Systems can prepare. People decide.
Specialist systems can extend research capacity, structure evidence and surface patterns. People define the question, test material claims, resolve uncertainty, approve recommendations and retain authority for every client communication and external action.
Frontier standard: no material recommendation, client commitment or external action is delegated to a system. This is an operating rule, not a statutory status or certification.
Adoption is rising faster than many organisations can demonstrate value or put effective controls in place.
The commercial question is no longer whether systems can produce work. It is which work they may prepare, which decisions they may inform and where accountable authority must remain.
ONS estimated that 30% of businesses were using at least one artificial-intelligence technology in September 2026, increasing to 51% among businesses with 250 or more employees.1 Separate government adoption research reported that many adopters perceived workforce-productivity gains while most reported no revenue change; human checking of outputs was common.2 Self-reported adoption and benefit are not causal evidence, but the gap between use and demonstrated commercial outcome is instructive.
The UK has no single general AI Act regulating every use. Existing data-protection, equality, consumer, competition, intellectual-property, confidentiality, contract and cyber-security duties apply in context. Government has signalled further rules for the most powerful systems, while parliamentary proposals remain proposals rather than current law.3
Businesses therefore need an operating model that remains useful while law and standards develop: bounded purpose, visible evidence, named decision owners and the ability to stop, correct and learn.
Assistance, recommendation and authority are not interchangeable.
The system prepares work for review.
Searching, extracting, classifying, comparing, drafting or proposing an action can increase capacity without transferring the decision.
The system or workflow proposes a judgement.
A recommendation may influence a person, so provenance, limitations, alternative explanations and the consequence of error must be visible.
A person or governing body owns the choice and consequence.
Authority includes the real discretion to reject, alter, pause or escalate, not merely pressing “Approve”.
Something leaves the controlled environment or changes a commitment.
Sending a message, making a submission, purchasing, publishing, changing a client system or committing resource requires attributable approval.
Public data is not unregulated data
Information about identifiable directors, employees, sole traders or contacts can be personal data even when publicly accessible. Purpose, lawful basis, necessity, proportionality, transparency, minimisation, retention and rights still require attention.4 Topic engagement may inform research; it must not silently become proof of identity, authority, budget or intent.
Meaningful human control is an operating design.
Solely automated significant decisions carry specific safeguards.
Changes commenced in February 2026 apply where decisions about identifiable people have legal or similarly significant effects and are based solely on automated processing. Safeguards include access to information, the opportunity to make representations, human intervention and the right to contest the decision.5
Limit: organisation-level research or a recommendation for a human client will not automatically fall within this boundary. Ordinary data-protection duties may still apply.A nominal reviewer may not provide meaningful involvement.
The Information Commissioner’s Office draft 2026 guidance says the reviewer should understand the logic and limitations, consider the underlying facts, review the case and have discretion to change the result.6
Status: the webpage remained draft at the evidence cut-off. It is used as developing regulatory guidance, not final law.Purpose, lifecycle control and intervention routes matter.
The government AI Playbook calls for meaningful human control at the right stages, lawful and secure use, testing, lifecycle management and plans for intervention.7 The Data and AI Ethics Framework adds traceability, least privilege, accountability and stop controls.8
Limit: both are public-sector guidance, not private-sector certification.Connected systems extend the attack surface and the consequence of untrusted content.
The National Cyber Security Centre recommends bounded, low-risk uses; least privilege; restricted tools, data and network routes; logging; named owners; short-lived access and an immediate shutdown route for agentic systems.9
Consequence: a system that cannot be monitored or contained should not receive authority to act.The human-directed research-to-action model.
Each stage states what specialist systems may prepare and what people must own.
- 01 · PurposePeople define the question.
Systems may retrieve context. A person sets purpose, scope, exclusions and permitted use.
- 02 · ResearchPeople choose and test sources.
Systems may search, extract and compare. A reviewer checks provenance and missing evidence.
- 03 · AnalysisPeople separate claim from inference.
Systems may surface patterns. A person resolves identity, contradiction and uncertainty.
- 04 · RecommendationPeople approve the judgement.
Systems may develop options. A decision owner tests alternatives and consequences.
- 05 · CommunicationPeople approve every material claim.
Systems may draft. A named person approves audience, evidence, wording and disclosure.
- 06 · ActionPeople authorise external effect.
Systems may prepare a reversible task. A person authorises sending a message, making a submission, purchasing or implementing a change.
A system finds a plausible expansion signal. A person decides what it means.
Several public sources indicate that a target organisation may be expanding operations.
A specialist workflow matches records, extracts dates and proposes that the change may affect demand for the client’s offer. It also drafts a possible contact approach.
Source links, dates, excerpts and possible contradictions are retained.
The interpretation is revised from “active opportunity” to “developing context”.
A future planning decision and accountable role become the next review triggers.
The system added value by reducing discovery and comparison time. The analyst added value by preventing entity and funding errors. The decision owner added value by matching the response to commercial capacity and risk.
Responsible intelligence should make work more usable, not merely more cautious.
Exceptions, contradictions and unresolved questions remain visible.
Human capacity is used where context and accountability matter most.
The organisation knows what may progress and what still needs proof.
Errors can be challenged and corrected, and the corrections propagated through affected work.
Automation should not erase the cost of judgement
A process may produce more outputs while reducing decision quality. Frontier therefore distinguishes production efficiency from commercial value. The outcome is stronger only when the work improves a relevant decision, reduces defensible handling cost or creates measurable movement without weakening control.
Questions every business should ask an intelligence provider.
- Who defines and approves each use case?
- What information may enter the system and what is prohibited?
- Can every material conclusion be traced to inspected sources?
- How are fact, inference, assumption and unknown kept separate?
- Which people can reject or alter a recommendation?
- Which communications and actions always require approval?
- How are personal data, objections and suppression records handled?
- How are access, credentials and client environments bounded?
- How is untrusted web, email or document content treated?
- What testing, monitoring and change records are retained?
- How can the system be paused, rolled back or disconnected?
- Who owns an error and how is it corrected across affected work?
Frontier red lines
Human-directed is not a certification.
This paper does not claim that technology-assisted work is error-free, unbiased or automatically lawful. It does not claim compliance with an international standard, government approval or a general UK AI Act.
Human review can also fail. A reviewer without evidence, time, competence or discretion is not a meaningful control. The design must show when review occurs, what the person sees, which authority they hold and how their decision is recorded.
UK rules will continue to develop. Final Information Commissioner guidance, possible legislation for powerful systems, agentic-system security work and EU obligations relevant to UK companies require monitoring through 2027–2030.
What would change the conclusion? A use case that affects an identifiable person, has significant consequences, handles sensitive information or can take external action should move to stronger legal, privacy, security and decision review before deployment.
Evidence and supporting sources used in this paper.
- Office for National Statistics, Business insights and impact on the UK economy: 8 October 2026, Wave 165. Voluntary survey and coverage limitations apply.
- Department for Science, Innovation and Technology, AI adoption research. Self-reported adoption and outcome measures; accessed 18 October 2026.
- House of Commons Library, AI regulation in the UK, 14 October 2026.
- Information Commissioner’s Office, What is personal data? and Legitimate interests. Accessed 18 October 2026.
- Data (Use and Access) Act 2025, section 80, and commencement regulations effective 5 February 2026.
- Information Commissioner’s Office, Automated decision-making guidance. Page described as draft at 18 October 2026.
- UK Government, AI Playbook for the UK Government, published 10 February 2025.
- UK Government, Data and AI Ethics Framework, updated 18 December 2025.
- National Cyber Security Centre, Managing the cyber risk of agentic AI, 20 August 2026, and Guidelines for secure AI system development.
- Frontier Insight Group synthesis. The six-stage human-directed model expresses Frontier’s operating standard; it is not a legal designation or third-party certification.
Method, accountability and reuse
Editorial method. This is an original Frontier Insight Group analytical paper based on research completed by 18 October 2026. It synthesises primary and authoritative public sources, regulatory material, disclosed industry research and, where stated, peer-reviewed or emerging research. The scope and material limitations of each source are recorded in the paper. Public-sector or professional frameworks are translated only where the boundary is made clear; they are not presented as proof of guaranteed outcomes.
Human responsibility. Research systems supported source discovery, comparison and quality checking. Editorial judgement, verification and publication approval remained under human direction.
Corrections. Material corrections or revisions will be dated and described in the version record. Evidence published after the cut-off belongs in a later edition.
Frontier Insight Group (2026). Human-Directed Commercial Intelligence: Where specialist systems add value while people remain accountable. Frontier Paper 05, version 1.0. Available at: https://frontierinsightgroup.co.uk/research/human-directed-commercial-intelligence/
Copyright and reuse© 2026 Frontier Insight Group. All original editorial analysis, frameworks, diagrams and presentation are protected. Short quotations with full attribution are permitted where lawful. Reproduction, adaptation or commercial redistribution requires permission. Third-party material remains the property of the relevant owner. Public-sector information is attributed to its source and used under the Open Government Licence v3.0 where applicable.
Professional boundaryThis publication is for general business understanding. It is not legal, financial, regulatory, procurement, investment or building-safety advice. Decisions should be tested against the organisation’s facts, duties, professional advice and decision rights.