Provision 29 and AI

Three things about Provision 29 are routinely misstated, and an audit committee should know them before anybody sells it a remedy.

It is a declaration about effectiveness, not a warranty that everything worked. The Code contemplates a negative or qualified declaration, together with a description of any material controls that have not operated effectively and the action taken or proposed.

There is no external assurance requirement attached to it. No auditor attestation, no mandated third-party review.

The FRC declines to define a material control. In its own words, it is not the FRC’s role or intention to prescribe or dictate what a material control is for a company. The board chooses, and the board then has to be able to explain the choice.

None of that mentions AI, because the Code does not mention artificial intelligence anywhere, and the FRC has published no AI guidance for boards. Its March 2026 guidance is for audit firms adopting AI in audit, which is a different document for a different reader. The FCA has said it does not plan to introduce extra regulations for AI and will rely on existing frameworks. There is no UK AI statute. Regulatory position last checked: September 2026.

So there is no rule that tells an audit committee what to do about AI, and there is a general obligation that now bites. If a material control has a model inside it, the declaration covers it. The question moves from what the regulator requires to what the committee can evidence, which is a harder question and a more useful one.

The register, which is the whole job#

Almost everything an audit committee needs before year end fits in one table, and most companies do not have it. Not a new framework: a list, maintained by whoever maintains the existing controls register, with three columns added.

• ControlThe material control, as it already appears on your register.From the existing register
• Model inside itWhat the system does within the control: scores, ranks, drafts, flags, decides, or none.From the process owner
• Named human checkThe person, by role, relied on to catch a wrong output. Not the approver of the process. The person who would notice.From the process owner
• Overrides this yearHow many times that person disagreed with the system and the disagreement stood.From the system logs, or from the admission that nobody counts
• Evidence it operatedWhat you would show: samples tested, exceptions raised, the reasoning behind one decision reconstructed six months later.From internal audit
• If it stoppedWhether the work returns to people, how quickly, and whether those people can still do it.From the continuity plan, tested rather than assumed

The column that causes the trouble is overrides this year. A great many organisations discover, in filling it in, that the number is zero and that nobody had noticed. A control whose human check has never disagreed with the system is either a control over a system that has never been wrong, or it is a signature.

Seven questions to put to management this autumn#

1. Which of our material controls have a model inside them? The bad answer is a list of AI projects. Those are different things, and a project list will miss the model that arrived inside a vendor’s product upgrade.
2. Who is named as the human check on each, and what would they have to know to catch a wrong answer? The bad answer is a job title.
3. How many times has anyone overridden one of these systems this year, and what happened next? The bad answer is that the question has not been asked.
4. Could we reconstruct one of these decisions six months later, and who would do it? The bad answer is that the system logs everything. Logging an output is not recording a reason.
5. If one of these systems stopped for a fortnight, what would we be unable to do? The bad answer is that the continuity plan covers it, offered without a test.
6. What is the evidence that this control operated, as opposed to existed? The bad answer is a policy document.
7. What would we put in the annual report if one of them had not operated? The bad answer is discomfort. The Code contemplates a qualified declaration and a committee that has rehearsed one is in a better position than a committee that has not.

What this does not tell you#

It does not tell you whether your controls are adequate, which depends on your business and not on a page. It does not interpret the Code for your circumstances, which is work for your advisers and your auditor. And it takes no position on whether Provision 29 is a good instrument. It is the instrument, its dates are fixed, and the first declaration is closer than most boards have registered.

It is also written for the UK listed regime and stops there. A private company board, a family business board, a partnership board, a charity board, an academy trust board, a housing association board and an NHS board all answer to a different instrument, and none of those instruments names AI either. The register above does not depend on which one you sit under.