Short answer
Good AI governance names the workflow, classifies the data, checks the supplier, defines human review, records evidence, assigns ownership and gives staff a clear route for questions or exceptions.
Start with where AI is already being used
Most firms already have some level of shadow AI. Staff may be using public tools for summaries, drafting, research, meeting notes or admin. The first governance step is to understand current behaviour without turning the exercise into a witch hunt. Ask which tools are being used, what data goes in, what outputs are relied on and where managers already feel uneasy.
Set the FCA, SRA or professional-body context
Regulated firms should connect AI use to existing duties around client outcomes, confidentiality, competence, records and oversight. The checklist does not replace FCA, SRA, ICAEW, ACCA or internal compliance guidance. It gives the firm an operating layer: which workflows need approval, what evidence is kept, who reviews outputs and what happens when a tool produces a poor answer.
Define acceptable and prohibited use
Teams need plain examples of what is allowed, what needs approval and what is prohibited. The guidance should mention client-identifiable data, confidential documents, legal privilege, regulated advice, personal data, contracts, credentials and commercially sensitive information. Staff should not have to guess whether a use case is safe.
Check suppliers before data is connected
Supplier review should cover where data is processed, whether prompts or files are used for model training, retention, access controls, audit logs, security terms, sub-processors and exit options. For sensitive workflows, do not rely on a sales page or a verbal assurance. Keep a short approval record that a partner, director or compliance owner can understand later.
Make human review explicit
Human-in-the-loop is only useful if the person knows what they are reviewing. Define which outputs must be checked, what examples are used for testing, what errors should be escalated and when the AI output must not be used. Review should be stricter where advice, client communications, legal judgement, financial recommendations or compliance evidence are involved.
Create evidence as the workflow runs
Governance becomes much easier when the workflow records purpose, owner, data type, tool, reviewer, decision and exceptions. Accountancy teams may need evidence for review quality and deadlines. Legal teams may need confidentiality and privilege controls. Financial advice and insurance firms may need clear oversight and client outcome evidence. Build the record into the process rather than asking staff to recreate it later.