- 75% of UK businesses are operating without any formal written AI governance policy
- Nearly half (46%) of business leaders are unaware they are legally liable for third-party AI tools under the EU AI Act
- Compliance is a massive time drain: 58% spend over 10 hours on a single AI audit
Startups.co.uk’s latest survey reveals that 75% of UK businesses operate without a formal written AI governance policy, while 30% have no plans to implement one.
This lack of governance leaves employees using AI tools without clear boundaries on data privacy, acceptable use or quality control.
AI adoption is outpacing governance
As AI becomes increasingly integrated into daily business operations, many SMEs appear to be adopting the technology faster than they areimplementing policies to manage its use.
Although 27% of businesses have informal AI guidelines in place, these do not provide the same level of structure, accountability or legal protectionof a formal corporate policy.
Without clear boundaries on acceptable use, data privacy and employee responsibilities, businesses are effectively leaving their compliance to chance.
Leaders unaware of UK/EU AI Act liability
The rush to adopt AI has created a dangerous compliance gap.
According to the data, nearly half of UK business leaders (46%) admitted they have no idea they could be held legally accountable for the integrity and ethical output of third-party AI models used within their organization.
A startup only needs to have one client inside of the EU for the EU AI Act to apply to them.
This widespread lack of awareness means hundreds of UK SMBs are putting themselves at risk of significant fines, the maximum penalty being up to €35 Million or 7% of global turnover.
Compliance remains resource intensive
For businesses taking steps to fix this governance gap, compliance is proving to require a significant amount of company time.
Among SMEs that completed an AI audit in the last quarter, 58% spent more than 10 hours on the process.
This highlights the challenge many businesses face in balancing rapid AI adoption with the time and resources needed to ensure responsible use of the technology.
What does UK regulation say about AI governance?
While there is no single “AI Act,” accountability is being aggressively enforced through a web of existing regulators (FCA, ICO, CMA). The government’s AI mandate is clear: your AI must prove Safety, Transparency, Fairness, Accountability, and Contestability.
Because these rules are fragmented across different regulators, businesses are unknowingly operating outside the lines, vulnerable to unexpected penalties and catastrophic reputational hits.
To satisfy regulators, secure data boundaries must be a foundational part of a startup’s AI strategy, not an afterthought.
Editor of Startups.co.uk, Zohra Huda, comments:
“UK startups are currently operating with a huge compliance blind spot – our data reveals that an alarming three-quarters of small businesses have no formal AI policy. More dangerous is that nearly half of founders have no idea they are legally on the hook for third-party software under the EU AI Act. In these lean times, you cannot afford to leave compliance to chance. With multi-million penalties hanging over anyone with just one client in Europe, rigid data boundaries aren’t just admin any more, but basic business survival.”
