Summary

  • GovS 005 version 2.2 broadens the standard’s scope language and adds AI considerations across governance, strategy, assurance, services, technology, data and risk.
  • The document places risk ownership in existing government roles that report through the accounting-officer line; publication does not show how departments have implemented the changes.

A small label, a wider control surface

The UK Government published an update to its digital functional standard on 1 October. The linked 45-page PDF is version 2.2, dated September 2026. Its opening note calls the revision a “minor update”, then describes a broader shift: from a digital, data and technology focus to a government digital-and-data standard, with stronger lifecycle management, governance and accountability and extensive new material on AI.

That wording matters because the change is not framed as a stand-alone AI rulebook. GovS 005 treats artificial intelligence as part of the government’s digital and data operating system. The revision threads AI through governance, strategy, assurance, service management, technology, data and risk management. The GOV.UK update record summarizes the change as proportionate AI and Knowledge and Information Management references throughout the standard, alongside new terminology.

The accountability chain is specific. An accounting officer is responsible for ensuring the organisation’s digital-and-data strategy is appropriate. A senior officer accountable for the organisation’s portfolio reports to that accounting officer and is responsible for the governance framework, strategy, plans and risk within the organisation’s appetite. The same portfolio role must ensure AI-related risks are identified, owned, assured and managed within that appetite and the organisation’s legal obligations.

Other roles carry distinct duties. The data lead is responsible for the quality, provenance and governance of information used by AI systems, including monitoring for bias, performance effects and drift. The technology lead covers the secure, resilient design, procurement, deployment and monitoring of AI-enabled solutions. The standard also describes assurance at operational, senior-management and independent levels. This is a management chain, not a new AI regulator.

GovS 005 is the approved reference for government departments and arm’s-length bodies, and its scope also reaches other organisations already covered by a government functional standard. It is not an Act of Parliament or a replacement for data-protection, security or other legal duties. The standard itself distinguishes “shall” requirements from “should” recommendations and assumes legal and regulatory requirements are met.

What the publication establishes is the revised framework, not compliance in practice. It does not report which departments have updated their plans, identified every relevant AI system or changed procurement controls. Those outcomes remain to be evidenced by each organisation’s governance and assurance work.

Sources