AI governance for UK SMEs: the audit question small firms cannot answer

Grant Thornton's 2026 AI Impact Survey found that 78% of nearly 1,000 senior business leaders are not fully confident their organisation could pass an independent AI governance audit within 90 days. It's a US survey, published April 2026, and we don't have equivalent UK numbers. For a UK firm of 5 to 50 people, the gap is probably wider still, not because the risks are greater, but because nobody has written anything down.

That gap matters more than it used to.

What the audit question actually means

An AI governance audit is not, at small-business scale, a room full of compliance officers working through a 200-point checklist. It is a much simpler test: if someone external asked you to account for how AI is being used in your business, could you answer them?

For most small firms using AI today, the honest answer is no. Not because the tools are dangerous or the use is reckless, but because it happened informally. A staff member started using ChatGPT to draft client emails. Someone found a tool that summarises long documents in seconds. The owner started using an AI assistant to turn meeting notes into action points. None of it was prohibited. None of it was reviewed. This informal spread is what the post on shadow AI in small businesses covers - and the two pieces are genuinely complementary: shadow AI is the supply side of the problem, governance is what you build to manage it once it is visible.

The result is that a firm can be running a meaningful proportion of its routine work through AI - touching client correspondence, financial data, and professional judgement - without a single record of which tasks, which tools, or which people are involved. That is the governance gap, and it is entirely common.

The four things worth documenting

Governance for a small professional services firm does not need to be complex. In practice it comes down to four questions. Answering them on a single page is enough.

Which decisions does AI touch?

Not every use of AI is a decision, but some are. If AI is drafting a recommendation letter, reviewing a contract clause, summarising financial information before a client call, or producing a report that goes out under a professional's name - those are consequential outputs. A one-line entry per workflow is sufficient: what the AI is used for, and at what point a human reviews the result.

What data goes in?

This is where the liability starts. Client names, financial figures, case details, unreleased pricing, health information - all of these have different handling requirements under UK GDPR, and some are specifically protected. Feeding them into a free-tier AI account with no data processing agreement in place is a breach waiting to be logged rather than discovered.

You do not need to ban the tools. You need to know which categories of data your team is putting into them, and whether the provider's terms allow it.

Who signs off the output?

AI produces confident-sounding text. It also gets things wrong, hallucinates citations, and misses context that a professional would catch in thirty seconds. The question is not whether a human reviews the output - presumably they do - but whether that review is explicit and recorded for anything consequential.

For most firms, a one-line note in the file is enough: "Draft produced with AI assistance, reviewed and approved by [name] on [date]." That is not bureaucracy. It is the kind of record that protects you if a client later questions the work.

How do you catch and correct errors?

Every AI system makes mistakes. The governance question is whether you have a way to find them and a way to fix them. In practice this usually means a short review step built into the workflow - not a separate audit process, just a check that is written down rather than assumed.

Why "only 18% measure ROI" is the same gap

Thomson Reuters research published in May 2026 found that around 40% of professional services firms are using generative AI, but only around 18% are measuring what they are getting from it. The same research found that roughly half of those firms see AI as a liability threat.

The 18% figure and the governance gap are the same problem. If you are not measuring what AI does for your business, you almost certainly have no record of which processes it touches - and you cannot measure return on something you have not mapped.

This creates an odd position: the firm that cannot quantify its AI ROI is also the firm that cannot demonstrate its AI is governed. The steps that fix one fix both. Mapping the use, setting a short review process, recording the output - those are the same actions whether you frame them as measurement or governance.

The ICAEW has been developing guidance under its PCRT (Professional Conduct in Relation to Taxation) framework, presented at Accountex in May 2026, specifically addressing how AI use interacts with professional conduct obligations for accountants. Similar questions are live in the legal sector. Regulated professionals using AI without any documentation of their review process are in a position that their professional bodies are beginning to scrutinise.

A lightweight governance note that is not a policy document

The answer to this is not a 40-page AI policy. It is a one-page note, reviewed once a year, that your team has actually read. Five short sections cover everything a small professional services firm needs:

• Scope. Which parts of the business this covers and which people it applies to.
• Approved tools. Which AI tools you have sanctioned, what they are used for, and what categories of data can and cannot go into each.
• Review process. For consequential outputs - client-facing documents, financial summaries, professional recommendations - who reviews the AI output before it goes out, and what that review involves.
• Data line. What client or business data cannot be put into AI tools without explicit sign-off, and how to seek that sign-off when there is a genuine case for it.
• Error handling. What to do when something goes wrong - who to tell and how to log it.

That document is not a compliance exercise. It is a reference sheet your staff can actually use. It also happens to be the thing you would produce if someone asked you to pass an audit.

The firms that are furthest ahead on this are not the ones with the most sophisticated AI tools. They are the ones that mapped their usage before they scaled it - so when a question comes from a regulator, a client, or their own professional body, they have something concrete to show. The AI readiness checklist for UK small businesses is a useful companion document here - it covers the baseline conditions (data practices, process maturity, team readiness) that governance also depends on.

The step most small firms have not taken

Most small professional services firms in 2026 are somewhere between "nobody is using AI officially" and "everybody is using it but nothing is written down." Very few have a clear picture of which workflows AI touches, what data moves through those workflows, and who is accountable for the output.

That picture does not take long to build, but it does require a structured starting point - a conversation that maps the actual usage, not the theoretical one, and produces a plain-English record of where AI sits in the business.

A HoursBack Assessment does exactly that. A 60-minute conversation, a structured report within two working days, and a five-day plan that covers the quick wins and the risk areas in plain English. If governance documentation is relevant for your firm, the report includes it. £799.

If you want to start with something quicker, the free AI Readiness Quiz gives you a rough read on where your business stands in two minutes.