Digital Transformation

AI Governance Framework Build for UK SMEs

August 28, 2026

Problem this solves

Operating AI with no formal usage policy or accountability

David Viney helps UK SMEs stand up proportionate AI governance without a committee, a dedicated department, or a six-figure budget. The work covers a plain-English acceptable use policy, a risk assessment process scaled to actual use cases, scenario-based staff training, and the appointment of a single named responsible person.

Experience

The standards tell you structure — not the controls

“Even the emerging standards have much more to say about how to structure AI governance than they do about the critical actions and technical controls to put in place. MASTER-AI ™ is not process theatre. It is the practical layer that sits on top of the standards — the actionable steps.”

— AI Governance for UK SMEs: What the Law Actually Requires

Judgement

Treat ISO 42001 as a destination, not day one

“full ISO/IEC 42001 certification is treated as a reference architecture to build toward proportionately rather than an immediate goal”

— AI Governance for UK SMEs: What the Law Actually Requires

Technique

Start your AI audit with the tools nobody approved

“Rollout follows a practical week-by-week sequence starting with an audit of AI tools already in use, including unapproved ones.”

— AI Governance for UK SMEs: What the Law Actually Requires

Judgement

Govern AI on four things done properly, not exhaustively

“Governance is built from four components done properly rather than exhaustively: a two-page acceptable use policy in plain English, a risk assessment process proportionate to use cases, scenario-based training, and a single named responsible person.”

— AI Governance for UK SMEs: What the Law Actually Requires

About this solution

Approach

Governance is built from four components done properly rather than exhaustively: a two-page acceptable use policy in plain English, a risk assessment process proportionate to use cases, scenario-based training, and a single named responsible person. Rollout follows a practical week-by-week sequence starting with an audit of AI tools already in use, including unapproved ones.

In practice

MASTER-AI ™ is a six-domain framework that maps the technical and organisational disciplines required to govern AI responsibly. It draws together the common threads in multi-jurisdictional laws and standards — including ISO 23894, ISO 27001, ISO 42001, the EU AI Act, the NIST AI RMF, and the UK's sector-based, pro-innovation approach.

Each of the six domain names forms the MASTER acronym — Model lifecycle, Algorithm explainability, Supply chain, Trusted data, Engaged humans, and Risk management — and together they feed into a central governance function, built on people, process, and technology, aligned to ISO/IEC 42001:2023, the world's first international standard for AI management systems.

Even the emerging standards have much more to say about how to structure AI governance than they do about the critical actions and technical controls to put in place. MASTER-AI ™ is not process theatre. It is the practical layer that sits on top of the standards — the actionable steps.

Scope and fit

Fits UK businesses with more than a handful of staff that use AI touching customers, employees, financial decisions, or personal data. For most SMEs the practical starting point is a lightweight risk register covering the five to ten most significant AI use cases; full ISO/IEC 42001 certification is treated as a reference architecture to build toward proportionately rather than an immediate goal.

Provider expertise

David Viney sits on the AIGAS AI Governance Framework Board advising on ISO/IEC 42001 compliance for the accounting profession, and works as a Fractional CIO advising mid-market businesses on AI adoption. He previously built one of the world's first Agentic AI Platforms - WPP Open - at the world's largest marketing company.