Responsible AI for UK Companies: Why Trust Is Your Fastest Growth Lever in 2026

Responsible AI now decides two things for UK companies: whether customers trust you enough to buy, and whether your own teams trust the tools enough to use them. Harvard Business Review calls it a growth strategy. Fair. But the version that pays off fastest happens inside your company, and almost nobody talks about that part.

By Toni Dos Santos, Co-Founder, Spicy Advisory. Published 4 August 2026, two days after the EU AI Act's transparency duties took effect.

What HBR actually said

In July 2026, Michael Wade and Jochen Wirtz argued in Harvard Business Review that trust is becoming a competitive advantage as AI gets embedded in products, services and decisions. Their point: Corporate Digital Responsibility has to grow up from a compliance exercise into a strategic capability.

The playbook has three stages. Know every AI system you run. Build governance in from the design stage. Then make your responsible practices visible to customers and regulators.

The examples they open with are the kind that end up in board papers:

• A robot toy maker fined by the FTC for harvesting children's location data without parental consent.
• SiriusXM facing a lawsuit over an AI hiring tool that allegedly screened out Black applicants using proxies like postcode and university, before any human saw a CV.
• Two Australian retailers caught running facial recognition on shoppers without proper notice.

Good article. One gap, though. It treats trust as something you build for customers and regulators. In every AI Diagnosis we run, the first people who need to trust your AI are your own employees. Miss that and the rest is theoretical, because there is no AI usage to be responsible about.

Where UK companies stand in August 2026

Short answer: the UK still has no single AI law, and you are still not off the hook. Three regimes apply at once, and they moved at different speeds this year.

1. The UK's own principles-based approach

Five principles (safety, transparency, fairness, accountability, contestability), applied by the regulators you already know: ICO, FCA, CMA, Ofcom. Each reads AI through its own lens. A lender answers to the FCA, a health tech to the MHRA. No single checklist, no single deadline, which sounds comfortable until you realise it means five rulebooks instead of one. Our guide to what the ICO expects on AI governance covers the baseline that applies to everyone.

2. The Data (Use and Access) Act 2025

The domestic change most UK companies underestimated. Since 5 February 2026, solely automated high-impact decisions are permitted on ordinary personal data, but only with four safeguards: notice, the ability to make representations, human intervention, and a right to contest. Special category data stays restricted. From 19 June 2026, every organisation needs a compliant complaints process. We broke the timetable down in our guide to the Data (Use and Access) Act and AI.

3. The EU AI Act, which reaches you anyway

If your AI system or its output reaches people in the EU (a customer, a candidate, a user of your SaaS), you are in scope. No EU entity, no EU servers, does not matter. The test is where your outputs land, not where your company sits. UK teams who lived through GDPR will recognise the pattern.

And the dates moved this summer, in both directions, when Regulation (EU) 2026/1744 (the Digital Omnibus on AI) entered into force on 27 July 2026. We covered exactly what the Digital Omnibus changed. The short version:

The penalty regime is active alongside it: up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for other breaches. For most UK mid-market firms the ceiling is theoretical. The real cost is switching off a customer-facing service while you fix it.

So the honest summary for a UK mid-market company: three regimes, deadlines that moved twice in one year, and regulators on both sides of the Channel now expecting you to know what AI you run and to say so out loud.

My take: trust is an adoption problem before it is a legal one

The pattern we see in AI Diagnosis missions, again and again. Companies buy the licences: around 91% invest in AI. Then roughly 21% of employees use those tools in their actual work. The 70-point gap in between is where governance quietly decides everything.

Because when there are no rules, two things happen.

Your careful people do nothing. They would rather skip the tool than get in trouble for pasting client data into a chatbot, so the licence sits there, paid and unused.

Your less careful people use whatever they want on personal accounts, which is how you get shadow AI, zero oversight, and exactly the incidents the silence was supposed to prevent.

Both outcomes are worse than the risk. And both are fixed by the same thing HBR is asking for. It is the first structural cause we find when AI adoption fails in a company: it is almost never the tool.

That is why I read their playbook as an adoption playbook wearing a legal costume. An AI inventory tells your teams what is approved. Governance by design tells them what is safe. Visibility tells customers you are not hiding anything. Same three moves, double payoff: one for the regulator, one for your Monday morning usage stats.

“An AI policy does not create trust. It removes the reason to be afraid. That is a different thing, and it is enough to unblock usage.” — Toni Dos Santos, Co-Founder, Spicy Advisory

What the law actually says about training, precisely

Worth being exact here, because a lot of coverage has been wrong since July. Article 4 of the EU AI Act required, from February 2025, that deployers ensure a sufficient level of AI literacy among the people using these systems. The Digital Omnibus rewrote it into a duty to take measures to support the development of that literacy.

An obligation of effort, where there was an obligation of result. It still binds every deployer in scope, including a forty-person company, and national supervision starts on 3 August 2026. You still have to show your work. Our piece on the Article 4 AI literacy obligation sets out the evidence to keep.

What has not changed: training your people stopped being a nice-to-have the moment your chatbot answered a customer in Lyon.

What this looks like in practice: four moves

1. Inventory everything, amnesty first

One spreadsheet, one afternoon per department. Every AI tool in use, including the ones IT does not know about.

You will only get honest answers if the exercise is framed as “we want to make this safe to use”, not “we are checking who broke the rules”. Say it explicitly, in writing, before you start. The shadow AI list is the most valuable page of the whole exercise, because it shows you what your teams actually want, and therefore which use cases deserve an official version.

2. Write guidelines a human would read

One page. What is approved, what data never leaves the building, who to ask when unsure.

A 40-page AI policy signed in the onboarding portal protects the lawyers and changes nothing else. The one-pager on the wall changes behaviour. If your policy does not fit on a page, it is not describing rules, it is describing anxiety.

3. Train on real work, not on tools

Sessions built on the team's own use cases: the sales follow-up, the monthly report, the candidate shortlist.

Fold the “why” of the rules into the training and you cover the Article 4 duty on the way, instead of running a separate legal webinar everyone mutes. Start with the executive team: C-suite AI literacy sets the speed of everything downstream.

4. Say it out loud

A responsible AI page on your site, a paragraph in your sales deck, an answer ready for the procurement questionnaire.

UK buyers ask now. In competitive RFPs, the supplier who can explain their AI governance in plain English wins against the one who says “we take this very seriously” and goes quiet. This is the point where the HBR thesis turns into a revenue line rather than a cost line.

Where this bites first for UK companies

The part nobody budgets for

A governance document does not create trust. Behaviour does.

AI adoption is a behaviour change problem, and behaviour does not change because a PDF got signed. It changes when someone shows a team, on their own work, what safe and useful looks like. That line item appears in no compliance budget, and it is the one that determines the return on your licences.

Next Thursday, ask five people from five different teams which AI tools they used this week, and whether they would tell their manager. The answers are your real responsible AI status, whatever the policy folder says.