Most AI governance advice is written for organisations with a compliance team and a dedicated AI lead. If you’re running a 5 to 50-person business, that advice doesn’t fit.
The ideas aren’t wrong, but nobody has the hours to build nine policies at once.
Here’s a smaller version: the same nine areas, broken into three stages, so you close the biggest risks first and build the rest as you go.
Stage 1: close the biggest gaps
Acceptable use. A plain list of what employees can do with AI without asking, what needs a check first, and what’s never allowed. Drafting an email: fine. Pasting a client’s personal data into a public AI tool: never.
Data rules. Not all data is equal. Public information can go into almost any approved tool. Client files and anything confidential need a tool that’s actually been checked first. Some things (passwords, anything going into your own product) shouldn’t go into AI tools at all.
Approved tools. One list, kept current: which AI tools are approved, which are on trial, which are blocked. Without this, people default to whatever’s on their phone, including personal accounts nobody’s reviewed.
Stage 2: control what gets added next
Use case approval. A short path for someone to propose a new way of using AI, have the risk checked, and get a yes or no before it goes live, not after.
Human oversight. The level of review should match the risk. Low-risk, routine work: AI drafts, a person skims it. Anything that affects a client, a decision, or money: a person makes the final call.
Vendor questions. Before signing with any AI vendor: where is our data stored, is it used to train their model, can we delete it on request, and what security certifications do they actually hold.
Stage 3: build trust and keep it current
Transparency. Telling people when AI was involved, whether that’s in a customer reply, in content, or in a decision that affects them.
Incident response. What happens when AI gets something wrong, or data leaks: who’s told, what gets paused, what gets logged, what gets fixed. Worth deciding this before you need it, not during.
Training and review. How people learn the rules, and how often the rules themselves get revisited. Not a one-off induction session, a habit.
None of this needs to happen in week one. Start with acceptable use, data rules and your approved-tools list. That alone closes most of the real exposure. The rest can follow in its own time.
If you’re not sure which of these nine you actually have in place, or want help shaping them to fit the way your business actually runs, that’s worth a conversation.
Reach out and we can help you work out what might be missing - Team@smoothopsservices.com