Govern: how to prove an AI assistant stayed safe, not just claim it

Most published AI principles are indistinguishable from each other. Safety, fairness, transparency, accountability — nobody disagrees. The difference between an organisation that means it and one that does not is whether anything is recorded when the principle is tested.

Four questions governance has to answer

1. What did the assistant do, and on what basis? A recommendation with no traceable reasoning cannot be reviewed.
2. Who is accountable for that class of decision, by name or role? 'The system' is not an accountable party.
3. What would have stopped it? Thresholds, refusals and escalation routes must exist before the incident, not after.
4. How would we know it went wrong? Someone has to look, on a schedule, at cases nobody complained about.

Log the events that matter, not everything

Logging every token is both a privacy liability and useless in review. Log governance events: a recommendation issued, a refusal, a safeguarding escalation, a consent change, a memory write or deletion, a human override. Each with a timestamp, the rule invoked, and the outcome. That set is small enough to read and specific enough to defend.

The UK context

The UK has no single AI act. Instead, existing law applies: UK GDPR and the Data Protection Act 2018 for personal data, the Equality Act 2010 for discrimination, sector regulators for sector risk, and the cross-sector principles set out in the government's pro-innovation approach — safety and robustness, transparency and explainability, fairness, accountability and governance, and contestability and redress.

Practically, that means your evidence has to be organised by principle rather than by product. A regulator will not ask which model you used; they will ask who was accountable, what you assessed, and what a person can do if they disagree with the outcome.

A governance minimum you can stand up this month

• A one-page AI use policy naming what is permitted, what is prohibited and who decides.
• A named accountable owner for each AI-supported decision type.
• An incident log — even a spreadsheet — with date, what happened, impact and action taken.
• A short DPIA for anything touching personal data, children's data or significant decisions.
• A monthly review of overrides, refusals and escalations.