Do you need AI governance software, or is an adviser enough?

What does AI governance software do, and what does an adviser do?

AI governance software is mostly a technical tool, and an adviser mostly offers consulting, advice and training. UK government research found that AI assurance suppliers provide two main groups of products and services. The first is consulting, advisory, training or procedural services and tools. The second is technical tools used to assess AI systems.

AI assurance can be done by the firm that builds an AI system, by the firm that uses it, or by a third-party provider. Third-party providers check AI systems independently, and serve firms that may lack this capability in house.

On this site, 27 of the 140 providers are software products. Each profile records what the product does, and whether it publishes a price.

Who is responsible if you use software or an adviser?

Your organisation is responsible, whoever helps you. Under UK data protection law, the accountability principle makes you responsible for complying. It also makes you responsible for showing that you comply, in any AI system that uses personal data. The ICO says you cannot hand these issues to data scientists or engineering teams.

Your senior management, including any data protection officer, are accountable for understanding and dealing with these issues.

If you buy an AI tool or outsource the work, the ICO expects you to judge its trade-offs yourself. That is part of your checks before you buy. It also expects you to set out what you need at the buying stage, not afterwards.

Once a service is running, review it regularly. Be ready to change it, or switch provider, if it no longer complies.

We only use tools such as ChatGPT. Do we need governance software?

A firm that only uses tools such as ChatGPT has duties that are mostly about people, not software. If the EU AI Act reaches your firm, what it asks of a firm that uses AI is mostly about people. You must take steps to support the AI literacy of your staff, and of others who use AI on your behalf.

If you use high-risk AI, the Act asks for people more than products. You must give human oversight to people with the right competence, training and authority. You must also use the system as its instructions say.

Whether the Act reaches you at all is set out in our guide to the EU AI Act.

How can you judge AI governance software or an adviser?

Judging AI governance software or an adviser is hard, because the market is young. UK government research says the quality of the tools and services on offer is not clear. It also says not all assurance tools are effective in reducing risk.

The market is also large and mostly small firms. UK government research estimated 524 firms supplying AI assurance goods and services in the UK, including 84 specialised AI assurance companies. 60% of suppliers are small and medium-sized firms.

There are no fully active certification schemes for AI assurance in the UK yet. Certifications of a person's skill in AI assurance exist, but their quality is hard to judge, and none come from a UKAS-accredited organisation.

Providers differ by size. Larger providers tend to offer a full audit across the life of an AI system, with tailored recommendations. Smaller ones tend to offer lighter governance audits.

So start with what you need, and write it down before you buy. The ICO expects requirements at the buying stage, which gives you a list to test any tool or adviser against.

Some advisers also sell software. Each adviser on this site is scored on its independence from what it sells, and you can compare them side by side on the compare page.

What can you use from the regulator and the government?

The regulator, the ICO, publishes an AI and data protection risk toolkit. It is designed to help organisations reduce the risks their own AI systems pose to people's rights. It is a spreadsheet that opens in Microsoft Excel or a similar program.

The ICO's AI guidance is under review, because of changes made by the UK's Data (Use and Access) Act.

The government built a self-assessment tool, AI Management Essentials, to help businesses set up good AI governance. It will not publish it. It plans simpler guidance on the basic steps, aimed at small and medium-sized firms.

The ICO’s free AI risk toolkit

What do AI engines cite on AI governance software?

AI engines cite few official sources on AI governance software. On 18 September 2026, The Assurance Desk asked six AI engines seven questions about AI governance in the UK. The 42 answers cited 404 links from 209 websites, and 13 of those links were official.

One question was “do we need a separate ai governance tool if we already have a compliance platform”. It got 6 answers with 54 links, and none of those answers cited an official source.

We asked each question once, from the UK, with web search on. AI answers change from day to day, so a later run can give different sources.

What to do

1. List the AI your firm builds or uses, including tools staff use at work such as ChatGPT.
2. Write down what you need before you buy software or hire an adviser. The ICO expects requirements at the buying stage.
3. Agree who in senior management is accountable for AI. The ICO says these issues cannot be left to data scientists or engineering teams.
4. Use a data protection impact assessment to show how you handle the risks of AI that uses personal data.
5. Review any outsourced service regularly, and be ready to switch provider.

Common questions

Which is the best AI governance platform in the UK?

The Assurance Desk does not name a best platform. It scores each software product on the same criteria, one score for each, with no overall winner. You can compare them on the compare page.

Do we need a separate AI governance tool if we already have a compliance platform?

It depends on what you need it to do. Write that down first: the ICO expects requirements at the buying stage. Then check what your current platform covers against that list.

Is there a qualification for AI governance?

Certifications of a person's skill in AI assurance exist. UK government research says their quality is hard to judge, and none come from a UKAS-accredited organisation.

Who should own AI governance: security, legal or IT?

Senior management, including any data protection officer, are accountable under UK data protection law. The ICO says these issues cannot be left to data scientists or engineering teams.

Where next

• Exposed to the EU AI Act
• Does your UK business need an AI policy, and what goes in it?
• How does the UK regulate AI?
• What does the EU AI Act ask of a UK business?
• How do I choose a data protection or AI governance adviser?
• What to ask an AI supplier before you buy

This is an independent editorial guide, not legal advice.