Workshop · For boards, legal, risk and compliance
The risks and harms of AI, the rules that now apply, and the governance framework that lets you move quickly without losing control.
Risks and harms
We take each one through real incidents, how likely it is in your business, and the controls that address it.
Regulation and standards
The EU AI Act's risk tiers: prohibited practices, high-risk systems (such as hiring and credit), transparency duties for chatbots and generated content, and rules for general-purpose models. Obligations phase in from 2025 to 2027 and reach UK firms that sell into the EU. GDPR still applies to every use of personal data.
A principles-based approach applied by existing regulators: the ICO on data protection and automated decisions, the FCA for financial services, the CMA on competition and consumers. UK GDPR, the Equality Act and sector rules apply now.
A patchwork of state laws (such as Colorado's AI Act and New York City's rules on hiring tools), federal agencies applying existing consumer, employment and health law, and sector rules such as HIPAA.
The governance framework
Light controls for low-risk productivity tools; full review for AI that affects customers, employees or money. The framework is practical enough to run monthly.
A short acceptable-use policy and the principles behind it.
Board accountability, an AI steering group and a named owner for every system.
Every tool and use case recorded and rated low, medium or high.
Data protection and AI impact assessments for higher-risk uses.
Due diligence questions and contract terms for AI suppliers: data use, liability, IP and exit.
Levels of autonomy, and when a human must be in, on or out of the loop.
Telling customers and staff when AI is used, including AI explainability statements.
Measuring quality over time, and a plan for when something goes wrong.
The agenda
What has changed, what boards are being asked, and recent incidents.
The ten risks, each with real cases and the questions to ask of your own AI.
The EU AI Act, the UK approach, US state and sector rules, and ISO 42001 and NIST, mapped to where you operate.
The eight building blocks, including agents and vendor contracts, and how to run them without slowing the business.
In small groups, take your real tools and use cases, rate each for risk, and agree the controls each one needs.
The questions directors should ask, and a 90-day plan.
Built on our work with the World Economic Forum on AI leadership, and on the first AI explainability statements reviewed by the UK Information Commissioner's Office, delivered with Best Practice AI.
Best Practice AI →