Public sector organisations are increasingly enthusiastic about artificial intelligence (AI), but a recent review and report by law firm TLT (Public Sector AI Perspectives: The realities of AI adoption and implementation) found a substantial gap between AI ambition and operational readiness. Based on their research involving 100 senior leaders across central and local government, regulators and blue-light services, it concludes that successful AI adoption depends less on the technology itself than on governance, data, procurement, workforce capability and organisational resilience available to organisations.
Whilst supporting our larger clients on their AI implementation, it is clear that most AI systems depend on large volumes of data, often drawn from multiple systems including suppliers and often different service areas. Convergence of different personal data from various sources can readily expose the organisation to data breaches. These could include unauthorised access, relying on poor or outdated data quality, potentially unlawful processing through non-compliance with the key UK GDPR principle of ‘purpose limitation’, and a blurring of the audit trail of the source of the data.
Senior Information Risk Officers (SIROs) should treat the use of AI as a primary information risk issue and make sure that it isn’t simply viewed as an IT focussed issue.
As AI is introduced into organisations, particularly in the public sector, by its very nature it changes how information is collected, processed, shared and used to make decisions. Where personal data is involved, this creates new risks to the confidentiality and integrity of how it is used.
This in turn gives rise to new challenges around availability, lawfulness, fairness and can increase questions of public confidence; precisely the risks for which the SIRO is accountable.
And these risks are not limited solely to the AI model itself; new inputs, prompts, training qualities, outputs, records, integrations and third-party platforms can all create new and previously unseen information risks. As SIRO you should seek written assurances that introducing new AI systems or software is distinctly assessed across the whole data lifecycle, from procurement and data incorporation through to the operational, monitoring and deletion of personal data.
In our SIRO and Advanced SIRO training we reinforce the expectation that as SIRO you are accountable for the organisation’s overall information risk stance and for formally accepting any significant residual information risk on behalf of the Accounting Officer. Remember that accountability for information risk cannot be outsourced with a contract, nor shifted to the IT procurement managers.
The Information Commissioner’s Office (since 30 September 2026 now the ‘Information Commission’) emphasises a risk-based approach. SIROs must assess risks to individuals’ rights and freedoms arising from AI and implement proportionate technical and organisational measures to mitigate them. Where AI supports operational or consequential decisions, the SIRO should be able to evidence that risks have been identified, assessed, escalated and mitigated appropriately.
And whilst Data Protection Impact Assessments (DPIA) have seen a reduction in status and frequency over the past few years, for higher-risk users they remain a key governance tool to consider before deployment of any new AI driven process.
AI is rushing towards us all, here at BLS Stay Compliant we are testing some new software to assist our redaction services for our clients and have recently introduced new AI supported client management processes. We are carrying out our own DPIA with a priority to assess any specific new risks, particularly focussing on purpose, scope and the limitations of AI in adopting these new projects.
Key SIRO to do list:
- Examine and seek assurance from IT experts about the compliance and impact of any new security risk
- Document and clearly describe the risk assessment and appetite for each new use of AI
- Be watchful for how AI sources personal data
- Ensure robust testing of AI systems before deployment of new processes
- Remember your SIRO input is vital for high-impact decisions involving personal data
As ever retain records of key decisions based on briefings and analysis from IT experts, and ensure there are audit trails of any subsequent decisions
And perhaps the key SIRO duty – intervene where risks to personal data become too high to mitigate notwithstanding the remainder of the project team pushing for immediate implementation.
Summary
Here at BLS Stay Compliant we firmly believe that using personal data proportionally and where necessary is key to successful organisations. The introduction of AI and risk assessment process should not become a barrier that results in staff using AI in dark practices. Instead as SIRO you should be encouraging a transparent risk management process for staff to propose, assess and deploy AI tools.
By setting out clear thresholds and expectations for the use of DPIAs, risk assessments and Board level risk appetite levels, as SIRO you will support your organisation to safely adopt and harness AI with confidence.
