For UK regulated professional services firms using AI, whether a policy exists matters less than whether it would survive contact with a regulator, a client, or a professional indemnity insurer. A firm may be able to produce a policy. The harder question is whether it can produce evidence that the policy operated in practice. The governance problem is therefore not policy creation, it is translating policy into controlled behaviour and producing evidence that those controls operated when they mattered.
This paper sets out a three-tier practice framework, Policy, Standards, Procedures, built from over fifteen years of regulated programme delivery inside major UK financial institutions, and developed through direct engagement with the operational realities of solicitor, accountancy, and financial advice firms in 2026.