Topic guide
AI governance and data strategy: the frameworks, the standard, and the people to run them
How UK organisations govern AI and set data strategy: risk frameworks, the funded Level 4 standard behind the work, and the workforce capability that makes policy stick.
By James Cotton · Last updated
AI governance is how an organisation decides what its AI systems are allowed to do, who is accountable when they act, and how that is proven to a regulator or a board. It is the difference between an AI policy that sits in a slide deck and controls that actually hold when an agentic system starts making decisions on its own.
Governance rarely stands alone. The same capability underpins data strategy: knowing which data an organisation holds, what it is allowed to do with it, and how it turns that into a decision advantage. iO-Sphere runs one programme on the funded standard (the Level 4 Data Protection & Information Governance Practitioner standard): Data & AI Governance, for the people who run data governance, data quality and data protection, with AI governance built in.
This topic gathers the guides we publish on governing AI at mid-market scale, the frameworks and standards involved, and (the part most governance programmes miss) the workforce capability needed to run any of it. Policy without trained people is where governance quietly fails.
In this topic
GuideAI Tool Due Diligence in the UK: Is the Supplier's Word Enough?No: the regulator expects UK buyers to check an AI tool for themselves. What to specify, test and put in the contract, and the questions to send the supplier.GuideWhat Is Information Governance? One Record's Life Under UK RulesWhat information governance means for UK organisations: the decisions a record needs at each stage of its life, the rules behind them, and who must make them.GuideAI Governance Training in London: From a Half Day to Fifteen Months, and How to Choose by LengthAI governance courses open to London teams, ordered by length with prices and next dates, from a half-day online module to the funded Level 4 apprenticeship.GuideWhat Is a Data and AI Strategy? Do You Need a Separate AI Strategy, and Who Should Write ItWhat is a data and AI strategy? The decisions it records, why one strategy beats two, what UK guidance asked for, and who in your organisation should write it.GuideWhat the Board Should Ask About AI: One Board Paper, Read From the Chair's SeatWhat should a UK board ask before it approves an AI tool? One board paper read against the FRC guidance, the Companies Act and the 2026 papers for boards.GuideAI Governance Certifications and Courses in the UK, Compared by the Role You Are TrainingAIGP, ISO 42001 lead auditor and implementer, ISACA, CGI and university AI governance courses in the UK, compared by the role you are training, prices as shown.GuideAI in Recruitment and HR Decisions: The UK Rules in 2026, and What a People Team Must DoArticles 22A to 22D, the ICO recruitment report and its cases, the Equality Act and the EU AI Act: what UK rules require when AI screens or scores people.GuideWhat Is Data Governance? A Plain Definition for a UK Business, and How It Differs from Data Protection and AI GovernanceData governance defined by DAMA, ISO and the UK government roles model, how it differs from data protection and AI governance, and how a UK team learns it.GuideAI Governance for a Business: What UK Governance Sources Ask of Boards and Senior ManagementWhere governance sources name AI, for UK firms: FRC guidance on material controls, the data regulator's AI audit toolkit, a cyber code and two ISO standards.GuideIs AI Literacy Training Required in the UK? The Law, and What Training Should CoverWe found no UK law requiring AI literacy training as at 2 October 2026. When the EU AI Act still reaches a UK business, and what staff training should cover.GuideAI Regulation in the UK 2026: What Applies to Your BusinessThere is no UK AI Act. A UK business using AI in 2026 answers to data protection, equality and consumer law, and the EU AI Act where its output is used there.GuideData Strategy Training for Managers: What a Course Should CoverWhat data strategy means for a manager, ten questions to ask of any course, data strategy and AI strategy courses with prices, and the 2026 funding changes.GuideA Generative AI Policy for Staff: What It Needs to ContainWhat a staff generative AI policy needs to contain: approved tools, what stays out of a prompt, who checks output, and the training that makes the rules work.GuideBuild or Buy AI Governance CapabilityGrow AI-governance capability or hire it in? What ICO guidance lets you contract out, what CIPD says hiring costs, and how to read the clock before choosing a route.GuideHow a UK Small Business Can Govern AI Without a Compliance TeamHow a UK SME governs AI with no compliance team: find where AI is used, who would notice a bad output and what it would cost. Plus the funded route, ST0967.GuideAI Governance in Marketing and Operations TeamsFour points where AI output in marketing and operations reaches a customer or a process, the CMA, ASA and ICO rules already in force, and who holds the check.GuideAI Governance in UK Financial Services and HealthcareWhat the FCA, PRA, MHRA and ICO have said about AI in UK financial services and healthcare, and the questions a supervisor will put to your accountable people.GuideData & AI Skills for People & HR TeamsAI now sits in hiring, L&D, people analytics and workforce planning. The skill a people team needs is judging where it helps and where a person must decide.GuideData Protection and Information Governance Apprenticeship (ST0967)ST0967, the Level 4 Data Protection and Information Governance Practitioner: the version 2.0 standard, £10,000 band, duties and assessment, for employers.GuideAI Governance Careers in the UK: Roles, Pay and How to Get InA real map of AI-governance careers in the UK: the roles by the decisions they carry, what each tends to pay, the roles people arrive from, and the funded route in (ST0967). Titles are not standardised, so you read the field by scope, not job label.GuideAI Governance Course UK: How to Choose the Right OneHow to choose an AI governance course in the UK by the capability it builds: what a short course, a funded Level 4 apprenticeship and a self-directed start each deliver, who each one suits, and where the funding fits.GuideAI Governance Framework UK: The Components It NeedsWhat an AI governance framework in the UK actually needs: risk tiering, a human checkpoint, an audit trail and a named owner. Each is really a capability requirement, and the people who can run the framework decide whether it governs anything.GuideAI Governance Officer Role: What It Is and the Route InWhat an AI governance officer actually is: the coordinating owner who makes sure every place AI touches a decision has someone accountable, and who can judge what the AI produced. There is no settled ladder; the capability is grown from people in compliance, data, risk and operations.GuideData Governance Career Progression in the UKHow a data-governance career actually advances in the UK: measured in the scope of judgment you are trusted with, and the funded route to grow into the field.GuideFunded Data Governance Training UK: Routes & RulesFunded data governance training in the UK, decided outcomes-first: whether it is free, how the Growth & Skills Levy pays for it, which funded standard covers data and AI governance (ST0967), and how to choose the route by the capability you need.GuideWho Is Responsible for AI Governance? A UK GuideResponsibility for AI governance in a UK organisation is distributed across the board, function and data owners, and everyone who uses AI. Naming those owners is the easy half; the half that governs anything is having people who can validate what the AI produced.GlossaryAI governanceAI governance is the set of policies, roles and controls an organisation uses to keep its AI use safe, compliant and accountable. Here's what it covers and how it works.GlossaryAI risk assessmentAI risk assessment is the structured process of identifying, weighing and controlling the risks an AI system could create before and after it goes live.GlossaryData governanceData governance is the set of rules, roles and processes that control how an organisation collects, stores, uses and protects its data. Learn how it works.GlossaryData protectionData protection is the law and practice that governs how organisations collect, use and store personal information. Here's what it covers and why the skills behind it are in demand.GlossaryEU AI ActThe EU AI Act is the EU's risk-based AI law. Learn what it covers, its rollout timeline, and when it can bind UK employers.GlossaryInformation governanceInformation governance is how an organisation manages information as an asset: its policies, roles and controls for accuracy, security and lawful use. Learn what it covers and why it matters.GlossaryResponsible AIResponsible AI is the practice of designing, deploying and governing AI systems so they are fair, transparent, safe and accountable. Here's what it covers and why it's now a business skill.GuideExecutive AI Programmes for Non-Technical Leaders (UK)How to choose an executive AI programme for non-technical leaders: the one test that sorts a decision-useful programme from a box-ticking one, the criteria to judge any provider on, which format fits your situation, and how the levy funds it.GuideHow Companies Govern Agentic AIHow to govern agentic AI in practice: describe the workflow and its decision points, define what correct looks like, build an audit trail and keep a human in the loop before an agent runs it, then build the people who can do that describing.GuideWhat Is AI Governance? UK Principles and PoliciesWhat is AI governance? A plain UK definition: where AI is used, who answers for it and how errors are fixed, plus the UK and OECD principles and policies.