Directors' duties and AI under the UK Corporate Governance Code

The UK Corporate Governance Code does not mention artificial intelligence anywhere. The Financial Reporting Council has published no AI guidance for boards. The Financial Conduct Authority has said it does not plan to introduce extra rules for AI and will rely on existing frameworks, and there is no UK AI statute. A director looking for the rule that says what to do about AI will not find one. What they have instead is a set of general obligations, one of which started to bite this year.

Provision 29, and the three things everyone gets wrong about it#

Provision 29 of the 2024 Code asks the board to monitor the company's risk management and internal control framework and, at least annually, to carry out a review of its effectiveness covering “all material controls, including financial, operational, reporting and compliance controls”. In the annual report it asks for a declaration of effectiveness of the material controls as at the balance sheet date, a description of any material controls which have not operated effectively, and the action taken or proposed to improve them.

The 2024 Code applies to accounting periods beginning on or after 1 January 2025. Provision 29 alone applies from 1 January 2026, so for a 31 December year end the first declaration appears in the annual report published in 2027.

Three claims about it circulate widely and each is wrong. It is not a declaration that the controls were effective: it is a declaration of effectiveness, sitting alongside a description of any that were not, and a qualified or negative declaration is contemplated by the Code itself. It does not require external assurance: nothing in the provision or the FRC's guidance asks for auditor attestation over it. And it does not apply to “premium listed” companies, because that segment ceased to exist when the Listing Rules changed in July 2024. The Code applies to companies listed in the commercial companies category or the closed-ended investment funds category, wherever incorporated.

One further point matters more than any of them. The FRC declines to define a material control: “It is not the FRC's role or intention to prescribe or dictate what a material control is for a company.” The judgement about which controls are material, and therefore which ones with machines inside them fall into the declaration, belongs to the board.

Where AI actually touches the Code#

Not in one place, and not by name. The provisions and principles a board is already operating under reach AI as soon as AI reaches the thing they govern.

Principle O asks the board to establish and maintain an effective risk management and internal control framework. Provision 28 asks for a robust assessment of emerging and principal risks. Provision 29 is the declaration above. Principle B concerns culture and asks the board to satisfy itself that culture is aligned with purpose and values, which is where the question of what people are quietly handing over belongs. Provision 2 asks the board to assess and monitor culture. Principle E and Provision 5 concern the workforce, which is where capability sits. Provision 25 sets the audit committee's remit including significant judgements, and a judgement made with a machine is still a significant judgement.

The only AI mention anywhere in the Code family is a question in the FRC's accompanying guidance asking whether the board is aware of emerging technologies being used by the company, giving responsible artificial intelligence as an example. That is guidance: a prompt rather than a requirement.

What a director's duties already require#

Directors' general duties under the Companies Act 2006 are unchanged by any of this. The duty to exercise reasonable care, skill and diligence, and the duty to promote the success of the company, apply to decisions about AI as they apply to everything else. Nothing about the technology lowers the standard, and delegation to a system does not transfer the duty any more than delegation to a person does.

Two practical consequences follow. A board that cannot say which decisions its machines make is not in a position to say it exercised reasonable care over them. And a board that accepted an assurance without asking what it rested on has accepted a claim rather than exercised oversight. Neither is a novel legal proposition; both are harder to satisfy when the thing being overseen acts at machine speed.

This page is not legal advice and directors should take their own on the duties. What it can say plainly is that the absence of an AI-specific rule is not the absence of an obligation, and a board waiting for a rule that names the technology will wait past the point where the question was asked.

If your board is not in scope#

Most boards are not. A private company board, a family business, a partnership, a charity, an academy trust, a housing association, an NHS board and a public body each answer to a different instrument, and none of those instruments names AI either. Large private companies may apply the Wates Principles. Several boards use the Code voluntarily as a reference point.

The obligation differs; the work does not. Which decisions machines may make, who can stop them, what people must remain able to do, how the board would hear, and what management's assurances rest on are the same five questions whichever instrument sits above them, which is the argument at board oversight of AI.

Where the EU regime sits beside this#

A UK company placing AI systems on the EU market, or whose system output is used in the EU, faces a second regime on its own timetable. The AI literacy obligation in Article 4 has been in force since 2 February 2025. Transparency obligations under Article 50 apply from 2 August 2026. The high-risk obligations were deferred during 2026 and now apply from 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for those embedded in regulated products.

A great deal of board material still quotes 2 August 2026 for high-risk obligations, which was correct before the deferral and is not correct now. Checking the date on the briefing is a reasonable first move with anything a board is handed on this.

What this does not show#

This page states what the Code says and what it does not. It does not interpret directors' duties, which is a matter for counsel, and it does not predict how a court would treat a board that delegated a decision to a system. No case has tested that in the UK. The claim that the five questions survive whichever instrument applies is an argument rather than a finding, and the fact that no regulator requires them is stated rather than glossed. Dates and wording were checked against the Code and the FRC's own pages in September 2026, and both change.