AI rules are unclear, but waiting is not a strategy

The instinct is understandable. UK ministers are still deciding whether and how to pass overarching AI legislation. If the rules might change, why invest now and risk getting it wrong? For many Managing Directors, Operations Managers, and Compliance Managers, that logic feels responsible. It is, however, built on a misconception. Regulatory uncertainty does not mean a legal vacuum. The rules governing what matters most are already in force, and the cost of waiting is rising every quarter.

Why the myth feels so reasonable

A UK government official told lawmakers that overarching AI rules and the future powers of the AI Security Institute remain undecided. That is a real statement from a real parliamentary hearing. It is not surprising that business leaders read headlines like that and decide to wait.

The myth also carries a grain of professional caution. Compliance Managers in particular are trained to avoid irreversible commitments ahead of settled rules. When the law is still forming, the conservative read is to pause.

The problem is that pausing is itself a choice with consequences. Competitors who have built proportionate controls and continued careful AI adoption are compounding their operational advantage month by month.

What the law already requires

Broader AI legislation may be unsettled, but the legal framework surrounding AI use is far from empty. UK GDPR applies the moment personal data touches an AI tool. Employment and equality law applies when AI assists in decisions about staff. Consumer-protection duties apply when AI interacts with customers. Sectoral rules apply in financial services, insurance, healthcare and legal practice, and many professional bodies set their own expectations for members. Contractual obligations apply from the moment a supplier agreement is signed.

Waiting for a single AI law will not suspend any of these. A business that pauses AI adoption to avoid regulatory risk may still face enforcement action under existing law if it handles data carelessly or makes an undocumented decision affecting a customer or employee.

Recent research into UK business AI governance found that regulation and increased risk management ranked among the leading obstacles to converting AI into measurable value. The irony is that the fear of regulation is itself becoming a barrier to the disciplined, documented approach that proportionate governance actually requires.

The real cost of inaction for UK SMEs

Regulatory uncertainty tends to produce one of two responses in SMEs: reckless experimentation with no controls, or complete inaction. Neither is a safe position.

For Managing Directors, inaction is not a neutral holding pattern. It is a decision to fall further behind while operating costs remain unchanged. For Operations Managers, it means teams continue to handle manual workloads that low-risk AI could reduce safely today. For Compliance Managers, a blank AI policy is not protection. It is an undocumented exposure.

The businesses that will be best placed when UK AI legislation does settle are not those that waited. They are those that built adaptable habits now: classifying use cases by risk, recording supplier terms, protecting personal data, and reviewing decisions that affect customers, employees, or finances. Those habits are valuable under any regulatory regime.

What proportionate controls actually look like

The practical response to an unsettled regulatory environment is not to stop. It is to avoid irreversible commitments and build controls that can flex as rules develop. Three areas are worth addressing now.

1. Separate low-risk assistance from high-impact decisions. Using an AI Assistant to draft a supplier email carries different risk from using AI to shortlist job applicants. Treat them differently. Document what each tool is intended to do and what its limitations are. That documentation is valuable evidence of good practice under any future audit.

2. Maintain an AI use-case inventory. A simple register of which AI tools your business uses, for what purpose, and which data categories they touch gives you a starting point for every regulatory question that follows. It also forces the internal conversation that many SMEs have not yet had about where AI is actually operating in the business.

3. Establish a quarterly review trigger. Set a standing agenda item that activates whenever a supplier materially changes its product terms, whenever a relevant regulatory development is announced, or whenever the business begins a new AI use case. This keeps governance proportionate and live without requiring a compliance team.

Honest limitations of this approach

It would be misleading to suggest that proportionate controls remove all risk. They do not. If UK legislation eventually introduces mandatory impact assessments, sector-specific prohibitions, or registration requirements, some businesses will need to revisit current practices. No framework built today will be perfectly aligned with rules that do not yet exist.

The argument here is narrower than that. Controls built around existing law, documented decision-making, and a clear use-case inventory put a business in a significantly stronger position than having no controls at all. They also create the institutional muscle memory that makes adapting to future rules faster and cheaper. Waiting, by contrast, produces neither safety nor readiness.

A realistic approach for SMEs building AI habits now

The practical question for most SMEs is not whether to adopt AI but how to build the internal competence to use it responsibly. That means understanding how to classify risk, how to document supplier relationships, and how to give team members a clear framework for what they can and cannot do with AI tools.

gecco's Training and consultancy programme gives SME teams a vendor-neutral grounding in responsible AI use. The ESSENTIALS tier covers AI fundamentals, practical workshops, and the GRAFT methodology for building assistants with clear purpose and documented controls. This builds internal capability rather than dependency, so the business can adapt as UK rules develop.

If your team is ready to move forward carefully

If your Managing Director, Operations Manager, or Compliance Manager is asking what proportionate AI governance actually looks like in practice, the AI Readiness survey is the right starting point. Take the AI Readiness survey. You will get access to 65+ free resources and a custom AI Readiness report. We then offer a free 30-minute showcase to walk through your results.

Regulatory fear is blocking UK SMEs from converting AI into measurable value. The real barrier is not law but leadership clarity. If you want help building the team habits and documented frameworks that responsible AI use requires, gecco's Training and consultancy programme is designed exactly for that.

Website · LinkedIn · Case Studies · Newsletter