AI governance for smaller organisations: what a lean team does first

A small organisation should start AI governance with four things. List the AI in use with an owner for each tool, publish a short acceptable use policy, add one approval step for new AI that touches personal data or decisions about people, and assess the few systems that matter most. Most AI governance advice is written for large organisations with risk teams, legal departments and committees. A business with fifty people, or five hundred, has the same questions about AI and a fraction of the people to answer them. This guide sets out what a lean team should do first, what can wait, and how to keep governance light enough that it actually happens.

Why it matters at your size

Smaller organisations often adopt AI faster than large ones, because fewer approvals stand in the way. That speed is an advantage, and it also means tools get used before anyone has asked what data goes into them. The common problems are the same at every size. Staff paste customer data into public chatbots. An AI feature gets switched on inside a product without anyone noticing. A tool starts making decisions about customers or applicants that nobody reviews.

The consequences can hit a small organisation harder. One privacy incident, one discriminatory outcome or one customer due diligence questionnaire you cannot answer costs proportionately more when there are fewer people and less margin.

Step 1: Find what is in use and record it

You cannot govern what you do not know about. Start with a list.

• Ask each team lead what AI tools and features their people use, and for what.
• Check expense claims and software subscriptions for AI products.
• Check the main products you already use, such as your CRM, helpdesk and office suite, for AI features that are switched on.
• If you can, run a discovery scan across devices, code repositories or cloud accounts.

For each tool, record its name, the vendor, what it is used for, whether it handles personal information, whether it makes or influences decisions about people, and a named owner. A spreadsheet works to begin with. The AI inventory template has a fuller field list when you are ready for it.

Expect to find more than you thought. That is the point of the exercise, not a failure.

Step 2: Publish a short acceptable use policy

Write one or two pages that every staff member can read in five minutes. Cover four things.

• Approved tools. Which AI tools people may use for work, and how to ask for a new one.
• Data rules. What must never go into an AI tool, such as customer personal information, confidential client material or passwords, unless the tool is approved for it.
• Checking outputs. When a person must review AI output before it is used, especially anything sent to customers or used in decisions.
• Who to ask. The person who owns AI questions.

Keep it short so people read it. You can add detail later. The guide on AI governance policies covers the fuller set of policies a maturing organisation tends to write.

Step 3: Add one approval step for new AI

Put one named person in front of new AI that touches customer or staff data or makes decisions about people. Ask the requester a handful of questions. What is it for? What data will it use? Who does it affect? Will a person check its outputs? Who supplies it? Approve, approve with conditions or decline, and write the answer on the inventory.

Make the step fast. A small organisation’s approval should take days at most. If it is slow, people will go around it. Low-risk tools that touch no sensitive data can be pre-approved under the policy.

Step 4: Assess the systems that matter

You do not need to assess everything. Pick the two or three systems that handle personal information at volume or influence decisions about customers, applicants or staff. For each, work through what could go wrong across accuracy, fairness, privacy, transparency, security and dependence on the vendor, and write down what you will do about each real risk. The guide on running an AI risk assessment gives a method that takes a few focused hours per system.

The output that matters is the list of controls. Typical ones are short and concrete, such as a person reviewing every declined application, a vendor contract that stops the vendor training on your data, and a notice telling customers when they are talking to a chatbot.

Step 5: Set a light review rhythm

Once a quarter, the owner of AI governance should spend an hour on three questions. Is the inventory still accurate? Does the policy still fit how people work? Has anything changed in the assessed systems? When a vendor ships a new model, a system starts being used for something new or a customer complains, look again straight away rather than waiting for the quarter.

When a customer asks

For many smaller organisations, the first outside pressure on AI governance is a customer’s due diligence questionnaire. Larger customers increasingly ask suppliers which AI tools they use, what data goes into them, who is accountable and how incidents are handled. The four steps above give you the answers. The inventory says what you use. The policy says what data is allowed. The approval step shows new tools are looked at before use. The assessments show you have thought about the systems that matter. Keep those records tidy and a questionnaire becomes an afternoon’s work rather than a scramble. The guide on responding to an AI governance due diligence questionnaire goes further.

What can wait

A lean team should be deliberate about what it does not do yet.

• A formal management system or certification. ISO/IEC 42001 is valuable when customers ask for it or AI is central to your product. The foundations above are the work an audit would expect, so start there.
• A committee. One accountable person with the backing of the chief executive is enough at first.
• Detailed control libraries. Derive controls from your assessments rather than adopting hundreds from a standard.
• Every framework at once. Pick one framework as your reference. The NIST AI Risk Management Framework and Australia’s Guidance for AI Adoption both offer a practical starting structure, and the Guidance for AI Adoption comes in a Foundations version written for organisations getting started.

Check which laws reach you, though. Obligations attach by what you do, not by headcount. A small organisation that screens job applicants with AI in New York City, uses AI in decisions about people under GDPR, or deploys AI with an EU connection has duties regardless of size.

Where Aicura fits

Step 1 is the one a lean team struggles to keep up, and it is free in Aicura. The Register tier gives you the AI Register, discovery across the sources you connect, details filled in from a library of known AI products so nobody types a vendor’s details from scratch, an audit log, and system and agent reports. That replaces the spreadsheet without adding a process.

When you reach steps 2 and 4, Essentials adds governance policy templates and reviews, risk assessments that start when a system is registered, model cards (a factsheet for each model) and writing guardrail rules. Register, and Essentials for smaller organisations, are self-serve, so you can start without a sales conversation. Aicura supports the work and gives you guidance. It does not certify your organisation or give legal advice.