What your instrument says
Provision 29 reaches companies listed in the commercial companies category or the closed-ended investment funds category, whether incorporated in the UK or elsewhere. The old premium and standard segments went in July 2024, so board material that still says premium listed was written before the Listing Rules changed.
Three things about it are routinely misstated. It is a declaration about effectiveness rather than a warranty that everything worked, and the Code contemplates a negative or qualified one. No external assurance or auditor attestation requirement is attached. And the FRC declines to say what a material control is: in its own words, it is not the FRC’s role or intention to prescribe or dictate that for a company.
What it does not answer
Whether the person named as the human check on a control with a model in it could tell a plausible wrong answer from a right one. Whether anyone has ever overridden that system, and what happened when they did. Whether the reasoning behind one of its decisions could be reconstructed six months later, and by whom. And whether, if it stopped, the people who would pick the work back up can still do it.
Those are questions about operation rather than design, and an audit committee already knows the difference. A control can be properly designed and still fail in operation, and the way you find out is to test it. Human oversight is a control. It is designed on paper, named in the framework, and almost never tested.
What you can establish before your next meeting
Which of your material controls have a model inside them, which is a different list from your AI projects and will catch the model that arrived inside a vendor’s product upgrade. Who is named as the human check on each. How many times anyone has overridden one of them this year.
The six-column register that holds all of it, and the seven questions to put to management this autumn, are at Provision 29 and AI. For a 31 December year end the first declaration appears in the annual report published in 2027, and the evidence behind it is gathered across the year in progress.
Where this is the wrong call
I do not write AI risk registers, map controls against the EU AI Act, run conformity assessments, build governance frameworks or draft committee papers. Firms that do that work properly exist and several of them are very good. This is the question those exercises leave open: whether the people named in your framework could actually detect a wrong answer, whether anyone has ever overridden a system, and what the organisation could still do if it stopped.
Regulatory position last checked: September 2026. If you are reading this much later, check the dates before you rely on them.
