AI governance for a small business is a short set of rules and habits that decide which AI tools your team may use, what data never goes into them, who checks the output and what happens when something goes wrong. For a 5 to 50 person office it fits on one page and takes an afternoon to set up, not a committee or a consultant. This starter kit gives you the seven pieces, three free templates to download, and a free course, AI Governance for Small Business, where you practice each piece in a safe copy of the real tool, starting with what never to paste into AI.
This page is for owners, office managers and ops or HR leads at accounting firms, law offices, agencies, insurance agencies and other white-collar teams. It is practical guidance, not legal advice. If your work is regulated, have a lawyer or compliance person review your final policy.
What does AI governance mean for a 5 to 50 person office?
Large companies talk about AI governance as frameworks, risk committees and model inventories. A small office needs the same idea at a much smaller size: someone has decided, in writing, how AI is used here.
Without that, AI use still happens. It just happens in private. Someone pastes a client spreadsheet into a free chatbot on a personal login. Someone else pays for an AI note-taker on a company card and records every client call. A draft email with a made-up deadline goes out because nobody read it closely. None of it is malicious. It is shadow AI: tools used for work that nobody approved, with settings nobody checked.
The cost is real for a small firm. One leaked client file can end a client relationship, trigger a contract dispute or start an insurer's questions. On the other side, banning AI does not work either; people use it anyway and stop telling you. Good governance is the middle path: say yes to AI, with clear lines.
What are the 7 pieces of AI governance?
A small-business AI program needs seven pieces. Each one links to the module in the free course where you build it.
| # | Piece | The question it answers | Where to practice it |
|---|---|---|---|
| 1 | Data rules | What must never go into AI? | Use AI at Work Without Leaking Client Data |
| 2 | Approved tools | Which tools and accounts may we use? | Choose the AI Assistant Your Team Should Use |
| 3 | Admin settings | Are the accounts set up safely? | ChatGPT Data Controls |
| 4 | Policy | Where are the rules written down? | Roll Out a Team AI Policy using Claude |
| 5 | Guardrails and training | Do staff and AI agents know the rules? | Onboard New Clients Without the Back-and-Forth and Answer Employee Policy Questions Instantly, both in Airia |
| 6 | Human review | Who checks AI work before it counts? | Invoices with an Approval Step using n8n |
| 7 | Incident plan | What do we do when someone gets it wrong? | Someone Pasted Client Data into AI: Contain It in One Hour, with the clean-up practiced in Clear Client Data Out of ChatGPT |
The course starts with Module 1: How Stepthrough Works, a two-minute tour of the practice player.
What data should never go into AI?
Start here, because every other piece depends on it. The simplest working rule is data classification with three levels:
- Public: text already on your website, published prices, general questions. Fine in any approved tool.
- Internal: draft memos, meeting notes and process documents. Approved tools on the company account only, with names and account numbers replaced by placeholders such as [CLIENT].
- Confidential: passwords, bank and card numbers, Social Security and tax ID numbers, health details, HR records and anything a client asked you to protect. Never goes in as is.
People sort by example, not by definition, so put real examples from your own work on the sheet. A quick test helps: would you be fine if this text showed up in a stranger's chat? In the free safe AI at work lesson, you strip a tenant's bank details and address out of a prompt, then catch two promises ChatGPT made up before the reply goes out.
Download: Data classification cheat sheet (.txt), a one-page Public / Internal / Confidential sheet with examples and placeholders.
How do you stop shadow AI with an approved tools list?
Shadow AI shrinks when the approved way is easy. Pick one main assistant on a business plan, write it down, and give people a simple way to ask for anything else.
An approved AI tools list is a short table: the tool, the plan or account, who can use it, what it is approved for, the highest data level allowed, the key settings, the owner and a review date. Keep it next to the policy. When someone asks for a new tool, run a quick AI vendor risk assessment before anyone signs up: does the vendor train on your data, how long does it keep it, can you get a data processing agreement, is there a SOC 2 report, and can an admin control sharing and connected apps?
To pick the main assistant, try the same office task in each one. The free lesson Choose the AI Assistant Your Team Should Use runs one job through ChatGPT, Claude, Gemini and Copilot so you compare real output, not marketing.
Download: Approved AI tools list (.csv). Open it in Google Sheets or Excel. The example rows are placeholders to replace.
Which admin settings matter most?
Most leaks come from default settings on accounts nobody configured. Whatever tool you approve, check these on day one:
- Model training. On personal plans, switch off the setting that lets the vendor use your chats to improve its models. OpenAI says its Business and Enterprise plans do not train on business data by default.
- Shared links. Anyone with a shared link can read that chat. Review them monthly and delete the ones nobody needs.
- Memory. Useful on your own login, risky on a login several people share, because one client's details can turn up in another client's chat.
- Temporary chats. Use them for sensitive one-off work. They stay out of history, but are safer, not secret.
- Who is on the account. One company workspace, no client work on personal logins, and remove people the day they leave.
The free lesson ChatGPT data controls for your team walks through each setting in ChatGPT and ends with a one-page policy you could send a client who asks what you do with their data.
What should an AI acceptable use policy include?
An AI acceptable use policy is the one page that ties the other pieces together. Keep it under a page, in plain words, with names. A policy that works for a small office covers:
- Approved tools only, with a link to the list and how to request a new one.
- The never-paste list, with a link to the data cheat sheet.
- What is fine to use, so people are not afraid to use AI at all.
- Account settings the owner keeps in place.
- A person checks every output before it reaches a client, a vendor or the public.
- Automations and agents that send, pay, delete or post need approval first, with a human in the loop.
- Being open with clients who ask whether you use AI.
- Mistakes reported the same day, with no blame. This is the rule firms forget, and the one that lets you fix a problem while you still can.
- An owner, a review date and a short quiz so the policy is read, not just filed.
You make the decisions; AI can do the writing. In the free lesson Roll Out a Team AI Policy in One Afternoon using Claude, you give Claude seven rules and get a one-page policy, an announcement email from the boss and a five-question staff quiz.
Download: One-page AI policy template (.txt), an AI policy for employees with ten sections and a sign-off line. Replace everything in [BRACKETS].
How do you keep a person in charge of AI output?
AI can draft fast and still be wrong with total confidence. Human review is the rule that no AI output counts until a named person has checked it. Two habits make it practical.
Review where it matters most. If people must approve everything, they stop reading and click yes. Set a threshold instead: every client-facing message, and any payment or refund over a set amount. In the free n8n lesson Invoices from Your Inbox to Google Sheets, with Approval, AI reads each invoice PDF and logs it, and anything over $1,000 waits for the owner's Approve button before it goes further.
Write the guardrails into the agent. When you build an AI assistant, put your hardest rule in its instructions in plain words, with a next step, and test the risky question before anyone else sees it. In Onboard New Clients using Airia, the assistant must never accept a Social Security number in chat and must send clients to the secure portal instead. In Answer Employee Policy Questions using Airia, an agent answers only from the handbook and says "I can't find that" when the answer is not there. Put your AI policy in that handbook and staff can ask it, "Can I paste a client invoice into ChatGPT?"
What do you do when someone pastes client data into AI?
It will happen, so decide now. A simple AI incident response plan for a small office:
- Stop and tell. The person tells the policy owner the same day. Nothing is deleted first, so you know what happened.
- Record it. Which tool and account, what was pasted, when, and whether a shared link or connected app was involved.
- Contain it. Delete the chat and any shared link, check the account's training and memory settings, and remove any unapproved tool from the device.
- Decide who else to tell. Check your client contract and, if personal data was involved, ask a qualified adviser whether you must notify anyone.
- Fix the cause. Update the cheat sheet, the tools list or the policy so it does not happen the same way again.
Keep it blame-free. The goal is to hear about mistakes in an hour, not discover them in a month.
How do you roll it out and keep it current?
Do it in one afternoon, then keep it alive with three small habits:
- Week one: send the policy with a read-by date, run the five-question quiz in a team meeting and pin the data cheat sheet where people work.
- New hires: the policy and quiz are part of their first week, the same as building access and email.
- Every six months: review the tools list, the settings and any incidents. AI tools change fast, and a policy that names last year's tools protects nobody.
If you want help teaching the team, our free guide to AI training for employees gives a simple plan, and the full AI Governance for Small Business course takes a little over an hour end to end.
Key takeaways
- AI governance for a small business is seven pieces: data rules, approved tools, admin settings, a one-page policy, guardrails and training, human review and an incident plan.
- Start with data rules. A three-level Public / Internal / Confidential cheat sheet answers most "can I paste this?" questions.
- Shadow AI shrinks when the approved way is easy: one business-plan assistant, a written list and a simple request process.
- Your AI acceptable use policy should fit on one page, name an owner and include a same-day, no-blame mistake rule.
- Keep a person in charge: review every client-facing output and anything over a set amount, and write hard rules into every AI agent.
- Download the free policy template, tools list and data cheat sheet above, and practice each piece in the free course.
Frequently asked questions
- Does a small business really need an AI policy?
Yes, if anyone on the team uses AI for work, and most already do. A one-page policy is enough for a 5 to 50 person office. It tells staff which tools to use, what never goes in and who to ask, which prevents the most common leaks and gives you a clear answer when a client asks how you use AI.
- What is the difference between AI governance and an AI acceptable use policy?
AI governance is the whole system: the rules, the approved tools, the account settings, human review and the plan for mistakes. The acceptable use policy is the one document staff read that writes those rules down. The policy is one piece of governance, not all of it.
- Can employees use their personal ChatGPT accounts for work?
Not for client or company data. Personal accounts are outside your control: you cannot see their settings, remove access when someone leaves or delete what they pasted. Approve one company account, ideally on a business plan, and say in the policy that client work never goes into personal accounts.
- Who should own AI governance in a small company?
One named person, usually the owner, office manager or operations lead. They keep the tools list, check new tool requests, hold the account settings and are the person staff tell the same day when something goes wrong. Name them in the policy.
- Is this AI policy template legal advice?
No. It is a practical starting point written for non-lawyers. Your client contracts, professional rules and local law come first, and if you work in a regulated field such as healthcare, finance or law, have a qualified person review your final policy before you rely on it.
- How often should we review our AI policy?
Every six months, and whenever you add a new AI tool, change plans or have an incident. Put the review date at the top of the policy and in the owner's calendar.
Sources
- NIST AI Risk Management Framework, the US government's voluntary framework that larger governance programs build on
- OpenAI: Enterprise privacy, on how business plans handle training and data
- Anthropic Privacy Center, on how Claude plans handle your data