# Do you need AI governance software, or is an adviser enough? Knowing what each one does helps you buy the help you need, and only that. The Assurance Desk. Published 5 October 2026. Last checked 7 October 2026. **The short answer.** AI governance software and advisers do different jobs. UK government research splits the AI assurance market into two groups: consulting, advisory and training services, and technical tools that assess AI systems. Whichever you use, UK data protection law keeps your organisation responsible ([GOV.UK, Assuring a Responsible Future for AI](https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai) and [ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). ## In this series - [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy.md) ## What does AI governance software do, and what does an adviser do? AI governance software is mostly a technical tool, and an adviser mostly offers consulting, advice and training. UK government research found that AI assurance suppliers provide two main groups of products and services. The first is consulting, advisory, training or procedural services and tools. The second is technical tools used to assess AI systems ([GOV.UK, Assuring a Responsible Future for AI](https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai), checked 5 October 2026). AI assurance can be done by the firm that builds an AI system, by the firm that uses it, or by a third-party provider. Third-party providers check AI systems independently, and serve firms that may lack this capability in house ([GOV.UK, Trusted third-party AI assurance roadmap](https://www.gov.uk/government/publications/trusted-third-party-ai-assurance-roadmap/trusted-third-party-ai-assurance-roadmap), checked 5 October 2026). On this site, 27 of the 140 providers are software products. Each profile records what the product does, and whether it publishes a price. **Software and advisers, side by side** - **AI governance software** - A technical tool that assesses AI systems - Keeps an inventory of your AI systems - Tests AI for bias, safety and security risks - Maps your AI to the EU AI Act, the NIST AI RMF and ISO 42001 - **An AI governance adviser** - Consulting, advice and training - Helps you build an AI management system to ISO 42001 - Runs AI risk and impact assessments - Aligns your programme with the EU AI Act, ISO/IEC 42001 and the NIST AI RMF What two software products and two advisers say they offer, from The Assurance Desk's provider records. Source: GOV.UK, Assuring a Responsible Future for AI, https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai (checked 5 October 2026); The Assurance Desk, Credo AI profile, https://theassurancedesk.com/advisers/credo-ai (checked 5 October 2026); The Assurance Desk, Holistic AI profile, https://theassurancedesk.com/advisers/holistic-ai (checked 5 October 2026); The Assurance Desk, Accorian (Esha Corporation dba Accorian; Accorian Assurance) profile, https://theassurancedesk.com/advisers/accorian (checked 5 October 2026); The Assurance Desk, BD Emerson LLC profile, https://theassurancedesk.com/advisers/bd-emerson (checked 5 October 2026) ## Who is responsible if you use software or an adviser? Your organisation is responsible, whoever helps you. Under UK data protection law, the accountability principle makes you responsible for complying. It also makes you responsible for showing that you comply, in any AI system that uses personal data. The ICO says you cannot hand these issues to data scientists or engineering teams ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). Your senior management, including any data protection officer, are accountable for understanding and dealing with these issues ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). If you buy an AI tool or outsource the work, the ICO expects you to judge its trade-offs yourself. That is part of your checks before you buy. It also expects you to set out what you need at the buying stage, not afterwards ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). Once a service is running, review it regularly. Be ready to change it, or switch provider, if it no longer complies ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). > "You cannot delegate these issues to data scientists or engineering teams." > ICO, AI accountability guidance > ICO, What are the accountability and governance implications of AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 5 October 2026) ## We only use tools such as ChatGPT. Do we need governance software? A firm that only uses tools such as ChatGPT has duties that are mostly about people, not software. If the EU AI Act reaches your firm, what it asks of a firm that uses AI is mostly about people. You must take steps to support the AI literacy of your staff, and of others who use AI on your behalf ([EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727), checked 5 October 2026). If you use high-risk AI, the Act asks for people more than products. You must give human oversight to people with the right competence, training and authority. You must also use the system as its instructions say ([EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727), checked 5 October 2026). Whether the Act reaches you at all is set out in [our guide to the EU AI Act](/guides/eu-ai-act-uk-business). ## How can you judge AI governance software or an adviser? Judging AI governance software or an adviser is hard, because the market is young. UK government research says the quality of the tools and services on offer is not clear. It also says not all assurance tools are effective in reducing risk ([GOV.UK, Assuring a Responsible Future for AI](https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai) and [GOV.UK, Trusted third-party AI assurance roadmap](https://www.gov.uk/government/publications/trusted-third-party-ai-assurance-roadmap/trusted-third-party-ai-assurance-roadmap), checked 5 October 2026). The market is also large and mostly small firms. UK government research estimated 524 firms supplying AI assurance goods and services in the UK, including 84 specialised AI assurance companies. 60% of suppliers are small and medium-sized firms ([GOV.UK, Assuring a Responsible Future for AI](https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai), checked 5 October 2026). There are no fully active certification schemes for AI assurance in the UK yet. Certifications of a person's skill in AI assurance exist, but their quality is hard to judge, and none come from a UKAS-accredited organisation ([GOV.UK, Assuring a Responsible Future for AI](https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai) and [GOV.UK, Trusted third-party AI assurance roadmap](https://www.gov.uk/government/publications/trusted-third-party-ai-assurance-roadmap/trusted-third-party-ai-assurance-roadmap), checked 5 October 2026). Providers differ by size. Larger providers tend to offer a full audit across the life of an AI system, with tailored recommendations. Smaller ones tend to offer lighter governance audits ([GOV.UK, Assuring a Responsible Future for AI](https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai), checked 5 October 2026). So start with what you need, and write it down before you buy. The ICO expects requirements at the buying stage, which gives you a list to test any tool or adviser against ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). Some advisers also sell software. Each adviser on this site is scored on its independence from what it sells, and you can compare them side by side on [the compare page](/compare). **Start with the work you need done** 1. Write the requirement: State what the service must do before you buy. 2. Check the trade-offs: Ask how it handles your actual use of AI. 3. Keep an owner: Your organisation remains responsible. 4. Review the service: Be ready to change it if it no longer complies. Use this sequence to judge a tool, an adviser or a combination of the two. Source: ICO, What are the accountability and governance implications of AI?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 5 October 2026) ## What can you use from the regulator and the government? The regulator, the ICO, publishes an AI and data protection risk toolkit. It is designed to help organisations reduce the risks their own AI systems pose to people's rights. It is a spreadsheet that opens in Microsoft Excel or a similar program ([ICO, AI and data protection risk toolkit](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/), checked 5 October 2026). The ICO's AI guidance is under review, because of changes made by the UK's Data (Use and Access) Act ([ICO, AI and data protection risk toolkit](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/), checked 5 October 2026). The government built a self-assessment tool, AI Management Essentials, to help businesses set up good AI governance. It will not publish it. It plans simpler guidance on the basic steps, aimed at small and medium-sized firms ([GOV.UK, Guidance for using the AI Management Essentials tool: government response](https://www.gov.uk/government/consultations/ai-management-essentials-tool/outcome/guidance-for-using-the-ai-management-essentials-tool-government-response), checked 5 October 2026). **The ICO’s free AI risk toolkit** ![The ICO’s AI risk toolkit download link, which opens an Excel spreadsheet.](https://theassurancedesk.com/images/editorial/desk-library-ico-toolkit.jpg) The ICO describes the toolkit as practical support for reducing risks to individuals’ rights and freedoms from an organisation’s own AI systems. The download link opens the file in Microsoft Excel or another spreadsheet program. The ICO page warns that its AI guidance is under review following the Data (Use and Access) Act. Use the current page to check for updates. ICO. Text reproduced under the Open Government Licence v3.0; cropped from the ICO website. Captured 7 October 2026. Licence: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ Source: ICO, AI and data protection risk toolkit, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/ (checked 7 October 2026) ## What do AI engines cite on AI governance software? AI engines cite few official sources on AI governance software. On 18 September 2026, The Assurance Desk asked six AI engines seven questions about AI governance in the UK. The 42 answers cited 404 links from 209 websites, and 13 of those links were official ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 5 October 2026). One question was “do we need a separate ai governance tool if we already have a compliance platform”. It got 6 answers with 54 links, and none of those answers cited an official source ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 5 October 2026). We asked each question once, from the UK, with web search on. AI answers change from day to day, so a later run can give different sources ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 5 October 2026). ## What to do 1. List the AI your firm builds or uses, including tools staff use at work such as ChatGPT. 2. Write down what you need before you buy software or hire an adviser. The ICO expects requirements at the buying stage ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). 3. Agree who in senior management is accountable for AI. The ICO says these issues cannot be left to data scientists or engineering teams ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). 4. Use a data protection impact assessment to show how you handle the risks of AI that uses personal data ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). 5. Review any outsourced service regularly, and be ready to switch provider ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). ## Common questions ### Which is the best AI governance platform in the UK? The Assurance Desk does not name a best platform. It scores each software product on the same criteria, one score for each, with no overall winner. You can compare them on [the compare page](/compare). ### Do we need a separate AI governance tool if we already have a compliance platform? It depends on what you need it to do. Write that down first: the ICO expects requirements at the buying stage. Then check what your current platform covers against that list ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). ### Is there a qualification for AI governance? Certifications of a person's skill in AI assurance exist. UK government research says their quality is hard to judge, and none come from a UKAS-accredited organisation ([GOV.UK, Trusted third-party AI assurance roadmap](https://www.gov.uk/government/publications/trusted-third-party-ai-assurance-roadmap/trusted-third-party-ai-assurance-roadmap), checked 5 October 2026). ### Who should own AI governance: security, legal or IT? Senior management, including any data protection officer, are accountable under UK data protection law. The ICO says these issues cannot be left to data scientists or engineering teams ([ICO, What are the accountability and governance implications of AI?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/), checked 5 October 2026). ## Where next - [Exposed to the EU AI Act](https://theassurancedesk.com/best/eu-ai-act-exposed.md) - [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md) - [How does the UK regulate AI?](https://theassurancedesk.com/guides/uk-ai-regulation.md) - [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy.md) ## Sources - GOV.UK, Assuring a Responsible Future for AI: https://www.gov.uk/government/publications/assuring-a-responsible-future-for-ai/assuring-a-responsible-future-for-ai (checked 5 October 2026) - ICO, What are the accountability and governance implications of AI?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/ (checked 5 October 2026) - GOV.UK, Trusted third-party AI assurance roadmap: https://www.gov.uk/government/publications/trusted-third-party-ai-assurance-roadmap/trusted-third-party-ai-assurance-roadmap (checked 5 October 2026) - The Assurance Desk, Credo AI profile: https://theassurancedesk.com/advisers/credo-ai (checked 5 October 2026) - The Assurance Desk, Holistic AI profile: https://theassurancedesk.com/advisers/holistic-ai (checked 5 October 2026) - The Assurance Desk, Accorian (Esha Corporation dba Accorian; Accorian Assurance) profile: https://theassurancedesk.com/advisers/accorian (checked 5 October 2026) - The Assurance Desk, BD Emerson LLC profile: https://theassurancedesk.com/advisers/bd-emerson (checked 5 October 2026) - EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 (checked 5 October 2026) - ICO, AI and data protection risk toolkit: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/ (checked 5 October 2026) - GOV.UK, Guidance for using the AI Management Essentials tool: government response: https://www.gov.uk/government/consultations/ai-management-essentials-tool/outcome/guidance-for-using-the-ai-management-essentials-tool-government-response (checked 5 October 2026) - The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file): https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json (checked 5 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.