Your AI Policy Is Now A Sales Document.

The deadline a founder hears about is the wrong one. The European Union's obligations for the high risk systems listed in Annex III of the AI Act moved to 2 December 2027 when the Digital Omnibus on AI entered into force on 27 July 2026, and the United Kingdom has no cross-sector AI statute in force. What did not move is the question in the next supplier review. Around a third of UK businesses are now using artificial intelligence, adopting it or considering it, and of those, 24% report having any security practice in place to manage the risk of doing so, according to the Cyber Security Breaches Survey published by DSIT and the Home Office on 30 April 2026. The distance between those two figures is where deals are now slowing down. A company that can state in two pages which models touch customer data, on what basis, and who signed it off is not better regulated than the competitor who cannot. It is faster to buy from, and in a competitive process that is the advantage.

Situation

Two things happened this year that changed what a smaller supplier is asked for, and neither was a rule requiring anything of smaller suppliers.

The first was in Brussels. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, the third day after publication rather than the usual twenty, expedited ahead of the AI Act's own 2 August 2026 application date. It moved the application date for the standalone high risk systems listed in Annex III from 2 August 2026 to 2 December 2027, and for high risk AI embedded in products already covered by EU product safety law to 2 August 2028. The transparency duties in Article 50 were not deferred and applied from 2 August 2026. A transitional period to 2 December 2026 applies to one of them only, the machine readable marking obligation in Article 50(2), and only for systems placed on the market before 2 August 2026. The other Article 50 duties, including disclosure that a person is interacting with an AI system and the labelling of deepfakes, bind from 2 August 2026. A deferral is not a repeal, and the obligations that were deferred were never the ones most smaller suppliers face.

The second happened quietly in Westminster, and it matters more. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force on 12 May 2026. They require the Information Commissioner to prepare a statutory code of practice on the development and use of AI and automated decision making, including the processing of children's personal data. Section 124A(4) of the Data Protection Act 2018 obliges the Commissioner to consult the Secretary of State first, and section 124B requires an expert panel, publication of the code in draft before that panel begins, and publication of the panel's report. So there will be a visible draft before there is a code. What the Regulations do not set is any date by which the code must exist. Separately, in its December 2025 response to the consultation on AI Management Essentials, DSIT confirmed it will not publish the tool and will not make it a procurement requirement, while saying it intends to produce refined guidance aimed primarily at smaller companies.

Guidance does exist, and a cyber security firm should say so plainly. DSIT published the AI Cyber Security Code of Practice on 31 January 2025, with a fifty page implementation guide reviewed by DSIT and the NCSC, and submitted it to ETSI as the basis for the standard TS 104 223. It is voluntary, it sets baseline security principles for organisations that build and deploy AI systems, and it is the most useful thing a UK supplier can align to today. What it is not is an assurance instrument. There is nothing in it a buyer can verify: no certificate, no attestation, and no self assessment the government will stand behind, since DSIT withdrew the one it had drafted. So a UK company of 20 to 200 people can point at good guidance and at nothing a procurement team will accept as proof. It also has customers who have decided they cannot wait for one. The same breaches survey records that 48% of large businesses review the cyber security risks posed by their immediate suppliers, against 30% of medium, 22% of small and 12% of micro businesses. The organisations doing the reviewing are, almost by definition, the ones a scaling supplier most wants as customers.

Insight

The commercial event of 2026 is not the arrival of an AI rule. It is the absence of one, and what fills the vacuum.

When a government publishes guidance but no certifiable baseline, the baseline does not cease to exist. It is written instead by whichever buyer has the most leverage, and differently by each of them. The same pattern has run through security questionnaires for a decade: with no universally accepted artefact, every enterprise buyer builds its own template and the supplier pays the cost of translation. The difference with AI is that the questions are newer, the people asking are less certain what good looks like, and the answers are therefore read with more suspicion, not less.

That reframes the cost. A founder treating this as a compliance problem asks what the rules require and concludes, correctly for now, that very little is. A founder treating it as a sales problem asks how many times this year somebody with a signature pending will ask us to describe our use of AI, and what each of those conversations costs in days. The second question has an answer that can be reduced, and reducing it does not require a certificate.

The asset that reduces it is unglamorous: a written AI use policy, a register of which systems and models are in use and what data reaches them, a named owner, and a short answer set a salesperson can send without routing the request through an engineer. Written once, it answers the whole class of question rather than one instance of it. That is why it belongs in the sales file and not only in the policy folder.

Options

Option A, answer each request as it arrives. No standing artefact. The founder or the lead engineer drafts a response to each buyer's AI section when it appears, usually once legal has already cleared the contract. Cost is zero until the first request, then recurs in full every time, falling on the two people least able to spare a week.

Option B, certify to ISO/IEC 42001. The international standard for an artificial intelligence management system, published in December 2023, is the one AI framework a certification body can certify a company against and a buyer can verify, in the same way ISO 27001 works for information security. It also carries a management system's full weight: documented scope, risk and impact assessment, internal audit, management review, surveillance visits, and a multi month path to a first certificate.

Option C, build the evidence layer without certifying yet. Produce the policy, the register and the answer set, and map them to the clause structure of ISO/IEC 42001 and to the controls already evidenced under ISO 27001 or Cyber Essentials, so the work counts toward certification if a buyer later demands one. Timeline is weeks. The output is evidence rather than a certificate: it satisfies a questionnaire and a diligence request, not a procurement gate that names a standard.

Trade-offs

Option A is not irrational for a company with one enterprise customer and no pipeline behind it. It becomes expensive where two or three reviews run concurrently, which is also the point at which the company can least afford its engineers writing prose. Its cost is hidden in the sales cycle rather than visible on a budget line, which is why it survives longer than it should.

Option B buys the strongest answer and buys it slowly. Where a pipeline contains a public body, a financial institution or a large health provider that has already named the standard in a tender, that is the right expenditure. Where buyers are asking questions rather than naming standards, it is a certificate purchased ahead of the demand, and the months spent obtaining it are months during which the questions still arrive unanswered.

Option C carries one weakness, which should be stated plainly rather than managed away: it produces no third party attestation. A buyer who wants independent assurance will not accept a well written internal policy as a substitute, and a supplier who implies otherwise loses credibility at exactly the wrong moment. What it does is remove the delay from every review that is asking questions, while leaving the company one deliberate step from certification rather than twelve.

A sequencing point cuts across all three. An AI register is only as good as the controls underneath it. A policy stating that customer data is not sent to external models is an assertion about access control, logging and egress, and a buyer's technical reviewer will test it as one. Writing the policy before the controls exist produces a document that fails on contact.

Recommendation

For a company of 20 to 200 people with no named standard in its pipeline, build Option C now and hold Option B as a triggered decision.

Concretely, that means four artefacts and one trigger. An AI use policy of no more than three pages, stating what staff may use, what customer data may reach a third party model, what must be approved, and what is prohibited. A register listing every AI system in use across product and internal operations, the data it touches, the supplier behind it, and whether customer data leaves the company's control. A named accountable owner at executive level, because every serious buyer question resolves to who decided this. A standard answer set of ten to fifteen responses drawn from the policy and the register, held where the sales team can reach it. And the trigger: the first time a buyer or tender names ISO/IEC 42001, or the first time an existing customer's renewal makes an AI attestation a condition, the certification programme starts that quarter rather than being debated.

Map the four artefacts to ISO/IEC 42001's clause structure as they are written, not afterwards. The marginal cost at the point of drafting is close to nothing. Retrofitting it later is a second project.

Why

The case rests on three numbers and one piece of timing.

The 24% matters most, and it cuts two ways. It means most competitors in a given process will answer badly, which is where the advantage sits. It also means the buyer asking the question has probably not solved it internally either, so a supplier who can describe a coherent position is doing the buyer's own work for them. The 31% sets the size of that opportunity, since it is the share of the market that will be asked. The 48% says who is asking: supplier review is now normal behaviour among exactly the customers a scaling company is trying to win, and AI has been added to those reviews faster than any assurance artefact has been created to answer them.

The timing is the part most often misread. The EU deferral to December 2027 and the absence of a UK statutory code read, to a founder with a product to ship, like permission to wait. They are the opposite. A regulatory deadline is a date by which everyone must comply, and it therefore levels the field. A buyer's questionnaire has no date, arrives without warning, and rewards whoever is ready first. The window in which being ready is a differentiator closes when the baseline finally publishes, because at that point the answer becomes a commodity. Until then it is worth something.

Risks

Five risks are worth naming, and none of them is the risk of a fine.

The first is shadow adoption. A register compiled by asking department heads what tools they use will understate reality, because staff adopt assistants individually and often through the free tier of a product the company has no contract with. A wrong register is worse than none: an inaccurate answer to a buyer is a representation, and one that proves false during a technical review damages more than the deal in front of it.

The second is decay. An AI register is a snapshot of a fast moving set of suppliers, and a document accurate in October is not accurate in March. Without a review cadence tied to something that actually happens, such as the quarterly management meeting, it goes stale in silence.

The third is overclaiming. The temptation in a questionnaire is to answer the question the buyer should have asked. A statement that no customer data reaches a third party model must be true of every integration, including the support desk and the sales tooling, or it should not be written.

The fourth is a policy that prohibits everything. A document banning the use of AI assistants outright is easy to write, impossible to enforce in a company whose engineers are already using them, and actively harmful: it converts visible use into hidden use, and the next review finds the gap. A policy that permits specified use with named conditions is harder to draft and is the kind that holds.

The fifth is the deferral itself. The Annex III date moved to 2 December 2027. Article 50 did not move. A company placing a product on the EU market that generates or manipulates synthetic content has had obligations since 2 August 2026, and the only relief is a transitional period to 2 December 2026 for the machine readable marking duty in Article 50(2), available solely to systems placed on the market before 2 August 2026. Reading one deferral as a general reprieve is the error most likely to produce a real compliance failure out of what is otherwise a commercial exercise.

Next Move

The first step costs nothing and can be done this week. Take the last three enterprise deals or renewals, pull out every question that touched artificial intelligence, model use or customer data leaving the business, and count the working days between the question arriving and the answer being sent. That number is the asset value of the policy, and it is usually larger than expected.

Garzon Cyber Solutions is built to carry the whole sequence rather than one part of it. The security foundations come first, delivered with specialist technology partners, because an AI policy is a statement about access control, logging and egress and has to be true before it is written. The compliance and certification layer then maps that evidence to what insurers, enterprise buyers and assessors are actually asking for, whether that is an AI use policy and register answering a questionnaire this quarter, readiness for ISO/IEC 42001, or the ISO 27001 and Cyber Essentials evidence the AI questions sit on top of. Where the company then needs a permanent owner for that file, we recruit on contingency: nothing is payable until the candidate accepts and starts. We are a young firm, and we built it on the view that these three capabilities are worth considerably more delivered in order than bought separately.

Confidence note

Confirmed. That Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, moving Annex III high risk obligations from 2 August 2026 to 2 December 2027 and Annex I to 2 August 2028, while Article 50 applied from 2 August 2026, its transitional period to 2 December 2026 covering only the Article 50(2) machine readable marking duty and only for systems placed on the market before 2 August 2026. That SI 2026/425 was made under sections 124A(1) and (2) and 124B(11) of the Data Protection Act 2018, that section 124A(4) requires the Commissioner to consult the Secretary of State before preparing a code, and that section 124B requires an expert panel, publication of the draft code and a statement on panel selection before the panel begins, and publication of the panel's report or a summary. That DSIT published the AI Cyber Security Code of Practice on 31 January 2025 with a fifty page implementation guide reviewed by DSIT and NCSC officials, that the Code sets baseline cyber security principles for organisations that develop and deploy AI systems, and that DSIT stated it would submit the Code and guide to ETSI as the basis for the standard TS 104 223. Those Regulations were made on 16 April 2026 under provisions inserted by the Data (Use and Access) Act 2025, came into force on 12 May 2026, require the Commissioner to prepare a code of practice giving guidance as to good practice in the development and use of AI and automated decision making, require that code to include guidance on the processing of children's personal data, and set no completion date. That DSIT, in its government response on AI Management Essentials published in December 2025, stated it will not be publishing the tool and will not be making it a requirement of the government procurement process, and that it intends to produce refined guidance focused primarily on supporting smaller companies. That the Cyber Security Breaches Survey 2025/2026, published by DSIT and the Home Office on 30 April 2026, reports that around a third of businesses (31%) were either using AI, in the process of adopting it or actively considering it, that 24% of that group, not of all businesses, reported cyber security practices or processes in place to manage the risks from the use of AI, and that 15% of businesses overall reviewed the risks posed by their immediate suppliers, comprising 12% of micro, 22% of small, 30% of medium and 48% of large businesses. That ISO/IEC 42001, the international standard specifying requirements for an artificial intelligence management system, was published in December 2023. That the NCSC's machine learning principles include securing the supply chain and managing the full life cycle of models and datasets.

Assessed. That the absence of a certifiable UK baseline causes enterprise buyers to write their own AI assurance questions, producing variation between templates, is our assessment from procurement practice and from the pattern established by security questionnaires, not a measured finding. That a policy, register, named owner and standard answer set materially shorten a buyer's AI review is our assessment, since no published study measures the effect. That buyers in regulated sectors are more likely to name ISO/IEC 42001 in a tender is our assessment from how certification requirements have historically propagated. That the current window is one in which readiness is a differentiator is an assessment about competitive behaviour, not a forecast of regulatory timing.

Not known. When the Information Commissioner's statutory code on AI and automated decision making will be published or what it will require of suppliers, since the Regulations set no date. What form DSIT's refined guidance for smaller companies will take, or whether it will be referenced in procurement. What proportion of UK enterprise security questionnaires now contain an AI section, since no published figure measures it. How many UK companies hold ISO/IEC 42001 certification. Whether the Annex III date of 2 December 2027 will hold, given that it has already moved once. When the Commissioner will publish the draft code and convene the panel, since no timetable has been announced.