11th November 2026
4 min read
A practical approach to responsible AI adoption across organisations
Artificial intelligence presents significant opportunities for organisations, but adopting it responsibly requires more than simply introducing new tools. Understanding where AI can add value, how it should be used and what safeguards need to be in place are increasingly important considerations.
Phil Coleman, Iken's Chief Information Officer, explores the wider challenges and opportunities of AI adoption, drawing on Iken's own approach to establishing practical governance and supporting responsible use across the organisation.
What has changed is public awareness and widespread use. AI tools have become far more accessible, meaning organisations of all sizes need to consider how these technologies will affect them.
Not every organisation will choose to adopt AI directly. However, employees may already be using widely available tools, whether formally approved or not. This makes it important to establish clear guidance around how AI can be used, managed or restricted, protecting the organisation, its staff and its customers while allowing opportunities for responsible adoption.
Learning from recent history
The urgency here is comparable to the “race to remote working” during the early days of the COVID pandemic. Organisations didn’t have the usual months or years to review policies, evaluate options, and plan implementations. Much of that work had to be done quickly, and sometimes retrospectively.
AI presents a similar challenge. Tools such as ChatGPT and Microsoft Copilot are already available to staff and are being used for business purposes, whether organisations feel ready or not. With that in mind, I want to outline the steps Iken has taken to create a safe and secure framework to understand, evaluate, and educate on the use of AI… ensuring it remains a supportive tool rather than a security risk.
“Responsible AI adoption starts with governance, values, and purpose, not tools.”
Phil Coleman
Chief Information Officer
Start with governance, not tools
Iken already had a comprehensive set of policies in place covering information security, data protection, and corporate governance, supported by core values that underpin how we work and the products we deliver. Before reviewing specific tools or technologies, we defined an AI Policy aligned with those values and existing considerations around intellectual property, data protection and privacy, data sovereignty, and reputation.
While that policy-level work is important, it needs to translate into practical guidance. We therefore shared four clear principles to guide how AI should be used day to day:
AI should be a supporting resource and should always have appropriate human oversight or validation.
These principles help ensure that any tools we approve can deliver value, extend capability, and do so accurately and reliably.
Understanding the wider data governance picture
Responsible AI adoption also sits within a changing legal and regulatory environment. Organisations need to understand how information is accessed, shared and protected, alongside the responsibilities that come with introducing new technologies.
The EU Data Act is one development in this wider picture. Although it is not specifically an AI governance law, it introduces requirements concerning certain data rights and switching between data processing services.
Iken's Commercial Contracts Lawyer, Helen Naylor, explores these changes in her forthcoming whitepaper, EU Data Act: What Do We Need to Know?, examining the practical considerations for organisations and technology providers.
Creating space for informed experimentation
In recent months, we have introduced an AI Working Group, bringing together colleagues with an interest in AI alongside those responsible for compliance and security. This has provided a forum for constructive discussion and pragmatic decision-making, while remaining aligned with our existing change management processes. Over time, I expect this to become part of normal change management as AI becomes more commonplace.
This approach has allowed us to introduce AI-supported development tools safely to support our delivery teams. We have approved a limited set of generative AI tools for wider use to evaluate their potential to improve productivity, while remaining within existing data classification and protection rules and maintaining our voice and values in all internal and external communication. More recently, we have undertaken a proof of concept exploring how AI could be integrated into our products, which we will share more about in a future post.
“AI isn’t something organisations can ignore… but with the right controls, it also isn’t something to fear.”
Phil Coleman
Chief Information Officer
Responsible AI adoption starts with understanding the risks, establishing clear policies and giving people the guidance to use new technologies confidently.
For another perspective on the changing data governance landscape, explore Helen Naylor's forthcoming whitepaper on the EU Data Act.
