AI governance for small businesses, without the bureaucracy

What governance means at 30 people

In large organizations AI governance can mean committees, model inventories and audit programs. A small service business needs the same ideas at a fraction of the weight. Someone is accountable. You know what tools are in use. New uses get a quick look before they go live. Problems get noticed and fixed.

Done well, governance speeds adoption. Staff use AI more confidently when they know what is allowed, and owners approve new uses faster when there is a simple way to check them.

Clients are starting to ask, too. Larger customers, insurers and some professional bodies now include AI questions in security questionnaires and renewal forms. A small firm that can show its policy, register and review rhythm in a few pages answers those questions faster and more credibly than one that has to piece together an answer.

The five parts of a lightweight model

These five pieces cover most of what a small firm needs:

In a firm with fewer than 20 people, the owner and the policy may be the same person and the same page. That is fine, as long as the register exists and gets reviewed.

• An owner: one named person, often the operations lead or a managing partner, with authority to approve or stop AI uses.
• A policy: one or two pages covering approved tools, data tiers, review rules and how to request something new.
• A register: a simple list of each approved tool and use, kept in a shared spreadsheet.
• A risk check: five questions answered before a new use touches clients, money or decisions about people.
• A review rhythm: a short check every six months, plus a review after any incident.

The AI register

The register is the piece most small firms skip, and the one that saves the most confusion later. Keep one row per tool and use, with these columns:

• Tool and plan, for example Microsoft 365 Copilot Business, or Zapier Team.
• Use, for example "drafting proposal sections" or "tagging support emails."
• Users or teams with access.
• Data allowed: public, internal, client confidential, or regulated.
• Human review step: who checks the output before it matters.
• Vendor data terms: whether business data is used for training by default, and where you checked.
• Owner and date of last review.

A five-question risk check for new uses

Before a new AI use goes live, the owner answers five questions. Most uses pass in minutes. A few will need more thought or outside advice.

Write the answers in the register row for that use. If any answer is unclear, the default is to start with a smaller scope, such as internal use only or a human approving every output, and widen it once you have seen how it behaves on real work.

• What data goes in, and is the tool approved for that data tier?
• Who sees the output, and does anything reach a client, regulator or the public?
• Does it score, rank or recommend anything about a person in hiring, housing, credit, insurance or health care? In Colorado, SB 26-189 creates duties for those uses from January 1, 2027.
• Who reviews the output, and how would we catch a wrong answer?
• What happens if it fails or the vendor changes terms, and can we switch it off without disrupting clients?

Borrowing from established frameworks

You do not need to adopt a formal framework, but it helps to know they exist. The NIST AI Risk Management Framework is a voluntary US framework that organizes AI risk work into four functions: govern, map, measure and manage. In July 2024 NIST added a Generative AI Profile that lists risks specific to tools like chatbots and drafting assistants.

For a small firm, the useful translation is simple. Govern means an owner and a policy. Map means the register. Measure means tracking quality and incidents. Manage means acting on what you find. If a client or insurer asks how you govern AI, being able to point to these four in plain terms is a good answer.

Regulated firms should connect AI governance to the obligations they already have: written information security plans for tax and accounting firms, HIPAA policies for health practices, recordkeeping rules for advisers, and professional conduct guidance such as ABA Formal Opinion 512 for lawyers.

NIST notes that version 1.0 of the framework, released in January 2023, is being revised, so expect updated guidance. The four-function structure is a stable way to explain your approach in the meantime.

An illustrative register entry and incident log

A filled-in register row makes the idea concrete. For example, at a 30-person engineering firm: Tool, Microsoft 365 Copilot Business. Use, summarizing project meeting notes and drafting internal status updates. Users, project managers and principals. Data allowed, internal and client confidential, but not personnel matters. Review, project manager reads every status update before it is shared outside the team. Vendor terms, Microsoft states prompts and responses are not used to train foundation models, checked against its documentation in October. Owner, operations director. Last review, this quarter.

Keep a separate, short incident log with the date, what happened, who was affected, what was done and what changed afterward. Incidents worth logging include an AI-drafted email sent with a wrong figure, client data pasted into an unapproved tool, or an automation that sent duplicate messages. The log matters less as a record of blame than as the input to your six-month review.

Most small firms will log a handful of minor incidents a year. That is normal. A blank log usually means people are not reporting, not that nothing happened.

Making it routine

Put a six-month review on the calendar. In 30 minutes, the owner checks the register against what is actually in use, reviews any incidents, confirms vendor terms have not changed, and asks each team lead what they want to add. Update the policy if needed and tell staff what changed.

Track three numbers over time: approved uses in the register, open requests, and incidents. Rising use with flat or falling incidents is the pattern you want.

InTheory can set up the register, policy and risk check as part of an initial engagement and hand them to your owner to run. The goal is that you can run it without us.