DAMA UK Case Study Makes the Case for Purchase Order Gateways and 10/20/70 Investment to Fix AI Governance's People Problem

What happened

Why it matters

• ·The Purchase Order Gateway model directly addresses regulatory exposure by making governance compliance a financial prerequisite, closing the common gap where AI systems are deployed before risk assessments or DPO reviews are completed, which creates retrospective liability under GDPR Article 22 and emerging AI-specific rules.
• ·The 10/20/70 allocation model exposes a structural operational risk: organizations that over-invest in AI technology relative to people and process controls are likely to fail governance audits not because frameworks are absent but because no one owns, understands, or applies them consistently.
• ·Formalizing DPO collaboration with AI governance teams is increasingly a regulatory expectation, not a best practice, as ICO guidance, the EU AI Act, and automated decision-making obligations under data protection law all require demonstrable accountability linkages between data privacy and AI deployment decisions.

Governance controls affected

What to do now

• ☐Audit your current AI project intake process to determine whether governance and DPO review gates exist before funding is approved, and implement a Purchase Order Gateway model if they do not.
• ☐Review your audit trail design for all active AI systems to confirm that decision logs are created at the point of deployment, not retrofitted after the fact, and that they meet tamper-evidence requirements.
• ☐Conduct a resource allocation review to assess whether your AI governance budget reflects a 70 percent weighting toward people and process, and identify underfunded areas such as reviewer training, governance ownership, and executive literacy.
• ☐Map your current governance program against both NIST AI RMF and ISO 42001 to identify framework gaps, and assign ownership for closing those gaps with a defined timeline.
• ☐Establish a formal collaboration protocol between your DPO and AI governance function, including shared review responsibilities for any AI system making or materially influencing decisions about individuals.

What to watch next

UK organizations should monitor ICO enforcement activity related to automated decision-making transparency, as the ICO's existing AI and data protection guidance creates an enforcement pathway that DAMA UK's recommendations are designed to address proactively. ISO 42001 certification activity is accelerating globally, and organizations that delay framework adoption risk being behind procurement and contractual requirements as enterprise buyers begin requiring certification as a vendor condition. Further DAMA UK guidance or sector-specific elaborations of the 10/20/70 model may follow, and compliance teams should track whether the Purchase Order Gateway concept surfaces in formal regulatory guidance or procurement standards from UK government bodies.