AI governance for small businesses: the minimum viable program
October 22, 2026
"AI governance" sounds like something with a committee, a platform contract and a six-month rollout. For a small business it is none of those. It is five unglamorous artifacts: one named owner, one register of the AI you use, one page of rules, a short list of decisions a human must make, and a review date. This post builds that minimum viable program on the best-known scaffold available — the NIST AI Risk Management Framework — cut down to small-business size, so the result is a program you can run in an afternoon a quarter instead of a department you cannot afford.
Quick answer
Name one accountable owner — a person, not a department — who can approve a new AI use and pause one that goes wrong.
Build a register: one row per AI system, including the AI features inside software you already pay for and the free tools staff adopted on their own. Columns: tool, purpose, owner, data it touches, who uses it, review date.
Write a one-page policy: approved tools, what information may never go into them, where AI use gets disclosed, and which decisions stay with a human.
Set human checkpoints: list the outputs and decisions that require a person to review before they take effect — anything that significantly affects a customer, an employee or a candidate.
Review quarterly, log incidents as they happen. Governance is the rhythm, not the document.
This is the NIST framework's four functions — Govern, Map, Measure, Manage — at SMB scale. NIST is a useful scaffold. It is not a certificate, and nobody at NIST will check your work; that part is addressed at the end of this post.
The scaffold: NIST's four functions, translated
The US National Institute of Standards and Technology published the AI Risk Management Framework (AI RMF 1.0) in January 2023. It is voluntary guidance — not a law, and compliance with it is not enforced by anyone — organized around four functions. Here is what each one means at enterprise scale, and what it shrinks to in a business of ten or fifty people:
| NIST function | What it covers | The small-business version |
|---|---|---|
| Govern | Accountability, roles, policies, risk culture — the cross-cutting function that informs the other three | One named owner; a one-page policy the staff have actually read |
| Map | Establish context: what each system does, who it affects, what could go wrong | The register — every AI use written down with its purpose and its data |
| Measure | Analyse and monitor risks and impacts, qualitatively and quantitatively | Spot-checks of real outputs, a simple incident log, asking "is this still doing what we approved it for?" |
| Manage | Prioritise risks, act on them, monitor over time, respond to incidents | Approve / restrict / retire decisions at a quarterly review; a known route for pausing a tool |
NIST is explicit that the functions are not a rigid sequence and that the effort should be proportionate to the risk of each system. A meeting-notes summariser and a tool that screens job applicants are both "AI use"; they do not need the same weight of oversight, and a register with a risk note per row is how you show you treated them differently.
The program, step by step
Step 1: Name the owner
One person is accountable for AI use in the business: they approve new tools, own the register, and can pause a use that is causing harm. In a small business this is usually the owner, a managing director or an operations lead — someone with authority over how work is done, not necessarily the most technical person. "IT owns it" fails when the outcome lands in sales, service or hiring. Write the name in the policy. If that person is away, name the deputy.
Step 2: Build the register
Ask each team what AI they actually use — the answer will include tools nobody purchased: the free chatbot in a personal browser tab, the AI feature quietly switched on inside your CRM, the transcription service in everyone's meeting app. Check invoices and admin panels too, but ask people first; informal use is where the unknown data exposure sits. One row per use:
| Tool / feature | Used for | Owner | Data it touches | Who uses it | Risk note | Review date |
|---|---|---|---|---|---|---|
| (example) Website chat widget | First-line customer questions | Ops lead | Customer names, order queries | Customers, support team | Must disclose it's AI; no account changes | Jan 2027 |
| (example) Drafting assistant | First drafts of proposals | Sales lead | Client briefs — no pricing or personal data | Sales team | Human reviews every draft before it leaves | Jan 2027 |
NIST itself calls for an inventory of AI systems with a level of risk-management activity set for each — this table is that call, answered in a spreadsheet. A register you keep current beats a platform you don't.
Step 3: Write the one-page policy
One page, plain language, tested by reading it aloud to someone who wasn't involved. Four contents:
Approved tools — the short list staff may use for work, on business accounts with business data terms. Everything else is not approved, which is a clearer rule than a ban on "AI."
Data rules — what may go into an approved tool, in three classes: fine (public or routine business material), restricted (only into approved tools, only for the stated purpose), and never (confidential client information, personal information beyond the purpose, credentials, anything you would not paste into a stranger's email). Never is the class that does the work.
Disclosure habits — where you tell people AI is involved: the chatbot notice, the job-posting statement where the law requires one, the label on AI-generated public content.
Human responsibility — the rule that a named person is responsible for important decisions, and that AI output used for one has been reviewed by someone who can actually change it.
Our free templates include starting language for most of this.
Step 4: Set the human checkpoints
From the register, mark the uses whose output can significantly affect a person — a hiring screen, a credit or eligibility judgement, a customer communication with consequences, anything touching health or safety. For each, write down who reviews, what they check, and how someone affected can reach a human and contest the outcome. Review that consists of approving hundreds of items a minute is not review; the checkpoint has to have enough time and information to say no.
Step 5: Run the rhythm
Quarterly: the owner reviews the register — new tools added, retired ones removed, review dates hit, incidents examined. An hour is usually enough at this scale.
Continuously: an incident log — a shared note, not a system. What happened, which tool and what data were involved, what was paused, who was told, what changed before the tool was used again. Five honest lines per incident.
On change: a new AI use, or a big change to an existing one, goes through the register and the checkpoints before it goes live, not at the next quarterly review.
What minimum viable deliberately leaves out
No governance committee. No dedicated hire. No governance platform software — a spreadsheet and a shared document carry the whole program at this size. No forty-page policy: a register and rules people actually follow protect you more than a framework document nobody has opened since it was written.
You have outgrown the minimum when: a use becomes high-risk in the legal sense (screening people, scoring credit, regulated decisions); enterprise or financial-sector customers start sending governance questionnaires you have to evidence rather than describe; or your AI use reaches the EU, where deployer duties are statutory. Each of those has a next step — several are covered by our regulation posts — but none of them changes the foundation. They all start from the register.
From written down to verified
The NIST framework is guidance. NIST does not certify anyone against it, and a customer or regulator asking "how do you govern AI?" gets your word as the evidence. That is the gap certification fills. The Ethicality AI Use Standard (EAUS) checks the same ground this program covers — disclosed AI use, a human responsible for important decisions, confidential information protected — and an independent assessment turns the register and the policy from claims into a checked result with a public registry entry. Start with the free self-assessment to see where your program stands, then get certified when you want it verified. Pricing is published and starts at $300 USD a year for the smallest organizations; the assessment itself is free, with a decision within five business days.
Frequently asked questions
How long does this take to set up?
The five steps are a few working sessions spread over about a month: an inventory conversation per team, one drafting session for the policy, one pass to set the checkpoints. After that, the cost is the quarterly review and the minutes an incident log takes. If a step is taking weeks, it is being built bigger than this program intends.
Do we need special software for the register?
No. A spreadsheet with the columns above, one owner, and a review date is a register. Software earns its place when the number of systems or entities makes a spreadsheet genuinely unmanageable — later than most vendors suggest.
Is the NIST framework mandatory?
No. It is voluntary guidance from a US standards body, not a regulation, and there is no NIST approval to obtain. Its value is that it is a credible, published structure your program can follow — the same reason customers' questionnaires increasingly reference it.
We're five people. Isn't this overkill?
The five-person version of this program is genuinely small: the owner is you, the register might have six rows, the policy still fits on one page. What doesn't shrink with headcount is the exposure — a five-person firm can paste the same confidential client file into the same chatbot as a five-thousand-person firm. Proportionate means light, not absent.
How does this help when a customer sends us an AI questionnaire?
Directly. The standard questions — what AI do you use, who is accountable, what data goes in, who reviews the decisions, what happens when it goes wrong — are the register, the policy and the checkpoint list, item for item. Firms without them answer with promises; firms with them answer with documents. The buyer-side view is on our procurement page, and the certification page for small businesses explains how the independent check fits: AI certification for small business.
What's the difference between this and just buying a compliance platform?
A platform can store the register and chase the review dates. It cannot decide which tools your business approves, what data your people may share, or who answers for a decision. Those decisions are the governance; the program above is where they get made, whichever tooling you later put under them.
Do the foundation once, properly
An owner, a register, a page of rules, human checkpoints and a quarterly rhythm: that is a governance program a small business can actually keep alive, and it is the ground every larger obligation builds on. Build it, then have it checked — get certified when you're ready.