A Thousand Pilots, No Flight Plan: Governing AI Across the British Corporate Group

Something unremarkable is happening inside British holding companies, and that is precisely what makes it significant. In a marketing team in Leeds, a generative AI tool has been bought on a departmental card. In Bristol, an operations director has commissioned a predictive maintenance pilot with a niche vendor. In a shared service centre in Glasgow, a small group has built a document-summarisation workflow that now handles commercially sensitive material. None of these appears on a group-level register. Few were reviewed by anyone beyond the business unit that authorised them.

This is not recklessness. It is the predictable outcome of a governance vacuum. When the centre says nothing, subsidiaries fill the silence with sensible local decisions, taken at local speed, with local budgets. The difficulty is that a thousand sensible local decisions do not add up to a group capability. They add up to a fragmented estate.

The Pilots Are Not the Problem

It would be easy, and wrong, to read this as a discipline failure at subsidiary level. Most of these initiatives are modest, well-intentioned and genuinely useful. The people running them are closer to the work than any group function could be, and they are responding to real friction in real processes.

The problem lies one level up. A holding company that cannot see its own AI activity cannot govern it, cannot consolidate its buying power, and cannot recognise the one pilot in twenty that merits genuine investment. Visibility precedes judgement. Without a register of what is being trialled, where, with which vendors and on what data, the group centre is reduced to reacting to incidents rather than shaping a portfolio.

Three Costs of Ungoverned Experimentation

Data fragmentation. Each tool ingests and retains data in its own way. Customer records, contract terms and operational telemetry end up scattered across vendor environments that no one at group level has mapped. The commercial damage is gradual; the compliance exposure can be sudden.

Uneven compliance. UK GDPR obligations do not vary by enthusiasm. Nor do sectoral rules for firms in regulated subsidiaries, nor the phased obligations of the EU AI Act for groups with European operations, which have been arriving in stages through 2025 and 2026. Where each business unit makes its own assessment, the group inherits a patchwork of standards and a single point of reputational failure.

Redundant spend. Twelve subsidiaries negotiating twelve contracts for broadly similar capabilities is not innovation. It is procurement fragmentation dressed as autonomy, and it forfeits the leverage that a group structure exists to provide.

Governance Is Not Central Control

The reflex in many group centres is to announce a moratorium, appoint a committee and centralise approval. This usually fails, for two reasons. First, it drives activity underground: tools get used anyway, just less visibly. Second, it mistakes the purpose of governance. The objective is not to decide which AI tools a business may use. It is to make good adoption easier than bad adoption.

That distinction matters. Governance should remove friction from the right behaviours, not add friction to all behaviours equally.

Shared Infrastructure as the Enabling Layer

The most effective group interventions are unglamorous and mostly technical: a single identity and access framework, a common data classification standard, an approved vendor list with pre-negotiated terms, an enterprise agreement that lets a subsidiary start a pilot in days rather than months. Where these rails exist, local experimentation becomes safer and cheaper, and the centre gains visibility as a by-product rather than through a reporting burden.

A group that provides nothing but policy will always be circumvented. A group that provides the plumbing will be used.

Decision Rights: The Missing Architecture

Beyond infrastructure sits the harder question of who decides what. A workable model distinguishes between three tiers of activity. Local experimentation on low-risk, non-sensitive use cases should sit with the business, within published boundaries. Deployment into customer-facing or regulated processes should require a documented assessment and a named accountable owner. Group-level commitments — enterprise platforms, material vendor relationships, cross-subsidiary data sharing — belong at the centre.

Written down and communicated, this architecture gives subsidiaries speed where speed is safe and the centre control where control matters. Left implicit, it produces the worst of both: hesitation at the periphery and surprise at the middle.

A Portfolio Approach to Scaling

Scaling is where most groups lose the value they have already paid for. A pilot that works in one subsidiary is rarely adopted by its siblings, because no one owns the translation. A portfolio approach treats AI initiatives as a set of investments with uneven prospects: most are local efficiencies, a few are platform opportunities, and a small number justify group-wide deployment.

Reviewing the portfolio on a fixed cycle — not to approve or forbid, but to sort — gives the centre a legitimate role and gives the businesses a route to investment they would not secure alone. The discipline is in the sorting, and in the willingness to stop funding the pilots that have quietly proved nothing.

Alignment Without Uniformity

British corporate groups are well practised at producing policy and less practised at producing capability. AI governance will test that habit. The prize is not a single group-wide programme imposed from the top; it is a set of shared rails, a clear allocation of decision rights and an honest portfolio review that lets proven work travel.

Insight without alignment produces scattered pilots. Alignment without delivery produces frameworks no one uses. The groups that get this right will be those that treat governance as infrastructure rather than permission.