AI governance checklist small business: for 20 to 100 people

How to use this AI governance checklist small business owners can run

At a business of 20 to 100 people, AI governance is not a committee. It is a short list of decisions that someone owns, written down where staff can find them, and revisited on a schedule. The checklist below is grouped into seven areas. Score each line honestly: yes, partly or no.

Do not try to fix everything at once. A reasonable first target is to move every 'no' in the first three areas to at least 'partly' within a month. The later areas can follow over a quarter.

This is a practical aid, not a certification or a legal compliance test. Nothing in it tells you that you meet any standard.

Why 20 to 100? Below about 20, one person can usually keep all of this in their head. Above 100, you start to need function-level owners and more formal processes. In between, the business is big enough to hold information that matters and teams that do things differently, and small enough that nobody has a spare week to manage risk.

A useful way to run it: print the checklist, sit down for an hour with the owner of AI questions and one director, and mark each line together. Disagreements are informative. If the director says 'yes' and the owner says 'partly', you have found a place where the written position and the daily reality differ.

Ownership and accountability

In practice the owner of AI questions is often the operations manager, practice manager or head of finance. The title matters less than having enough standing to say no and enough time to answer within days.

Governance without an owner is a wish. These lines make sure someone is answerable.

• One named role (not a committee) owns AI questions and approvals, and every staff member knows who it is.
• A director or owner has agreed the business's position on AI use and will back the owner of the policy when it is inconvenient.
• There is a defined route for staff to ask 'can I use this?' with a promised response time.
• Someone has reviewed what clients, contracts and professional rules require of you on AI.

Know what is in use

You cannot govern what you cannot see. The inventory is the most useful single artefact on this list.

Do the inventory twice: once from the top down (what IT and finance know about) and once from the bottom up (what people say they use). The difference between the two lists is the finding.

• A tool register exists: tool, purpose, account type, users, information touched, approved or not, last reviewed.
• The register includes personal accounts, browser extensions and meeting recorders, not just what IT bought.
• AI features inside existing software (email, documents, accounting, CRM, helpdesk) have been identified and their settings checked.
• The register is updated whenever a new tool is requested and reviewed at least quarterly.

Rules and information handling

The policy itself can be short. What matters is that it is specific, readable and consistent with your other documents.

Classify information in your own terms. Many businesses find three levels is enough: open, internal and restricted. The restricted level is what the 'never enter' rule protects.

• A written AI use policy of a few pages exists, with a date and an owner.
• It names the information that must never be entered into AI tools, such as health details, payment data, credentials and privileged or confidential client material.
• Human review is required for anything sent out, signed or relied on.
• Business accounts only for work use, with training on your inputs turned off where the tool allows.
• The policy is consistent with confidentiality clauses, your privacy policy and client engagement terms.

Vendors and contracts

Most of your AI risk sits with other people's products. A few checks on each approved vendor go a long way.

For smaller vendors and start-ups, add one more check: what happens to your data if the company is sold or closes? Pay particular attention to tools that ask for a lot of access in return for a small convenience.

• For each approved tool, someone has read the terms on data retention, training on customer content, data location and breach notification.
• Admin controls are enabled: single sign-on and multi-factor authentication where offered, and access removed when people leave.
• Client contracts with AI clauses have been read, and you know whether you currently comply.
• There is a short process for retiring a tool and getting data out.

People and training

A policy that nobody understands is decoration. This area is where good intentions usually fall down.

Training does not have to be formal. A recurring ten-minute slot in a team meeting, built around one real example from the last month, is more effective than an annual module.

Include managers specifically. They are the people staff ask first, and if their answers differ from the policy, the policy loses. Give them a one-page guide with the five questions they are most likely to be asked and the agreed answers.

• Every staff member has been walked through the policy using examples from their own work.
• New starters get the policy and approved list as part of induction.
• There is some training on using the approved tools well, including how they get things wrong.
• Staff have been asked, safely, what they use and what they need, and the answers changed something.
• Staff know that reporting a mistake quickly will not be treated as misconduct.

Insurance, clients and incidents

This is the part people tend to think about only when someone sends a form.

Treat near-misses as valuable. The staff member who says 'I almost pasted the whole client file in' has just given you the best training case you will get.

Test the incident process once, on paper. Pick an invented case, such as a staff member pasting a client's tax file number into a personal chatbot, and walk through who is told, in what order, and what gets written down. The gaps show up in about twenty minutes.

• Your cyber policy wording has been read with AI in mind, and your broker has been asked in writing about anything unclear.
• The established cyber controls are in place and evidenced: multi-factor authentication, tested backups, patching, email filtering and a written incident plan.
• You can answer a client's supplier questionnaire on AI in a day, from documents rather than memory.
• There is a written process for AI-related incidents: who is told, who assesses whether privacy obligations are triggered, who talks to the client.
• Where personal information is involved, you know whether the Privacy Act applies to you and who checks that.

Review rhythm and where to start

Put three dates in the calendar. A quarterly 30-minute review of the tool register and open requests. A six-monthly read of the policy and vendor terms. And a review after any incident or any major client contract change.

If you are not sure how to score the early lines, start by finding out what is actually happening. Calibre Forum's survey is one way to do that: each person answers on their phone, the owner sees groups of three or more, and the report includes a tool register and a controls checklist with prioritised next steps and a 30, 60 and 90 day roadmap. It does not supply policies, training, monitoring or certification, so you would still write and run the rules yourself.

Finally, keep the checklist itself short enough to survive. A checklist that grows to fifty items will be filed. One that fits on a page will be used.

At the end of the first quarter, rescore the whole checklist. Where a line is still a 'no', ask why. Usually the answer is that nobody owns it or the effort was underestimated, and both are fixable.

Common questions

This guide is general information, not legal, insurance or financial advice. Check your own obligations with a qualified adviser.