DSIT AI Management Essentials (AIME): What Happened

AI Management Essentials (AIME) was a self-assessment tool that the Department for Science, Innovation and Technology (DSIT) put out for consultation in November 2024. It was aimed at SMEs, and it applied to any organisation that develops, provides or uses AI systems.

Many organisations still ask about it, because the consultation said government was exploring AIME for public sector procurement. That did not happen. In its response, updated on 6 February 2026, the government said it would not publish AIME as a finished tool, and so would not make it a requirement of procurement. DSIT itself was dissolved in July 2026, and AI policy now sits in the Cabinet Office.

The questions AIME asked are still the right ones. This article covers what it was, why it was shelved, and how to use it as a self-check.

The short version

AIME is not a requirement and not a certification. It was consulted on in 2024 and 2025, and the government decided not to publish it as a finished tool.
Its three themes still describe sensible governance: internal processes, managing risks, and communication.
Use it as a self-check, not a badge. If a customer needs something certifiable, ISO/IEC 42001 is the recognised standard.
Public sector bodies have a separate duty. The Algorithmic Transparency Recording Standard (ATRS) is mandatory for central government departments.
Replacement guidance is promised. The government said it would develop guidance on foundational AI governance, with a focus on SMEs. We had not found it published by 29 September 2026.

What it was, and what it was not

AIME was a structured questionnaire covering baseline good practice for managing AI systems. It was not a technical standard, not a certification, and not an assessment of whether a specific model is safe. It asked whether your organisation had sensible arrangements in place. The draft drew on ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act.

The government’s response said consultation feedback found that a tool ignoring organisation size and role could not meet the varied needs of different users. The response points to this as the problem.

The consultation draft remains on GOV.UK. It is worth reading, provided you treat it as a set of good questions and not as an official standard.

The three themes

1. Internal processes

Does the organisation have defined ways of working around AI, or does each team improvise?

In practice this means:

a policy that says which tools may be used with which data
a named owner for each AI system
a route to get something reviewed and approved
a decision record showing someone considered the question before deployment

The common gap is not the absence of a policy. It is a policy nobody can follow, so the real process is unwritten and invisible.

2. Managing risks

Have you identified what could go wrong, and is someone accountable for each of those things?

This is where generic technology risk registers fall short, because the AI-specific failure modes are not in them:

Incorrect output stated confidently. The model does not signal uncertainty the way a human expert would.
Drift. The world changes. The model does not. Performance degrades without anyone noticing.
Prompt injection. Untrusted content in a document or web page instructs the model. If your system reads external material and can take actions, this is a live vulnerability.
Over-reliance. Users stop checking, because the system is usually right.
Data leakage. Sensitive material reaching a tier of tool it was never classified for.

Each needs an owner, a control and a review date. “We are aware of hallucination” is not a risk entry.

3. Communication

Do the people affected know what is happening, and can they do something about it?

Internally: do staff know which tools are approved, and what they are accountable for when they use one? Externally: are customers or citizens told when AI is materially involved in a decision affecting them, and is there a route to challenge it?

This is the theme organisations score worst on, and the one that tracks harm most closely. Most AI failures that reach a complaint, a regulator or a newspaper involve someone who did not know the system was there and had no way to contest it.

How to work through it without turning it into a project

The self-check itself is not long. What makes it feel large is discovering how much you do not currently know. A workable sequence:

Week one: count what you have. Build the AI inventory first. Nothing else can be answered without it. Include embedded AI in tools bought as something else: the CRM’s lead scoring, the HR platform’s CV screening, the service desk’s auto-triage. This is where the surprises are, and where the highest-risk uses usually turn out to be.

Week two: answer accurately and record the gaps. The temptation is to answer aspirationally. An accurate low score with a dated remediation plan is far more defensible in front of a procurement panel than a high score you cannot evidence. Someone will eventually ask you to show the thing you claimed.

Week three: fix the cheap, high-value gaps. Usually that means naming an owner for each system and writing a policy that permits a compliant path. Add AI-specific entries to the risk register, and make sure someone can say “this decision was wrong”.

Then leave it alone until something changes. This is not an annual ritual. Revisit it when you deploy something new, when a supplier changes materially, or when a tender asks.

What to use alongside or instead

You need	Use
A certifiable AI management system	ISO/IEC 42001
To publish how a public sector algorithm works	The ATRS, mandatory for central government departments and for arm’s-length bodies that deliver public services
To handle personal data in AI systems	The ICO’s guidance on AI and data protection and DPIAs
To secure AI agents	The NCSC’s interim guidance, mapped in our OpenShell guide
A view of the legal position	Our guide to UK AI regulation in 2026

Should you bother?

Yes, and soon, if you sell to the public sector, you are in a supply chain that does, or AI governance questions have started appearing in your tenders and security questionnaires. The reason is now the questions, not the tool. Panels ask about AI governance whether or not AIME exists.

Yes, eventually, if you use AI on personal data at any scale. The artefacts a self-check asks for are largely the ones UK GDPR already requires, so the marginal cost is low.

Not yet, if your AI use is limited to individuals using a public chatbot for drafting, with no systems built on it. Write the acceptable-use policy and come back when that changes. It will, faster than you expect.

What it will and will not do

A self-check is a floor. Working through it will not make your AI safe, and it will not satisfy a sector regulator that has its own expectations.

What it will do is make you write down what you are running, who is accountable for it, and what you would do when it goes wrong. Most organisations discover, doing this, that they cannot currently answer the first question. That is worth finding out from a questionnaire rather than from an incident.

Frequently asked questions

Is AI Management Essentials mandatory?

No. The government decided not to publish it as a finished tool, and it is not a requirement of public sector procurement.

Is AIME a certification?

No. It was a self-assessment questionnaire. If you need a certifiable standard, look at ISO/IEC 42001.

What replaced AI Management Essentials?

Nothing yet. The government said it would develop guidance on foundational AI governance with a focus on SMEs. We had not found it published by 29 September 2026, so check GOV.UK.

Who is responsible for AI policy in government now?

DSIT was dissolved in July 2026. AI strategy, public sector AI adoption and the AI Security Institute now sit in the Cabinet Office.

Sources

Related reading: UK AI regulation in 2026 covers what binds you. If you would rather have the artefacts built than described, that is our AI governance and compliance service.

DSIT AI Management Essentials: what happened and what to do now