The questions people actually ask.
Straight answers on AI governance, accountability and control. Where regulation matters, the source and the date are shown so you can check it yourself. Where the position is still moving, this page says so.
22 questions, in five sections.
The rules, as they stand today.
Every statement below carries its instrument and its date. Nothing here is a legal opinion, and an organisation with a specific exposure should take advice on it.
Is there a UK AI Act?
No. There is no UK AI Act, and the government has not introduced a dedicated AI bill. That does not mean AI use is unregulated.
Existing data protection, employment, consumer, equality and sector-specific obligations can still apply to how an organisation builds and uses AI, enforced by the regulators that already supervise it.
On 14 September 2026 the Joint Committee on Human Rights, in its report Human Rights and the Regulation of AI, reported that the laws currently applying to AI in the UK do so mainly at the point of deployment, described the framework as fragmented and difficult to navigate, and called for a wide-ranging AI Bill and a single statutory regulator.
Source: Joint Committee on Human Rights report, 14 September 2026. Checked 11 October 2026
Does the EU AI Act apply to a UK company?
It can. Scope follows the activity, not the address.
The EU AI Act applies by where an AI system is placed on the market or used, rather than by where the company is registered. A UK organisation serving EU customers, operating EU entities or placing a system on the EU market may be in scope as a provider or as a deployer.
Source: Regulation (EU) 2024/1689. Checked 11 October 2026
What is Article 4, and does it apply now?
Article 4 is the AI literacy obligation, and it applies now.
It has applied to providers and deployers since 2 February 2025, and national authorities have supervised and enforced it since 2 August 2026. On 27 July 2026 it was amended. Providers and deployers must now take measures to support the development of AI literacy, rather than ensure a sufficient level of it. The Commission and Member States must now help organisations, particularly smaller ones, to meet it.
It is an obligation of means rather than of outcome. It asks for demonstrable, targeted effort, taking account of knowledge, experience, education, training and the context of use. It does not require an organisation to guarantee a particular level of AI literacy for every individual.
Which is why the response to it matters. Article 4 asks for measures that support literacy, not simply for training to be issued. A completion record shows that training was completed. It does not, on its own, show what somebody is capable of doing safely, and that is a separate question an organisation still has to answer for itself.
Source: Regulation (EU) 2024/1689, Article 4, as amended 27 July 2026. Checked 11 October 2026
When do the high-risk obligations apply?
2 December 2027 for stand-alone high-risk systems, and 2 August 2028 for embedded ones.
Article 50 transparency obligations have applied since 2 August 2026.
The deadline moved. The requirement did not. The Annex III uses are unchanged, and the systems being deployed today are the systems that will be in scope when those dates arrive.
Source: Regulation (EU) 2024/1689, Articles 50 and 113, as amended by Regulation (EU) 2026/1744. Checked 11 October 2026
What does the ICO require on AI and automated decision-making?
A statutory code of practice is coming, and it is not in force yet.
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, SI 2026/425, came into force on 12 May 2026. They require a code covering the processing of personal data in developing and using AI and automated decision-making, including children’s data. The duty now sits with the Information Commission, which took over the Information Commissioner’s functions on 30 September 2026. The ICO name is still in use.
No date has been set for the code. Once it is in force, courts and tribunals must take it into account where it is relevant, and so must the Information Commission when it carries out its functions.
Source: SI 2026/425, in force 12 May 2026. Checked 11 October 2026
Who is accountable, and for what.
The distinction that decides whether an organisation can answer a regulator, and the one most often missed.
Who is accountable when an AI agent makes a mistake?
Your organisation remains accountable for the decision to deploy and operate AI inside your business.
Legal responsibility can sit with several parties depending on the system, the use and the jurisdiction, and providers carry obligations of their own. None of that removes an organisation’s own accountability for what it chose to run.
The practical governance questions are narrower and harder. Who approved this use of AI. Who owns it in production. What evidence justified giving the person who built it that level of access. An organisation that cannot name a person against each of those three does not yet have an accountability model.
What is the difference between an AI policy and AI governance?
A policy states what people should do. Governance decides what they are permitted to do, and produces the evidence.
Most organisations have the first and describe it as the second. The gap shows the moment somebody senior asks who built a particular agent and on what authority.
How is AI governance different from responsible AI?
Responsible AI sets the principles. AI governance is the operating model that makes them hold at the point of use.
Fairness, transparency and accountability are positions an organisation takes. Governance is the intake process, the approval gate, the register, the named owner and the access decision that turn those positions into something evidenced.
Both are needed. Only one of them can be audited.
We are working towards ISO 42001. Do we still need a control system?
Yes, and the two are complementary rather than competing.
UKAS-accredited ISO/IEC 42001 certification is now available in the UK. UKAS announced the first accreditation, to BSI, on 15 January 2026.
ISO/IEC 42001 defines how an AI management system should be structured and operated. A control system is what makes those controls usable at the point where people actually build, approve and operate AI. An organisation can hold the certificate and still be unable to say who built an agent last week.
Source: UKAS, first AI management system accreditation, 15 January 2026. Checked 11 October 2026
Controlling who can build and use AI.
How permission is decided, what the Agent Passport® is, and what it is not.
What is AI agent governance?
It is the set of decisions determining which agents exist, who is permitted to build them, what they are allowed to reach, and who owns them once they are live.
It differs from general AI governance in one respect that matters. An agent takes actions rather than producing suggestions, so the control has to sit on the ability to act and on the scope of access granted, not only on the quality of the output.
How do you control who is allowed to build AI agents?
Through capability-based access. The Agent Passport® is an internal control classification with three earned levels.
Consumer is the universal floor: approved AI assistants and the agents shared with them, with no build rights. Practitioner can build simple agents with a no-code builder. Builder can build advanced agents, including ones that connect to other systems or act on their own. Each step needs the training for that tool, and every agent still needs evidence and approval before it is shared. In a Microsoft estate, that is Copilot at Level 1, Agent Builder at Level 2 and Copilot Studio at Level 3. The same pattern applies on other platforms.
Two appointed roles sit alongside the levels. A Business Owner is accountable for a use case in production. A Governance Approver signs off risk at the control gates.
It is not a certification, a qualification, a credential, a badge or a register of individuals. The client assesses its own people. Ambient Agent® installs the model.
Can employees build AI agents without IT approval?
In most organisations, yes. That is usually the finding rather than the risk.
Modern assistant platforms put agent building into the hands of anybody with a licence, by design. The question is not whether people can build. It is whether the organisation decided who should be able to, wrote that decision down, and can evidence it.
Where no decision was taken, the default is that everybody can build anything. Nobody chose that.
Do Microsoft Copilot agents need governance?
Yes, for the same reason as any other agent.
A Copilot agent can read, summarise and act on anything the person using it can reach. If the person who built it connected it with their own sign-in, it can reach what the builder can reach, for everyone who uses it. The governance questions are who was permitted to build it, what it can reach, who owns it in production, and whether its sharing can be evidenced.
This is a question about control and accountability, not about how many licences an organisation holds. Ambient Agent® is a member of the Microsoft AI Cloud Partner Program, and is technology agnostic in principle and Microsoft-fluent in practice.
Is this a software platform?
No. Enforcement runs through the tooling you already have.
The control model is applied at every governance gate and inside the existing approval workflow. There is nothing to license and nothing new to run, which is also why the system can be handed over and owned outright on completion.
What happens when the engagement ends?
The control system is owned and operated by your team.
Ambient Agent® exits when the control infrastructure is installed and there is evidence to justify scale. A Governance Retainer is available where an organisation wants continuing quarterly reviews and expansion, and it is optional.
How to tell whether you have a problem.
Three questions worth putting to your own estate before anybody external puts them to you.
What is shadow AI?
Shadow AI is any AI use inside an organisation that nobody formally approved, owns or records.
It is rarely deliberate. It is the ordinary result of capable tools arriving inside licences people already hold, faster than any approval process was designed to handle.
It matters because an unrecorded agent has no named owner, so nobody reviews what it reaches or what it shares, and nobody switches it off.
How many AI agents should we expect to find?
There is no reliable benchmark, and any supplier offering one is guessing.
What can be said is that the number is usually far higher than the organisation expects. One organisation looked inside its own tenant and found 1,224 AI agents. One hundred and nine had no recorded owner, and roughly nine in ten records held no sharing data, so nobody could evidence who could see what.
The count is found through administration reporting in the platforms already in use, not through a new tool.
What should we be able to evidence today?
Five things. In our experience, most organisations can produce two of them.
A current count of AI agents and assistants in the estate. A named owner for each one in production. A record of who approved each use and on what basis. What each agent can reach and who it shares with. What was required of the person who built it, before they were permitted to build.
If a regulator asked this afternoon, the distance between what could be produced and what should exist is the honest measure of where an organisation stands.
Price, time and who we are.
Full detail sits on the pricing page. These are the questions asked most often.
What does AI governance implementation cost in the UK?
Ambient Agent® publishes its prices rather than quoting on request.
The AI Control Diagnostic is £15,000 to £20,000 plus VAT over two weeks. The Control System Install is £75,000 to £150,000 plus VAT over six to twelve weeks. The Governance Retainer starts at £10,000 per month plus VAT.
Each is a complete piece of work at a complete price. No fee is credited or deducted against any later engagement.
How long does it take to install AI governance?
Two weeks for the Diagnostic. Six to twelve weeks for the Install.
The range is set by the number of business units and the complexity of the existing approval landscape.
Our founder, Brent Phillips, led a programme that reached live governance in six weeks, across more than ten business units, with more than £230,000 identified from a single intervention and more than 574 professionals capability-mapped.
What happens in an introduction?
A 30 minute conversation at no charge. We talk about where you are with AI, then show you a sample of the work: a Diagnostic report, the Agent Passport® or an approval record.
It is there to establish whether there is a problem worth solving and whether Ambient Agent® is the right organisation to solve it.
No price is discussed in a first conversation, because scope decides price and scope is not yet known. The prices themselves are published on the pricing page.
Who founded Ambient Agent®?
Ambient Agent Ltd was founded by Brent Phillips, following enterprise data and AI programmes inside large regulated organisations.
The control model comes out of practical work on AI adoption, workforce capability, governance and agent deployment, rather than from building a software product.
Ambient Agent Ltd is registered in England and Wales, company number 16396624, and is VAT registered under number 526 4965 62.
No question matches that. Try a different word, or ask us directly.
Still not sure where you stand?
The Self-Assessment turns these questions round and asks them of your own organisation.