Responsible AI for organisations without a compliance department

01

The business problem

AI tools enter most organisations from the bottom up. Someone uses an assistant to draft a letter, it saves an hour, and within a few weeks it is part of how the team works — with no policy, no record of what data has been shared and no agreement on who checks the output.

The exposure is rarely dramatic. It is personal data pasted into a tool with unclear retention terms, or a decision affecting a client that nobody can now explain.

02

Context

Organisations without a compliance function often assume responsible AI means a heavy framework. In practice, a small number of controls covers most of the realistic risk, and they can be written in a few pages.

The aim is not to slow adoption down. It is to make the useful work defensible.

03

Options and recommended approach

A proportionate set of controls

1. 1

   Write an acceptable-use position

   State plainly what may and may not be entered into AI tools, particularly personal, sensitive, client or commercially confidential information, and which tools are approved.

2. 2

   Name a human reviewer for each use

   Every AI-assisted output that reaches a client, funder or regulator should have a named person accountable for reviewing it before it is used.

3. 3

   Keep a short register of AI uses

   One line per use: what it does, what data it touches, who owns it and what happens if it is wrong. This is the document that makes every other conversation possible.

4. 4

   Check the data protection position of each tool

   Hosting location, retention, whether inputs train the model, sub-processors and UK GDPR terms. Record the answers next to the register entry.

5. 5

   Decide where AI must not be used

   Typically decisions about individuals — eligibility, safeguarding, employment — without meaningful human involvement.

6. 6

   Review quarterly

   Tools and terms change quickly. A short scheduled review keeps the register honest.

04

Practical use case

A charity of about twenty staff was using an AI assistant to summarise casework notes. The work was genuinely useful, but the notes contained personal data and nobody had checked the provider's retention terms.

The response was not to ban the tool. It was a one-page acceptable-use position, a named reviewer for anything leaving the organisation, a register entry recording the data involved, and a documented check of the provider's processing terms. The team kept the time saving and could explain the arrangement to their funder.

05

Benefits

• Staff know what is allowed, so shadow usage falls
• Questions from funders, boards or clients can be answered from a document rather than from memory
• Risk is concentrated where it is actually material, rather than spread thinly across a long policy
• Adoption continues rather than stalling on uncertainty

06

Limitations and risks

• Governance documents that are not reviewed become misleading within months
• A register is only as good as the honesty of what staff report using
• Proportionate controls are not a substitute for specialist legal, data protection or cyber security advice where the risk is significant
• Provider terms change without notice; the position recorded today may not hold at renewal

07

Responsible AI and data considerations

Three questions do most of the work when assessing any individual use: what would happen if the output were wrong, who would notice, and could the organisation explain the decision to the person affected by it.

Where the answer to any of those is uncomfortable, the use needs either stronger human involvement or a different approach.

08

Conclusion

Responsible AI in a small organisation is not a framework exercise. It is a short written position, a named person, an honest register and a date in the diary to look at it again.