AI Governance module, introduction. It is continually reading what your organisation says,, against the standards you have set, alerting when content is likely to impact value, or create officer exposure.
When a page or document drifts from that standard, the person who owns it hears about it, and the record shows what was found, who was told and what followed. That record is the the difference between telling a regulator or insurer you keep your published information in check, and showing them.
Alongside it, within AI Confidence, visibility monitoring reads what AI is saying about you. 1 read covers the source, the other the answer built from it. Together they show whether what AI repeats still matches what you meant to say.
01The information left behind.
Websites, campaign assets and PDFs accumulate over years of publishing. Some sites remain online without an active owner. Risk profiling from 2017 to 2023 found 41% of websites unknown to the organisation’s own digital teams. P&C / Sitemorse risk profiling, 2017 to 2023, covering more than 119 million websites. Information keeps reaching customers, clinicians or investors after the organisation has changed its position.
This was a housekeeping concern. AI makes it a consequence: old information becomes the answer someone receives today.
2 cases from AAAnow’s published work show what that looks like. A medicine had been withdrawn, yet its administration guidance was still online, so a clinician asking AI could be handed instructions for a treatment no longer approved. A set of financial results was read with the figures assigned to the wrong columns, so an investor asking a simple question could be handed the wrong answer. Both documents were approved when published. Approval settled what the page said on the day. It said nothing about how the information would be read years later.. The use cases set out what was found in each.
02Directors and officers.
Correcting a page after a complaint is not the measure of oversight . The measure is what leadership knew and what it did.
UK directors’ duties
Directors owe the company reasonable care, skill and diligence. A breach can bring a civil claim, including compensation where company loss follows and the requirements for the claim are established. For the director, the question is what the company knew about the information AI repeats, and what was done. The answer comes from a record or from memory. Companies Act 2006, sections 174 and 178.
UK health and safety
A director or similar officer can be prosecuted alongside the company where its health and safety offence involved their consent, connivance or neglect. Safety guidance still online after withdrawal is the oversight question asked after an incident. HSE, legislation on leading health and safety; section 37, Health and Safety at Work etc. Act 1974.
US board oversight
Delaware’s Marchand v Barnhill allowed a claim against directors to proceed over an alleged failure to make a good-faith effort to establish board monitoring of a central compliance risk. The court did not decide final liability. Directors can support their defence with evidence of monitoring and board oversight before the event. Delaware Supreme Court, Marchand v Barnhill, 2019.
Firms within the FCA’s Consumer Duty test and monitor customer communications and address identified deficiencies. A page AI still returns to a customer is a communication the firm is expected to have tested. FCA Handbook, PRIN 2A.5, consumer understanding.
Listed companies carry disclosure obligations over their public communications. Nasdaq requires prompt disclosure of material information, subject to its exceptions. LSE standards refer to timely disclosure under UK market-abuse law and applicable regulatory rules. NYSE guidance requires released information to be factually accurate. A results PDF read with figures in the wrong columns is not accurate as received. Nasdaq Rule 5250; London Stock Exchange Admission and Disclosure Standards; NYSE 2026 Annual Guidance Letter.
03As AI expands, the evidence of control matters.
Your organisation is building AI too compete and to operate at greater scale. At some point a regulator, an investor or an insurer will ask what you can evidence about it. The most direct answer available is control over the information AI already reads of you, because that is the AI exposure you hold today. Monitoring records, decisions and follow-up findings are that evidence.
For companies within the UK Corporate Governance Code’s scope, Provision 29 applies to financial years beginning on or after 1 Jan. 2026. On a comply-or-explain basis, the board declares the effectiveness of material controls at the balance-sheet date. The Code applies to companies in the commercial companies and closed-ended investment funds listing categories. The board signs that declaration. The information the company has published, and AI reads, is a control the board will be asked to stand behind. Aon reports growing insurer interest in AI governance evidence within D&O underwriting. FRC, UK Corporate Governance Code 2024, Provision 29 and scope; Aon, AI Risk 2026.
This is what AI Governance is for. It keeps finding the content that has drifted from your rules and puts each finding in front of the person who can act on it. The audit trail then holds the checks, the findings and your decisions side by side, so when the question comes the answer is already written down.
04Evidence for board oversight.
The monitoring record provides directors with evidence to review significant findings and the organisations response. FRC guidance recommends reporting significant issues to the board even after correction, including the action taken, and calls for the board’s own review of how controls are operating. FRC, Corporate Governance Code Guidance, paragraphs 262 to 264.
05Where AI Governance sits.
There is an order to this, and it matters. AAAnow has 2 service levels. AI Accelerator comes first: a rapid uplift in what your organisation understands about how AI reads it, and in its position. AI Confidence carries that understanding forward as an ongoing discipline across the digital landscape, bringing the estate into view and clearing out what is out of date. AI Governance is an optional module, added alongside AI Confidence and invested in separately, once that control is known about and understood.
The reason is practical. You cannot govern what you do not know you have, and there is no value in governing material that should already have gone. Governance added to a landscape under control produces rules that mean something and findings you can act on.
AI Accelerator
Solid foundations for AI: understanding the information infrastructure and content environment, assessment, education and agreed improvements.
AI Confidence
Ongoing review across the wider digital landscape, with continuing monitoring and independent reporting on the organisation’s position: its AI readiness, placed on the AI Readiness Maturity Scale™, and its misinformation exposure.
AI Governance module, optional, alongside AI Confidence
Client-defined content rules applied through continuous monitoring, issue alerts and a full audit trail, supporting a documented response process.
The investment follows the same logic. AI Governance is set as a fixed monthly element plus a share of the AI Confidence licence fee, so it grows in step with the landscape AI Confidence already covers: more page views and more websites in scope mean more content read against your rules.
Monthly element
Set at £2,500 / $3,000 a month.
Licence share
A further 19% of the organisation’s AI Confidence licence fee, the monthly fee for AI Confidence, set by the page views and websites it covers.
Worked example
At the AI Confidence starting level of £3,000 / $4,000 a month, the licence share is £570 / $760, so AI Governance is £3,070 / $3,760 a month, alongside the AI Confidence licence.
06Assessment, mitigation and insurance partnerships.
Insurers have worked with AAAnow’s outside-in reading of digital risk for more than 10 years, though partnerships with Marsh, Alliant and Gallagher. That work produced AI programmes for assessing and reducing digital ADA (Americans with Disabilities Act) exposure, where an inaccessible page already carried a litigation risk. The same reading is now applied to the information AI repeats about you.
That history shapes how the assessment is built. It is independent, made from the outside in, and built to be stood behind in front of an underwriter. AAAnow provides the assessment, the monitoring, the evidence and the guidance. Your teams make the agreed changes, which keeps the record clean: what was found came from outside, what was done came from you. Our heritage sets out where that reading comes from.
Next
See it working, rule by rule.
The service detail sets out what is read, who hears about a finding, and what the record holds when the board asks. The directors’ article takes responsibilities and oversight further.