Board-Level AI Investment Decisions: The UK Approval Paper

AI spend often reaches a UK board as a slide: a use case, a vendor, a projected saving and a request for budget. The board approves or defers, and the minute records one line. Twelve months later, when the system misbehaves or the saving fails to appear, nobody can reconstruct what the directors were told, what they understood about the model, or what would have made them stop. That gap is now a governance problem as well as a commercial one.

The commercial side is well documented. MIT's NANDA initiative reported in August 2025 that for 95% of companies in its dataset, generative AI implementation was falling short, and it attributed the shortfall to a learning gap rather than to model quality, as Fortune reported on the MIT State of AI in Business study. On the governance side, one thing changed for listed UK boards in 2026: Provision 29 of the UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026, so a board reporting against the Code now has to declare on the effectiveness of its material internal controls, or explain why it has not.

This guide is written for the sponsor who has to put an AI investment in front of the board: usually the COO, the CRO or the Chief Data and AI Officer. It covers the approval paper and the decision record, meaning what the paper must contain so that the board's decision is defensible later. It deliberately cedes the short list of questions a director should ask to the board section of our enterprise AI consulting guide, the post-launch board metrics to our voice AI board reporting guide, and the regulator-by-regulator risk map to our guide to an AI risk management framework for UK sector regulators.

This guide is shipped by the team behind DATS, the five-stage AI consulting system from DILR.AI, delivered by senior practitioners who ship code, not decks. Or see AI operating model, the engagement that sets governance, RACI and lifecycle, audit-ready by design.

What does a UK board need on record before approving AI spend?

A UK board approving AI spend should, in our framework, hold a written record of five things: the placement and its owner, what the directors were told about how well the organisation understands the model, which material controls it touches, the benefit measure, and the criteria that would stop the investment. Without it, a later review has little to show how the directors exercised care.

The distinction matters because a list of good questions and a defensible decision are not the same artefact. A director can ask every right question in the meeting and still leave no trace of the answers. The approval paper is where the answers live, and the minute is where the board records that it read them. A sponsor who writes the paper with the minute in mind does most of the governance work before the meeting starts.

In practice the paper is short. It should run to a few pages, not a deck, because a board reads the summary and the risks and skims everything else. The structure below follows the order a later reviewer will read it in: who owned it, what they knew, what it touched, what it was meant to achieve, and what would have stopped it. The same discipline of a named owner per placement runs through the DATS consulting system, whose placement diagnostic produces a ranked roadmap of where AI belongs and where it does not.

How does the directors' duty of care apply to an AI investment decision?

The directors' duty of care applies to an AI investment decision exactly as it applies to any other spend. Section 174 of the Companies Act 2006 requires each director to exercise reasonable care, skill and diligence, judged against a reasonably diligent person with the knowledge expected of the role and the knowledge that director actually has. For AI, that means the board must show it understood what it approved.

The text is short. Section 174(1) of the Companies Act 2006 reads: "A director of a company must exercise reasonable care, skill and diligence." Section 174(2) then sets a two-part standard. The first part is objective: the general knowledge, skill and experience that may reasonably be expected of a person carrying out that director's functions. The second is subjective: the general knowledge, skill and experience that the director actually has. A director with a technology background is therefore held to a higher standard on an AI decision than one without, not a lower one.

Two consequences follow for the sponsor writing the paper. First, the paper should not assume technical literacy the board does not have. If the directors cannot follow the explanation of how the system reaches its outputs, the paper has failed them, and the minute will record an approval they could not have understood. Second, the paper should state plainly what is not known. A board that approves with a clearly stated uncertainty has made a judgement; a board that approves without being told about it has not. Both points sit underneath the short list of director questions in our enterprise AI consulting pillar.

Section 172, the duty to promote the success of the company, sits alongside this. It asks directors to have regard, among other matters, to the likely long-term consequences of a decision, the interests of employees, relationships with suppliers and customers, and the company's reputation for high standards of business conduct. An AI placement that changes how customers are served, or how staff work, engages those considerations directly, and the paper is the natural place to show the board weighed them. None of this is new law. What is new is how often boards are now asked to approve systems whose behaviour the organisation itself cannot fully explain, which is where the AI operating model earns its place: it covers governance, RACI and lifecycle, so the question of who answers for that behaviour has a written answer.

Does Provision 29 put AI systems inside the material controls declaration?

Provision 29 can put an AI system inside the material controls declaration if the board decides the system is, or supports, a material control. The UK Corporate Governance Code 2024 applies Provision 29 to financial years beginning on or after 1 January 2026, and the FRC deliberately leaves the definition of a material control to each board, based on its principal risks.

According to the FRC's UK Corporate Governance Code page, the 2024 Code has applied to financial years beginning on or after 1 January 2025, with Provision 29 applying from 1 January 2026. Provision 29 asks boards to make a declaration in relation to the effectiveness of their material internal controls. The Code operates on a comply or explain basis, and it applies from the date a company is listed in the commercial companies category or the closed-ended investment funds category. So it applies to the boards of those listed companies; a private company is not caught, although many choose to follow the Code voluntarily.

The FRC's guidance is explicit that it will not define the term for you. The Corporate Governance Code Guidance states that it is not the FRC's role to prescribe what a material control is for a company, since that depends on the nature of the principal risks. The guidance adds that boards will need to determine the actions necessary to give them the information they require to make the declaration, and that where a material control is not operating effectively at the balance sheet date, the board should disclose it alongside the action taken or proposed.

For an AI investment, the practical test is whether the system will sit inside, or feed, a process the board already treats as material. An AI agent that drafts customer correspondence may not. A model that classifies transactions feeding the ledger, scores credit decisions, or triages regulatory complaints is more likely to, where the process it supports already sits among the board's principal risks. The approval paper should answer that question directly, because the answer decides whether the system's monitoring has to produce evidence the board can rely on at year end. Where it does, design the monitoring before the build, not after. For a worked example of governance evidence in a different regulated setting, see our guide to AI governance in institutional education.

What should the approval paper say about how well the firm understands the model?

The approval paper should state, in plain words, how well the organisation understands the model it is buying or building, and where that understanding stops. Evidence from UK financial services shows why: the Bank of England and FCA found in 2024 that only 34% of responding firms reported complete understanding of the AI they use, largely because of third-party models.

The Bank of England and FCA survey of AI in financial services, published on 21 November 2024, found that 75% of responding firms were already using AI, with a further 10% planning to within three years. Against that adoption, 46% of respondent firms reported only partial understanding of the AI technologies they use, against 34% reporting complete understanding. The survey attributes the gap largely to third-party models, and it found that a third of all AI use cases are third-party implementations.

This is financial services data, and other sectors were not surveyed, but the mechanism is general. Any organisation buying a model through an API, or a product with a model inside it, inherits a system whose training data, update cycle and failure modes it does not control. The approval paper should therefore carry a short understanding statement with three parts: what the organisation can see (inputs, outputs, logs), what it cannot see (training data, weights, vendor changes), and how it will detect a change it cannot see. That third part is the one most papers omit.

The same survey offers a useful calibration. Only 2% of use cases had fully autonomous decision-making, and firms rated 62% of their AI use cases low materiality and 16% high materiality. Fully autonomous decision-making was rare in that survey, so a paper asking the board to approve a high-materiality placement with little human oversight is asking for something unusual, and it should say so explicitly. Where the placement will act on its own, the paper should name the human approval point and who staffs it; how much autonomy the board will accept in the first place is the subject of our voice AI board risk appetite guide, which translates appetite into testable thresholds.

How should the paper set kill criteria and a second decision point?

The paper should set kill criteria before the money is spent: the measured result, by a named date, below which the investment stops or returns to the board. A second decision point turns one large approval into two smaller ones, so the board funds a placement to its first evidence gate and then decides again on what the evidence shows rather than on the original forecast.

The reason is the base rate. If, as the MIT NANDA study reported, generative AI implementation was falling short for 95% of companies in its dataset, a board should expect that any single placement may not deliver, and it needs a way to end the ones that do not. A kill criterion written into the approval paper is that mechanism, and because it was agreed before anyone was invested in the outcome, it is easier to apply.

Good kill criteria share three features. They are measured against a baseline taken before the system goes live, not against a vendor benchmark. They have a date, so the review happens whether or not anyone asks for it. And they name what happens on failure: stop, rescope or return to the board, not "review". The benefit side follows the same rule, and the modelling behind it is covered in our enterprise framework for building an AI business case and our year-one business case refresh guide.

The second decision point also changes the conversation with vendors and consultancies. A supplier asked to quote against a staged approval has to show what it will deliver by the first gate, which is a useful test of its delivery. Our AI solutions catalogue lists six named enterprise AI solutions, each a specific placement a board can weigh on its own terms.

Who signs the paper, and where do SM&CR and the Cyber Governance Code fit?

The sponsor signs the paper, a named executive owns the placement after approval, and the board minutes its decision. In FCA-regulated firms the Senior Managers and Certification Regime already attaches individual accountability to the relevant senior manager; elsewhere, the Cyber Governance Code of Practice from DSIT, DCMS and the NCSC gives boards a voluntary reference for governing the digital risk an AI system adds.

Two points need care. First, SM&CR binds FCA-regulated firms and their senior managers, with PRA rules also applying to dual-regulated firms; it does not bind every company. Second, the 2026 reforms did not tighten it. The FCA's policy statement PS26/6, published on 22 April 2026, is phase one of a reform that aims to make the regime more efficient and proportionate while maintaining strong individual accountability; it reduces burden on items such as criminal record checks and the 12-week rule, and it contains no AI-specific measure. For a regulated firm, the practical point is simply that the AI placement should map to a senior manager whose statement of responsibilities already covers the business area it touches. If no statement covers it, that is a gap to fix before approval, not after.

For every other organisation, the Cyber Governance Code of Practice, launched on 8 April 2025 by DSIT, DCMS and the NCSC, is the nearest official reference for what a board should own on digital risk. It is a code of practice for board members, not a statute, and it is about cyber risk rather than AI as such. It is still useful for an AI approval, because a new model endpoint, a new data flow to a vendor, or a new agent with write access to business systems all change the organisation's cyber exposure, and the code is written so that board members govern that exposure themselves. Write the cyber section of the paper to answer the code's expectations and the security review stops being a separate negotiation.

The cleanest pattern is one accountable executive per placement, with the sponsor and that owner both named in the minute. The AI execution office model works this way: embedded delivery with production placements the client owns, and a named owner per ship.

What is the best way to structure an AI approval paper in 2026?

The best way to structure an AI approval paper in 2026 is around the evidence a later reviewer will need, not the case a sponsor wants to make. This guide uses five sections: owner and placement, understanding statement, controls touched, benefit measure, and kill criteria. Other structures work if they cover the same ground and a board can read them quickly.

There is no single right template, and it would be wrong to claim one. The criteria worth judging any structure against are these: it names one accountable owner; it states what the organisation cannot see inside the model; it answers the material control question for listed companies under Provision 29; it fixes a baseline and a date for the benefit; and it sets a second decision point. A paper that meets all five will survive a later review even if the investment does not.

Where you take help matters less than whether the paper meets those criteria. The large advisory firms, Deloitte, PwC, EY and KPMG among them, are a natural fit when internal controls assurance under Provision 29 is the central question, and a listed company with a heavy controls agenda may reasonably prefer one. Accenture and Faculty are options when the priority is a large delivery programme. An internal transformation office with a strong finance partner can write a perfectly good paper on its own. The case for a senior-led consultancy such as DATS is narrower: it is delivered by senior practitioners who ship code, not decks, with a named owner per ship, so the kill criteria are set close to the people who will deliver against them. The concession is real: if your constraint is controls assurance at scale rather than delivery, an audit-led adviser may suit you better. Our approach to placing AI inside enterprise systems sets out the delivery side of that trade-off.

The wider context helps the sponsor too. About 88% of organisations now use AI, yet only around 6% capture material EBIT impact, according to McKinsey's State of AI (November 2025). That gap is a reasonable argument for a staged approval with a kill criterion rather than a single large commitment. For the logic of designing measurement before the solution, see our note on value by design.

Frequently asked questions

Does a private company without a listing need an AI approval paper?

A private company is not bound by Provision 29, which applies to companies listed in the commercial companies or closed-ended investment funds categories, but its directors still owe the section 174 duty of care under the Companies Act 2006. An AI approval paper is the simplest evidence that the duty was met, so a private board benefits from the same structure even without a declaration to make.

The effort is also smaller than it sounds. For a private company the controls section can be a paragraph rather than a mapping exercise, and the rest of the paper is the same. A private company that reports to lenders or investors may also be asked how a large AI commitment was approved, which is a practical reason to have the paper ready. If you want to talk through what that looks like for your board, contact the DATS team.

Is an AI approval paper the same as an AI business case?

An AI approval paper is not the same as an AI business case, although it contains one. The business case argues that the benefit outweighs the cost; the approval paper records what the board was told, what it understood, which controls the system touches and what would stop it. A strong business case without those elements gives the board a forecast but no defensible decision record.

In practice the business case becomes the benefit section of the paper, and the other four sections are added around it. Sponsors who already have a good business case usually find the understanding statement and the kill criteria the hardest parts to write, because they require saying what is not known. Those are the parts a later reviewer is most likely to test. The embedded delivery model compared with project consulting explains why the owner of those sections should be someone who stays after go-live.

Can a board approve AI spend before the data is ready?

A board can approve AI spend before the data is ready, provided the approval paper says so and funds data readiness as the first stage with its own decision point. What a board should avoid is approving a build on the assumption that data quality will be resolved along the way, because an unresolved data dependency leaves the build with nothing reliable to run on when it reaches production.

The fix is structural rather than technical: split the approval. Fund the data work to a measured readiness threshold, then return to the board with the evidence before the model spend is released. That costs a second meeting, and it avoids releasing model spend before the data can support it. Where the organisation's existing estate sits on Azure, AWS or Google Cloud with a data layer such as Databricks or Snowflake, the readiness work belongs inside that platform rather than in a parallel stack, which keeps the evidence in systems the organisation already runs.

Want help writing the paper before the board meeting? See how the DATS consulting system works end to end, how an embedded AI execution office keeps a named owner on every placement, which productised AI solutions ship first, or read about DILR.AI and the operators behind it.

For more on board-level AI strategy, browse the strategy articles on the DILR.AI blog, revisit the DATS pillar guide to enterprise AI consulting for the director's question list, or see the metrics a board should receive after launch. To discuss a specific approval, book a scoping call.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.