AI ethics and governance: moving from theory to practice

Summary

• Organisations must build ethical thinking into their AI design and deployment decisions, not bolt on after the fact
• There are three important routes to successful AI ethics: focusing on people, users and necessity; treating AI ethics as a shared responsibility; and scaling in a structured way
• Good practice means protecting people, data, privacy, rights, and customers, and ensuring AI use is proportionate, explainable and responsible
• Organisations with successful AI ethics will start simple, build capability, and introduce structure and independence when the organisation needs it


AI ethics and governance is often treated as an afterthought: the system is built, the use case is launched, and only then do the risks, gaps and unintended consequences become visible. But in a rush to adopt AI, organisations can easily miss a more basic question: do we need AI here, and if so, what safeguards should be in place before we use it?

That is why AI ethics matters. The UK Government’s evolving approach to AI regulation, the ICO’s guidance on AI and data protection and the EU AI Act’s phased rollout through 2026 and 2027 all point the same way: organisations are expected to build ethical thinking into how they design, buy and deploy AI, not review it after launch. 

This article shows three practical routes: start small in micro-businesses with user-focused checks; build capability in SMEs through champions, cross-functional practice and training; and scale with structured governance and independent oversight in large organisations.

AI ethics and governance in micro businesses

AI ethics starts with two simple questions asked at every decision point: who is affected by this, and what could go wrong for them? Those questions keep attention on people rather than just performance, and they help teams pause before adopting a tool simply because it looks efficient or fashionable.

A useful next step is to walk through the user journey and ask where someone might be excluded, misrepresented or disadvantaged by an assumption built into the product. That might be a customer whose needs, circumstances or language are not reflected in the data, or a user who is given a result they cannot understand, challenge or act on. The ICO’s guidance is clear that fairness and transparency need to be considered across the AI lifecycle, including problem formulation and deployment.

In a micro-business, ethics should be embedded into everyday decision making. There may be no board, committee or formal review process, but there should still be a habit of asking whether AI is needed at all, whether the decision is proportionate, and whether the impact on people has been properly understood before launch.

Build capability: ethics in SMEs

As organisations grow, AI ethics and governance needs to become a shared responsibility. This is where ‘AI Champions’ can play a genuinely useful role. I am a big fan of a specific, focused champion role, ideally held by someone exposed to several parts of the organisation, because they can see both the frustrations and successes of the process as well as customer feedback and operational reality.

For you

Be part of something bigger, join BCS, The Chartered Institute for IT.

A good AI Champion is not there to block innovation. They are there to notice patterns, ask structured questions and provide feedback on where AI is helping, where it is causing friction and where it is creating risk. That role works best when it is tied to real conversations about operations, procurement, service quality and user experience, rather than being left as a side project with no authority or access.



This stage also demands investment in skills and training. AI literacy should be accessible for managers, procurement teams and front-line staff so they can recognise bias, question outputs and understand when human oversight is required. Practical upskilling through short courses, role-based scenarios and workshops turns good intentions into day-to-day capability, supports compliance, reduces the risk of data breaches or unsafe use of non-anonymised data, and helps organisations recognise and reward best practice.

Diverse perspectives matter because bias is often invisible from inside the role that created it. Technical, commercial and operational teams will each see the system differently, but none will see the whole picture on their own. Bringing those viewpoints together helps challenge assumptions and increases the chance that hidden risks are identified before they are built into the design.

Scale with structure: ethics in large organisations

In larger organisations, AI ethics needs structure and formal oversight. That usually means an independent AI or ethics board with mixed membership that reflects the key stakeholders in the organisation: technical, legal, operational, customer-facing and senior leadership perspectives. If the membership is too narrow, the board risks reflecting one part of the business instead of challenging it.

It is important to remember that the board’s recommendations should be independent of organisational goals, even though that can be difficult to manage in practice. The point of the board is not to repeat commercial ambition in a different room; it is to test whether a system is fair, transparent, explainable and defensible, even when it is attractive from a business point of view.

BCS’ work in this area is relevant here. Its report on AI ethics and professional registrations found strong public support for independent standards in high-impact AI roles, reinforcing the idea that accountability should not sit entirely inside the organisation that benefits from the technology. At scale, AI ethics and governance is not about slowing everything down; it is about creating the discipline and independence needed to make better decisions.

Conclusion: ethics as a maturing practice

Technology is moving quickly, and we do not have all the answers yet. But we do know what good practice looks like: protect people, data, privacy, rights, and customers, and ensure AI is used in ways that are proportionate, explainable and responsible.

Getting AI ethics right is not about slowing progress; it is about securing a future that organisations can trust. The organisations most likely to succeed will start simple, then scale. They will ask the right questions early, build capability through champions and cross-functional discussion, and introduce structure and independence when the organisation becomes large enough to need it.


Darren Winter is Director of Duco Digital Training, a BCS-accredited training organisation specialising in AI, business and technology training, and recently completed three years of doctoral PhD research in AI Ethics at the University of Córdoba.