AI adoption continues to accelerate across both public and private organisations. In healthcare, three-quarters of surveyed public-sector organisations are already exploring or implementing generative AI initiatives.

One of the most significant tests of AI at scale is now approaching, with NHS England announcing plans to provide Microsoft 365 Copilot to roughly half a million clinicians and support staff. This isn’t happening in a vacuum. More than a quarter of surveyed GPs are already using AI tools in their clinical practice, making broader adoption a logical next step. The goal across healthcare is to reduce administrative burdens, improve efficiency, and give staff more time to focus on patient care.

The real test is no longer whether organisations can deploy AI. It is whether their governance can keep pace once they do.

The readiness gap

The more difficult question, however, is whether the surrounding environment is ready. Sixty-eight per cent of surveyed physicians said the NHS lacks the digital infrastructure needed to introduce AI effectively. The concerns are not limited to the technology itself. Training gaps, interoperability issues, patient safety and data privacy are all important parts of the readiness picture.

At the scale at which public-sector organisations operate, AI adoption requires governance that can keep pace with both the technology and the environment around it. This must include clear policies for data access, retention, accountability and human oversight.

That gap is not unique to healthcare. Private-sector organisations face many of the same readiness questions, even when the regulatory context, systems and consequences differ. 

Why existing governance models need to evolve

Many governance practices still rely on periodic reviews, where changes to systems and data access are assessed at defined intervals. That made it easier to track risk, document decisions and respond as regulation evolved. Human decision-makers were also more visibly positioned at the centre of many workflows, making informed judgment calls. 

AI changes those operating conditions. AI systems can retrieve, combine and summarise information at a scale that makes interaction-by-interaction human review impractical. At the same time, many organisations are adopting multiple tools across operational and governance functions. Similar information may be accessed through several systems, making it harder to maintain consistent visibility into what was used, by which tool and for what purpose.

The nature of the modern workforce compounds the challenge. Today, staff join, leave and move between teams, while organisations are regularly reshaped through restructuring, mergers and acquisitions. The problem of access no longer matching someone’s role or legitimate business need is not new.  Introduce AI into that environment, and existing data sprawl and oversharing become easier to discover and more consequential.

The recurring mistakes

A few patterns repeatedly undermine otherwise well-intentioned governance efforts. Organisations often lack a clear inventory of what sensitive data exists, where it lives, who owns it and who can access it. In large, long-established organisations, where information may have accumulated across decades of systems and restructures, this picture is rarely as tidy as teams assume.  Deploying AI into an environment that has not been properly assessed can amplify operational and reputational risk. 

Governance is also frequently treated as a pre-launch checklist rather than a continuous operational function.  Teams may invest heavily in preparation, but real-world use can surface behaviours, use cases and risks that pre-launch testing could not fully anticipate.

Many organisations are also layering multiple specialised tools that do not communicate effectively with one another. An organisation might use one platform for administrative automation, another for back-office processes and a third for access governance. Each tool may perform its individual function adequately, but together they can create fragmented oversight, duplicated effort and additional sprawl that is difficult to contain. 

The confidence-reality gap

There is a striking gap between how ready organisations believe they are and what their operating environments are revealing. ShareGate’s 2026 Microsoft 365 AI Readiness Survey of IT and security leaders found that 93% of surveyed IT and security leaders were confident their Microsoft 365 governance framework could support AI responsibly. Yet 29% reported that AI tools had already surfaced sensitive internal information that they believed should not have been accessible. A further 8% were unsure whether this had occurred.

The types of data being surfaced are not abstract.  They include contracts, employee records, strategic plans and customer lists. In a healthcare setting, that could mean an employee receiving an answer grounded in sensitive information they were technically permitted to access but no longer had a legitimate reason to see. 

With Microsoft 365 Copilot, one common issue is not a broken security boundary but an existing permission model that no longer reflects legitimate business need. The real issue is that those permissions are often broader, older, or less deliberate than leadership assumes. Permissions designed for human search and manual discovery were not created with prompt-based retrieval in mind. Information that once required someone to know where to look can now be surfaced through a single prompt.

When governance tools are fragmented and oversight is inconsistent, oversharing becomes a recurring pattern rather than an isolated incident. Remediation becomes slow and costly. The distinction that matters here lies in whether governance is reactive or proactive.  Organisations that establish and continuously review the right controls before and after deployment can reduce the likelihood and impact of data exposure, while avoiding the cost of remediating problems after trust has already been affected.

Getting the foundations right

The NHS Copilot rollout will be a major test for workplace AI at scale in the UK. Its success will depend as much on the governance surrounding it as on the technology itself.

That means organisations need to move beyond surface-level readiness checks. Effective governance starts with a thorough understanding of the existing environment: what data exists, where it lives, who owns it, and who can access it.  It requires collaboration across IT, security, legal, compliance, data and operational teams, with clear accountability for the decisions each group owns. It also requires scrutiny of the broader toolset: whether platforms work together, support consistent oversight and reduce more complexity than they introduce.   

Good governance isn’t a brake on AI adoption; it’s what makes fast adoption sustainable. By identifying risk earlier rather than responding after an incident, organisations give AI deployments a better chance to deliver. Teams can focus on efficiency, service improvement and better employee experiences rather than spending their time correcting governance problems that AI has made easier to see.

The goal is not more governance for its own sake. It is the confidence to use AI responsibly at scale.

HMRC is due to publish its latest Advisory Fuel Rates from September, with the quarterly review potentially changing how much employers reimburse staff for business travel in company cars.

The rates are also used to calculate how much employees should repay if they use company-paid fuel for private journeys.

While the changes are usually linked to fluctuations in fuel prices, experts warn that using outdated rates could lead to incorrect mileage claims and, in some cases, unexpected tax consequences.

What are HMRC’s Advisory Fuel Rates?

HMRC reviews the rates every three months to reflect average fuel costs for company cars.

They are designed to help employers reimburse staff for business journeys without creating additional tax liabilities and to calculate repayments where company fuel has been used for personal travel.

Joe Lytwyn, personal finance expert at thimbl.com, said: “HMRC’s Advisory Fuel Rates are designed to reflect the average fuel cost of running a company car for business journeys.”

He added: “They’re reviewed every three months because fuel prices don’t stand still, so it’s important that businesses keep up with the latest figures.”

One mistake many drivers make

Lytwyn said many employees wrongly believe the rates apply to everyone who drives for work.

He explained: “One of the biggest misconceptions is that the rates apply to everyone who drives for work. They don’t.”

Instead, the Advisory Fuel Rates only apply to company cars.

Employees using their own vehicles for work are covered by separate HMRC mileage rules.

Could you end up paying more tax?

Using the wrong reimbursement rate can have tax implications for both employers and employees.

Lytwyn said: “If an employer reimburses above HMRC’s Advisory Fuel Rate without being able to justify the higher cost, the excess could become taxable.”

He added that employees who receive less than the advisory rate “may be able to claim tax relief on the difference in some circumstances.”

Keep good mileage records

Experts also say poor record-keeping is one of the biggest reasons mileage claims go wrong.

Lytwyn said: “Poor record-keeping is probably the most common issue. People often forget to log journeys properly, or they mix business and personal mileage together.”

Keeping a record of where you travelled, why the journey was for business and the miles covered can help avoid problems if HMRC or your employer ever questions a claim.

Recommended reading:

What drivers should do before September

With fresh Advisory Fuel Rates expected from September, drivers are being encouraged to check that any future claims use the updated figures.

Lytwyn said: “Don’t assume the current rates will remain the same.”

He added: “Once HMRC publishes the updated figures, check whether your employer has updated its mileage policy and make sure any new claims use the correct rates.”

He also recommended keeping mileage records up to date throughout the year, making it easier to challenge incorrect reimbursements or claim any tax relief that may be due.

It’s worth noting that the September rates have not yet been published, so drivers should continue using the current HMRC Advisory Fuel Rates until the updated figures are officially released.

JOSEPH GABRIEL LAGONSIN

News Editor

Adclear found that 89% of the most-viewed social media posts promoting cryptocurrency trading did not comply with Financial Conduct Authority rules. The finding was based on an analysis of 57 Instagram and TikTok posts.

The review looked at posts promoting or advising on crypto products and found that most contained at least one issue under FCA financial promotion guidance. It comes as the regulator prepares a new set of compliance requirements for crypto firms operating in the UK from 2027.

Social media has become an important source of information for retail investors considering digital assets. FCA consumer research cited alongside the analysis found that 29% of people who buy cryptoassets use social media to research them before purchasing.

Risk warnings

The most common problem was the absence of risk warnings. Across all posts analysed, 56% made no reference to the financial risks of trading cryptocurrency.

The rate was higher on Instagram, where 69% of posts made no mention of risk. On TikTok, the figure was 43%.

The review also found that 54% of posts did not disclose that the content was an advert, sponsorship, or partnership. Another 40% lacked balance in how they presented the risks and rewards of investing in crypto, while 30% did not make clear that past performance is not a reliable guide to future outcomes.

A smaller share, 7%, was judged not to be fair, clear, and not misleading under FCA standards. The analysis also found that 11% of posts promised guaranteed returns, even though cryptoassets are widely treated as high-risk products.

Regulatory backdrop

The findings come as the FCA sets out a broader regulatory framework for crypto firms in the UK. The planned changes are expected to introduce tighter rules on financial resilience and market integrity as the sector moves into a more formal supervisory regime.

The context matters because online personalities have become a prominent channel for crypto marketing, particularly among younger consumers. A compliance gap in that channel could draw greater scrutiny as the regulator focuses more closely on how financial promotions are presented to retail audiences.

Adclear’s automated compliance platform reviewed 57 posts tagged with #crypto that were published over a little more than a year. It compared the results with FCA expectations for financial promotions and concluded that non-compliance was widespread among so-called cryptofluencers.

The group said crypto-related influencer content appeared more compliant than posts promoting buy now, pay later products in its separate work, but less compliant than broader financial influencer content. It did not provide detailed comparative percentages in the material released.

Industry response

Joe Jordan of Adclear said the research pointed to basic disclosure failures rather than complex legal issues in many cases.

“As retail investing continues to attract a newer, younger generation of investors, crypto trading is set to become an increasingly mainstream part of our investing landscape. This is an exciting shift, but it also means we should expect to see more people turning to social media for trading knowledge and advice.

“With new rules on the way, this is a great moment for cryptofluencers to double down on aligning with FCA guidelines. Our analysis shows that many posts can improve their compliance with simple fixes, such as risk warnings or fully transparent ad disclosure. It’s an encouraging reminder that compliance isn’t necessarily complex. With the right checks and proper awareness of the rules, financial content across social media can become more trustworthy and transparent for everyone,” Jordan said.

The research adds to a growing debate over the role of online creators in marketing financial products. UK regulators have stepped up scrutiny of influencer promotions across investments, credit, and digital assets, arguing that consumers can be exposed to misleading or incomplete claims when content blurs the line between personal opinion and paid advertising.

For crypto firms, the issue is likely to become more acute as the UK brings the sector further inside the regulatory perimeter. Any business relying on social channels to reach potential customers may face pressure to tighten oversight of paid partnerships and unaffiliated endorsements alike.

The findings suggest that, at least in the sample reviewed, many of the most popular crypto posts still omit the warnings and disclosures UK rules require when high-risk investments are promoted to consumers.