The Register Before the Review: Board Oversight of Shadow AI
UK boards are now less likely to be asked whether they have an AI policy than whether they can show where AI is actually used. That shift matters. Staff across finance, HR, sales and operations can adopt generative tools in days, often without procurement involvement. The result is shadow AI: a fragmented estate of trials, plug-ins and personal accounts that may touch client data, regulated information or critical services.
A policy tells people what should happen. A register shows what is happening. For directors, the practical response is a short, disciplined sprint that produces a one-page AI use register, named owners and a clear escalation route before a client audit, procurement review or regulator enquiry forces the issue.
Why the board needs a register, not another policy
Many UK firms already have acceptable-use policies, data protection policies and procurement thresholds. Shadow AI slips between them. A team may use a transcription tool for meeting notes; a manager may paste a contract into a public chatbot; a subsidiary may buy an AI feature embedded in existing software. Each decision can seem minor. Aggregated, they create data leakage, contractual and continuity risk.
The register is not an inventory for its own sake. It is evidence of oversight. It allows the board to see which tools are approved, which are tolerated under conditions and which must stop. It also gives internal audit, risk and compliance a common reference point. Where the firm is regulated, the register supports conversations with the FCA, PRA or ICO without pretending that every experiment was pre-approved.
The 180-minute board sprint
The aim is not a perfect census. It is a defensible first version with owners and decisions. The board or a delegated committee can run the sprint in three hours.
0–20 minutes: set the boundary. Agree what counts as AI use for the register. Include generative AI, embedded AI features in software, automated decision tools and third-party models used through APIs. Exclude trivial spell-check functions unless they process client data.
20–55 minutes: collect the estate. Ask each business unit to bring its known tools and known workarounds. Use a simple prompt: name the tool, the use case, the data involved and who relies on the output. Do not wait for a perfect central list. The gaps are part of the finding.
55–95 minutes: rank by sensitivity and impact. Score each entry on data sensitivity, client impact, regulatory relevance and dependence on a single vendor. This is not a technical risk assessment. It is a board-level triage that identifies where evidence is missing.
95–130 minutes: assign named owners. Every entry needs one accountable executive or senior manager. Shared ownership is not ownership. The owner confirms approval status, required controls and the next review date.
130–160 minutes: decide and escalate. Agree which tools are approved, which are conditionally tolerated and which are suspended pending review. Record the decision and the rationale. Escalate red flags immediately.
160–180 minutes: approve the register and the cadence. The board approves the one-page register as a living document. Set a quarterly refresh and a trigger-based review after any material change, such as a new client contract, a vendor breach or a regulatory enquiry.
A one-page register that survives scrutiny
The register should fit on one page at board level, with a more detailed annex held by management. The one-page version should show:
| Field | Purpose |
|---|---|
| Reference and tool | Unique identifier and product or model name |
| Use case | What the tool does and which team uses it |
| Named owner | Accountable executive or senior manager |
| Data classes | Personal data, client confidential, financial, regulated or public |
| Client and regulatory impact | High, medium or low, with a short reason |
| Approval status | Approved, conditional or suspended |
| Key controls | Contract, DPIA, human review, logging, training or access restriction |
| Review date | Next scheduled check |
The register should not become a catalogue of every experiment. Group low-risk uses where possible. Keep high-risk uses separate. The test is whether a director can explain the firm's AI exposure in five minutes without asking management for another slide.
Three red flags to escalate immediately
1. Client or personal data in a public tool without contractual cover. If staff are pasting client information, employee records or unpublished financial data into a consumer AI service, the board should not wait for the next quarterly review. The issue is not only data protection. It may breach client contracts and undermine the firm's security assurances.
2. Automated decisions affecting individuals without human review. AI used in recruitment, credit, pricing, claims or performance management can create legal and reputational exposure. The board should confirm that a person can understand, challenge and correct material decisions. Where required, a data protection impact assessment should be in place before scaling.
3. A critical service dependent on an unapproved AI vendor. Embedded AI in a payroll, trading, claims or customer platform can create concentration risk. If the vendor's terms are unclear, if exit arrangements are untested or if the tool cannot be switched off, the board should treat it as an operational resilience matter, not an IT experiment.
Making the register useful between meetings
A register only works if it changes behaviour. Management should report a small set of metrics to the board: number of registered tools, number of high-risk uses, overdue reviews, suspended tools and incidents. The board should ask whether owners have the authority and budget to remediate. Internal audit can test a sample of entries each year.
For investors and clients, the register is a useful assurance tool. It shows that the company is not claiming to have eliminated shadow AI, but can demonstrate that it knows where AI is used, who owns it and what happens next. That is a more credible position than a policy that nobody can evidence.
At 3HR plc, the boardroom test is simple: if the firm cannot produce a one-page register within three hours, it does not yet have control of shadow AI. It has a policy, and a gap.
