Data Regulation Evidence Registers Should Come Before AI Use Expands

AI Trust & Governance

24 September 2026 | By Ashley Marshall

The UK data regulation conversation has moved from principles to proof. If your AI system uses data, your next board question should be simple: can we show what data was used, why it was lawful, and who checked the risk?

The policy signal is about evidence, not paperwork

The latest UK signal on AI and data is not that every business needs a bigger compliance department. It is that leaders need better evidence before AI moves deeper into live work. In July 2026, the government opened a call for evidence on data regulation in the age of AI and other data-intensive technologies, asking for practical examples of how personal and non-personal data regulation interacts with AI, where uncertainty remains, and where legal, technical and governance arrangements could better support responsible data use. That is a useful prompt for boards because it reframes AI governance as an operational evidence problem, not a policy wording problem. See the GOV.UK call for evidence here.

For UK businesses, the practical move is to build an evidence register that shows which AI workflows touch which data, why that data use is permitted, what review has taken place, and what would trigger escalation. This does not need to be a complex platform. A controlled spreadsheet or governance table is enough to start, provided it has owners, review dates and links to source documents. The counterargument is familiar: teams already have privacy notices, supplier contracts and DPIAs, so a separate AI data evidence register sounds like duplication. In practice, those documents are usually scattered across legal, IT, procurement and operations. AI changes the risk because a single workflow may combine customer records, internal knowledge, third-party models and automated recommendations. The register is the map that lets leaders see the whole system.

Most firms are using data, but AI governance is still patchy

The evidence gap is not theoretical. The UK Business Data Survey 2026 found that 86% of UK businesses handled digitised data, while 41% of businesses that handled digitised data reported using AI for at least one purpose. Large businesses were much further ahead, with 82% reporting AI use. The same survey found that AI-using businesses had more developed data practices, but governance and awareness were still uneven: 17% of AI-using businesses reported having no AI policy in place, and only 19% of businesses were aware of regulatory guidance and found it clear. The official statistics are available on GOV.UK here.

Those figures should worry business leaders more than they reassure them. A company can have strong AI enthusiasm and weak AI evidence at the same time. Staff may be using approved tools for drafting, search, analysis or customer triage, while nobody can quickly answer which datasets are feeding the workflow, whether special category data is excluded, whether outputs influence decisions about people, or whether supplier settings changed after launch. What this means in practice is simple: do not wait for a regulator, client or insurer to ask for the evidence pack. Build it while the workflow is still small enough to understand. Each register row should describe the workflow, data categories, purpose, lawful basis, owner, supplier, model or system used, review status and escalation route. The aim is not to stop useful AI adoption. The aim is to make adoption inspectable before it becomes embedded and harder to unwind.

Automated decision-making raises the bar for proof

AI governance becomes sharper when outputs affect people. In April 2026, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 were made, requiring the Information Commissioner to prepare a code of practice for processing personal data in relation to developing and using AI and automated decision-making. The regulations came into force on 12 May 2026 and explicitly cover AI, automated decision-making and guidance for children's personal data. The statutory instrument is published on legislation.gov.uk here.

That does not mean every AI workflow is an automated decision-making system. The common misconception is that using AI anywhere near a process automatically creates an Article 22 problem. Often it does not, especially where AI drafts, summarises or supports a human decision. But the organisation still needs to know where the boundary sits. A register forces that question into the open. Does the system make a recommendation that staff usually accept? Does it rank leads, score applicants, flag customers for review, approve refunds, allocate shifts, prioritise service requests or influence pricing? Is there meaningful human review, or only a rubber stamp? For each workflow, leaders should record whether people are affected, whether the decision is solely automated, whether profiling is involved, what human intervention exists, and where an individual could challenge an outcome. This is the difference between saying 'we have a human in the loop' and being able to prove what the human actually does.

The register should connect legal, technical and supplier evidence

A useful evidence register is not a privacy team document pretending to cover the whole system. It should join up four kinds of proof. First, legal proof: lawful basis, transparency notice, DPIA status, automated decision assessment, retention rule and data sharing position. Second, technical proof: data source, access control, model or tool, retrieval source, logging, output review and deletion route. Third, supplier proof: contract owner, processor or controller role, sub-processor list, data location, model training position, security evidence and change notification route. Fourth, operating proof: workflow owner, launch date, review date, incident route, staff guidance and stop condition. When these sit together, leaders can ask better questions.

The ICO's 2026 consultation on draft automated decision-making guidance shows why this joined-up view matters. The ICO said the guidance is aimed at data protection officers, compliance professionals and technical leads with oversight of an organisation's use or procurement of ADM systems. That audience list is telling: AI risk is no longer owned by one department. It sits between compliance, technical delivery and procurement. The consultation page is available from the ICO here. What this means in practice is that a good register should be reviewable in a meeting where operations, IT, data protection and finance are all present. If the row only makes sense to lawyers, it will not govern the workflow. If it only makes sense to developers, it will not satisfy legal scrutiny. The register needs enough plain-language structure for both sides to see the risk.

Start with the workflows that already carry consequence

The best starting point is not a company-wide hunt for every AI experiment. That becomes slow, political and incomplete. Start with workflows where AI touches personal data, customer outcomes, employee decisions, regulated advice, financial value or operational continuity. In a typical UK SME, that means sales qualification, customer service triage, HR screening, credit control, complaints handling, meeting note extraction, CRM enrichment and management reporting. These are the workflows where a poor data assumption can become a real-world problem. They are also the workflows where evidence makes adoption easier, because leaders can approve expansion with confidence rather than instinct.

A practical first version can have fifteen columns: workflow name, business owner, AI tool, data sources, personal data category, special category data check, lawful basis, privacy notice link, DPIA status, automated decision risk, supplier contract link, retention rule, monitoring owner, review date and stop condition. Add a status field with simple options such as proposed, pilot, live, paused and retired. Review the register monthly until the operating model settles, then quarterly for low-risk workflows and more often for high-impact ones. The objection will be that this slows the team down. It should do the opposite. If every new AI use case starts from a blank governance discussion, adoption becomes slow and inconsistent. If each use case lands in a known register with known evidence fields, the route to approval gets clearer. That is how governance becomes an accelerator rather than a brake.

Boards should ask for evidence movement, not perfect certainty

No register will remove all uncertainty. AI tools change, guidance changes, suppliers change, and business users will keep discovering new uses. The point is not to freeze the organisation until every answer is final. The point is to show evidence movement: which workflows are understood, which are awaiting review, which have known gaps, which suppliers need follow-up, and which risks have been accepted by the right person. That is a healthier board conversation than a binary claim that the company is either compliant or not compliant.

The UK's wider AI adoption agenda reinforces this. The government's interim response to the AI Champions' adoption plans said deep AI adoption depends on industry leadership, workforce engagement, skills and confidence, and cited OECD estimates that AI adoption could add £55 billion to £140 billion to UK GVA by 2030. The response is available on GOV.UK here. That upside is real, but it will not be captured by firms that cannot explain their data use. For UK leaders, the balanced position is this: keep moving, but make movement reviewable. Build the register, attach evidence as you go, and use it as the release gate for higher-consequence AI. The businesses that handle this well will not be the ones with the longest policy documents. They will be the ones that can answer practical questions quickly and prove what changed.

Frequently Asked Questions

What is an AI data evidence register?

It is a structured record that connects each AI workflow to its data sources, purpose, lawful basis, risk assessment, supplier controls, owner and review status. It helps leaders prove how AI data use is governed.

Is this the same as a DPIA?

No. A DPIA is a formal assessment for data protection risk. The register is an operating map that shows which workflows exist, which ones need a DPIA, and where supporting evidence is stored.

Do small businesses need this?

Yes, if they use AI with customer, staff or operational data. The first version can be a simple spreadsheet. The key is ownership, review dates and evidence links, not a complex governance platform.

Which AI workflows should be registered first?

Start with workflows that affect people, money, customer service, hiring, complaints, regulated advice, finance decisions or business continuity. Low-risk drafting tools can follow later.

Does every AI workflow count as automated decision-making?

No. Many AI tools support a human rather than making a solely automated decision. The register should record where that boundary sits and what human review actually involves.

Who should own the register?

A senior operational owner should own it, with input from data protection, IT, procurement and department leads. If it sits only with legal or only with IT, it will miss part of the risk.

How often should the register be reviewed?

Review it monthly while AI use is expanding, then move lower-risk workflows to quarterly review. Review high-consequence workflows whenever data sources, suppliers, models or decision logic change.

What is the biggest mistake to avoid?

Do not treat the register as a compliance archive. It should be used in approval, supplier review, model change and incident response, otherwise it will quickly become stale.