Most AI governance advice is written for banks and big tech. Small businesses need something lighter: a few clear rules that stop the most common mistakes without slowing people down. This page gives you exactly that.
The five rules that cover 80% of the risk
- Use approved tools only. Keep a short list of AI tools that the business pays for, with training switched off.
- Keep sensitive data out. No client confidential information, personal data, passwords or financial records in tools that are not approved for it.
- A human checks before it leaves the building. Anything AI drafts for a client, customer or regulator is reviewed by a person.
- Be open about AI. Tell clients when AI plays a material part in their work (see the client AI disclosure template).
- Report problems. If AI produces something wrong, offensive or leaks data, tell the owner the same day.
What to set up in one afternoon
- ☐ Name an AI owner.
- ☐ Adopt the AI acceptable use policy template and send it to everyone.
- ☐ List the AI tools people use today and check each one's SafeScore.
- ☐ Replace any tool that trains on your data with one that doesn't (see AI tools that don't train on your data).
- ☐ Start an AI risk register.
- ☐ Book a quarterly 30-minute review.
Budget-friendly controls
| Control | Cost | Why it matters |
|---|---|---|
| Business plan of your main AI assistant | Per user per month | Keeps your data out of training and adds admin controls. |
| Single sign-on through your email provider | Often included | Removes access when someone leaves. |
| Written policy and training | Free | Most AI incidents are human mistakes. |
| Quarterly review | 30 minutes | Vendors change terms often. |
Frequently asked questions
Do small businesses need ISO 42001?
Rarely at the start. Consider it if larger clients ask for proof of AI governance in tenders. The rules on this page are a good foundation for it.
What about laws?
Privacy laws such as GDPR already apply to personal data you put into AI tools. If you serve EU customers, check the EU AI Act checklist.