How to Create an AI Governance Framework for a Small Company

What is an AI governance framework, and why is a policy not enough?

An AI governance framework is the set of roles, rules, records and routines a company uses to decide which AI uses are allowed, under what conditions, and how it checks they stay safe and useful. The policy is one document inside it. The framework is everything that makes the policy true on a Tuesday morning when someone wants to paste customer emails into a chatbot.

Most small companies start with a one-page policy that says staff should use AI responsibly and protect confidential information. Nobody disagrees with it, and it answers none of the real questions. Which tools are approved? Can personal data go into the AI feature that just appeared in the help desk? Who decides? What happens when something goes wrong? A framework answers those questions with a named owner, a list, a grading system and a few forms.

The pressure to answer them is growing. Stanford's 2026 AI Index counted a record 362 reported AI incidents in 2025, up from 233 in 2024. Regulators are also moving: the EU AI Act has required providers and deployers to take measures to support AI literacy among their staff since 2 February 2025, and other countries are adding rules on automated decisions and data protection that reach AI use.

Which principles should an AI governance framework rest on?

You do not need to invent principles. The OECD AI Principles, adopted in 2019, updated in 2024 and now backed by 47 adherents, give five values-based principles: inclusive growth and well-being; human rights and democratic values including fairness and privacy; transparency and explainability; security and safety; and accountability. They were written for governments, and they translate well to a company.

The trick is to turn each principle into a commitment someone could break. 'We value transparency' cannot be breached. 'We tell customers when they are talking to a bot' can. A short list of testable commitments is far more useful than a page of adjectives, because each one creates a job: a disclosure, a data rule, a bias check, a named owner.

• People stay accountable: every AI use case has a named owner
• Fairness is checked, not assumed, wherever AI touches decisions about people
• We say when AI is involved, to customers and to staff
• Data goes only into tools approved for that class of data
• Outputs are reviewed in proportion to risk
• We report and learn from AI mistakes without blame

Who should own AI governance in a small company?

One named person should run it day to day. In a small company this is often the compliance lead, the data protection lead, the IT or security manager, or an operations head. The AI owner keeps the inventory current, runs intake, chases reviews, logs incidents and reports to the committee. They do not need to be an expert on every tool.

Alongside the owner, a small committee of five or six people meets for about 45 minutes a month: a chair with authority (often the CEO), the AI owner, and leads for security, HR, finance and one business area. Write decision rights by risk tier into a one-page charter so everyone knows who can approve what. The Institute of Internal Auditors' three lines model is a useful check: the people who use AI own their use cases, the AI owner and committee set rules and monitor, and someone independent reviews the programme once a year. Nobody should approve their own use case.

How do you build an AI inventory?

You cannot govern what you cannot see, and the AI in a company is almost always more than anyone expects. It includes standalone tools people log into, AI features inside software you already pay for (help desk reply drafting, CRM scoring, recruitment screening, meeting recorders), small in-house scripts that call an AI service, agents that take actions, and AI in any product you sell.

Build the list in four moves. Survey all staff with a plain promise of no blame. Scan IT's subscription and single sign-on lists, finance's card statements and the admin settings of your main platforms. Verify each entry with its owner in five minutes. Record one row per tool with owner, data classes it receives, whether the vendor trains on your data, where data is stored, approval status and review date. Treat newly found 'shadow AI' as information, and make the approved route faster than the unofficial one.

How should you grade AI use cases by risk?

Risk tiers stop governance from becoming either useless or hated. A tool that rewrites a paragraph and a tool that decides whether a customer gets a refund should not go through the same process. Grading by risk is the common language of the field: the EU AI Act sorts systems into prohibited, high-risk, transparency and minimal categories; the NIST AI Risk Management Framework, released in January 2023 with a generative AI profile in July 2024, organises the work into Govern, Map, Measure and Manage; and ISO/IEC 42001, published in December 2023, sets requirements for an AI management system that treats risk and impact assessment as routine.

A simple, practical approach is to score five criteria from 1 to 3 and add them up. Add two overrides on top: any use that shapes a decision about a person's job, pay, credit, housing, education, health or legal rights is high risk whatever the score, and anything that may be a prohibited practice in a law that applies to you stops for advice. Where a law sets its own categories, the law comes first.

What should AI acceptable use and data rules say?

Acceptable use rules work when they are concrete: this class of data, this kind of tool, allowed or not. Draw a matrix with your data classes down the side (public, internal, confidential, personal, sensitive personal, customer-owned, source code and secrets) and tool categories across the top (approved enterprise tool, approved consumer tool with business settings, unapproved free tool, feature inside approved software, in-house build, agent). Each cell says Allowed, With approval or Never. Passwords and keys are never allowed anywhere.

Add three output habits. The person who uses an output is responsible for it. Facts, figures, quotes and citations that leave the company are checked against a source, because AI tools produce confident errors. And no AI output decides anything about a person without a human who can overrule it. Teach the three common leakage routes too: pasting into tools whose terms allow training or retention, uploading documents to features that index them for everyone, and prompt injection, where content the AI reads carries hidden instructions.

How do intake, vendor checks and human oversight fit together?

New ideas should arrive through one short intake form: purpose, tool, data, people affected, risk scores and proposed controls. Low-risk uses go through a fast lane where the AI owner answers within two working days. Higher-risk uses get a fuller risk assessment and a committee decision. Every approval carries an owner, conditions, a stop rule and a review date, and a one-page record card that can answer an auditor's or customer's question in two minutes.

Most AI risk in a small company arrives through vendors, including vendors you already have when they switch on a new feature. Assess each tool on a short list of areas: whether it trains on your data and whether that can be turned off, retention and deletion, security assurance, data location, admin controls, transparency about model changes, contract terms, and oversight features such as logs and an off switch. Ask counsel to check the contract wording.

Then design oversight rather than assuming it. 'A human is in the loop' means little until you name the reviewer, the frequency, the sample size, what they look for and when the system must stop. Watch for automation bias, where people accept the machine's suggestion because it is there, and for rubber-stamping at volumes no one can really review. Where AI touches decisions about people, compare outcome rates across groups, look for proxies such as postcode or school, and test pairs of cases that differ in one detail.

How do you handle AI incidents, training and board reporting?

An AI incident is any event where an AI tool or use caused, or nearly caused, harm, loss, a data breach, a wrong decision or reputational damage. Ask people to report within one working day without blame. Then classify severity, contain (stop the use, ask the vendor about deletion), check whether it is also a personal data breach with legal deadlines, tell affected people honestly, fix the root cause in the system rather than the person, and record the lesson.

Training is what turns governance from a team's job into everyone's habit. A practical pattern is 60 minutes for all staff on the quick rules, data rules and spotting confident errors; longer sessions for managers on tiers and oversight; and half a day for builders and power users. If you want to see where people stand first, AssessAll's Everyday AI Judgment at Work assessment measures day-to-day judgment with AI tools.

Finally, report to the board each quarter on one page: programme health, risk, value, decisions needed and upcoming law changes. Take the numbers from your registers so the report is a copy, not a composition.

How long does it take to set up AI governance?

For a company of a few dozen to a few hundred people, ten weeks of a few hours a week is a realistic build. Once it runs, the routine is small: ten minutes a month on metrics, a 45-minute committee meeting, quick answers on new requests, and a yearly refresher for staff.

• Bodhih's AI Use Policy and Governance Kit packages this build as a workbook, forms, templates and a 10-week calendar
• To turn the skills involved into a personal plan for your AI owner or committee, see how a Jobulary development plan works