The Bank of England says firms do not have enough AI governance. In the firms I work with, the problem is usually the reverse.
Its September Systemic Risk Survey found 63 per cent of responding firms putting AI in their top five risks, citing a lack of controls and governance.[1] Both are true. Too many firms have none at all, but in those that have built something the problem is the opposite: so much detail nobody can use it. I suspect the second is making the first worse.
More thorough, harder to follow
And it is not only governance. Over the past year I have reviewed risk assessments, strategies, business cases and propositions across several clients and sectors, and they are the same: more thorough than five years ago, far harder to follow, and sometimes slower to complete than the thing they describe takes to build.
I am part of the cause. When I build something with AI it comes back more rigorous than anything I would have written alone, working through every exception and edge case where I once used judgement and left things out. A model has no reason to do that, so it all stays in.
Here is the part I find uncomfortable. I am currently spending half a day reviewing one spreadsheet built in Claude. I have thirty years in spreadsheets, slides and analysis and I am good at this. I can still work through it, but increasingly only with AI helping me read what AI produced.
That is new territory, and I doubt I am alone in it.
When guidance becomes the barrier
The same shows up in public documents. The UK government’s AI Risk Management Toolkit, published by DSIT in September, sets out nine risk categories and a multi-disciplinary team to run them, even for a meeting transcription tool.[2] And that is risk management alone, leaving out classification, provider or deployer status, and everything around it.
Now take a board that has not started. They look at that, decide it is a programme they cannot afford, and do nothing. They stay in the 63 per cent.
If nobody can complete a control, it is not really working as one.
We have spent years asking that AI models be explainable. We should ask the same of our own documents. When did you last read one of yours all the way through?
If you would like to talk through what proportionate AI governance might look like for your organisation, you can read more about our services or get in touch; I would be glad to hear from you.
This article was first shared as a post on LinkedIn.
Sources
- Bank of England, Systemic Risk Survey Results – 2026 H2, published 30 September 2026.
- Department for Science, Innovation and Technology, AI Risk Management Toolkit, published 8 September 2026.