Rung one, Productivity AI, covers everyday drafting in tools like Copilot or ChatGPT, working from general training rather than your own data. Exposure at that rung is limited to what a user pastes in.

From rung two, Knowledge AI, upward, where AI is connected to your own documents and can answer questions using them, governance stops being optional. An AI tool is only as safe as the permissions underneath it. That is why data governance gates every rung from two upward: no business should connect AI to its own knowledge base without access control, labelling and audit logging in place first.

Why Lanmark for AI governance and security

Most AI governance advice comes from generalist consultancies working from a policy template, with no way to enforce what they recommend. Our advice is backed by a live security operation rather than a slide deck.

Our 24x7x365 Managed Detection and Response service, with the security operations centre behind it, is priced for a smaller business, so the controls behind your AI policy are actually watched by analysts rather than just switched on. We hold Cyber Essentials. We are a Microsoft Direct Cloud Solution Provider, which matters here because Microsoft 365 Copilot’s governance controls, data loss prevention, sensitivity labels and audit logging are native to the same tenant we already manage for you.

Our sector experience sits mainly with law firms and financial services firms: see IT support for law firms and IT support for financial services. AI governance sits alongside our AI consultancy and generative AI consultancy work, on the same security-first foundation.

Book an AI readiness review

If you are not sure what your staff are putting into AI tools, that uncertainty is the risk. Our AI readiness review is an informal, no-obligation conversation covering governance and risk alongside technical readiness, with a team that also runs your security monitoring.

Book an AI readiness review, or call 020 7123 4910.