# What is AI governance? > AI governance is how a company decides which AI tools are allowed, who checks the output and what data can go in. See a small firm's version of the rules. Source: https://learn.ynteractive.com/content/glossary/ai-governance · Updated 2026-10-06 · Free from Stepthrough (https://learn.ynteractive.com) [Business](https://learn.ynteractive.com/content/glossary#topic-business) · [AI glossary](https://learn.ynteractive.com/content/glossary) Quick answer AI governance is the set of decisions, owners and checks a business uses to manage AI: which tools are approved, what data may go into them, who reviews the output, and what happens when something goes wrong. A written policy is one piece of it. Governance is who keeps that policy working. Last updated October 6, 2026 Updated October 6, 2026 · By [Robert Breen](https://learn.ynteractive.com/content/about) ## Why it matters for a small business Without governance, AI use spreads one person at a time. Someone pastes client files into a free tool, someone else lets an automation send emails nobody reads, and the first time anyone notices is when a client complains. Governance turns those private choices into shared ones, made once, written down and checked. For a small firm it does not need a committee. It can be one owner, a short [AI acceptable use policy](https://learn.ynteractive.com/content/glossary/ai-acceptable-use-policy), a list of approved tools and accounts, and a rule that a person reviews anything that goes to a client. Larger organizations often borrow from published frameworks such as the NIST AI Risk Management Framework or the ISO/IEC 42001 standard, which give structure for spotting and tracking risks. ## In a real lesson: Turn a Client Meeting into Action Items and a Follow-Up Email (Accounting Firms) The [Summarize a Client Meeting lesson](https://learn.ynteractive.com/content/chatgpt-client-meeting-recap-accounting-firm) is about turning a transcript into decisions and action items for Millbrook Accounting, a made-up firm, and its made-up client Cedar Lane Landscaping. It closes with three governance rules in one breath: "follow your firm's policy on AI tools, use a business account that doesn't train on your data, and leave out account numbers and tax IDs." Those are the bones of a governance program: an approved tool, an approved account setting and a data rule. The lesson also builds in a review step. The prompt says to write "Not stated" instead of guessing, and the finish reminds you to check the owners, dates and numbers before the email goes out. The [AI Expense Categorizer Agent lesson](https://learn.ynteractive.com/content/n8n-ai-agent-categorize-business-expenses-google-sheets) shows the same idea inside an automation. Its system prompt for Maple Street Bookkeeping, also made up, names "the bookkeeper who reviews every entry before it is posted" and says "Do not give tax advice." Governance written right into the tool. [Try this lesson free](https://learn.ynteractive.com/modules/accounting-meeting-summary) or [read the step-by-step guide](https://learn.ynteractive.com/content/chatgpt-client-meeting-recap-accounting-firm). ## Common confusions ### AI governance vs an AI policy The policy is the document. Governance is the ongoing work around it: approving tools, training people, checking that rules are followed and updating them when tools change. ### AI governance vs guardrails [Guardrails](https://learn.ynteractive.com/content/glossary/guardrails) are technical limits inside one tool, such as "drafts only." Governance decides which guardrails each tool needs and who checks them. ## Tips - Name one owner for AI decisions, even in a five-person office. - Keep a simple list: tool, account type, who uses it, what data is allowed, who reviews the output. - Review the list every few months. AI tools change their features and settings often. ## Related terms [Shadow AI](https://learn.ynteractive.com/content/glossary/shadow-ai) · [AI literacy](https://learn.ynteractive.com/content/glossary/ai-literacy) · [AI acceptable use policy](https://learn.ynteractive.com/content/glossary/ai-acceptable-use-policy) · [Human in the loop](https://learn.ynteractive.com/content/glossary/human-in-the-loop) · [ChatGPT data controls](https://learn.ynteractive.com/content/glossary/chatgpt-data-controls) · [Audit trail](https://learn.ynteractive.com/content/glossary/audit-trail) ## More Business terms [Allowance for doubtful accounts](https://learn.ynteractive.com/content/glossary/allowance-for-doubtful-accounts) · [AP aging report](https://learn.ynteractive.com/content/glossary/ap-aging-report) · [Applicant tracking system](https://learn.ynteractive.com/content/glossary/applicant-tracking-system) · [Approval workflow](https://learn.ynteractive.com/content/glossary/approval-workflow) ## Where you use it: free lessons - [Turn a Client Meeting into Action Items and a Follow-Up Email (Accounting Firms)](https://learn.ynteractive.com/content/chatgpt-client-meeting-recap-accounting-firm) (ChatGPT, 9 min) - [Build an AI Agent That Categorizes Business Expenses](https://learn.ynteractive.com/content/n8n-ai-agent-categorize-business-expenses-google-sheets) (n8n, 12 min) - [AI Email Responder: Draft Gmail Replies Automatically with n8n](https://learn.ynteractive.com/content/ai-email-responder-gmail-drafts-n8n) (n8n, 12 min) ## Prompt templates that use it [AI pilot plan prompt](https://learn.ynteractive.com/content/prompts/ai-pilot-plan-prompt) ## Frequently asked questions **Is AI governance only for big companies?** No. Big companies need more paperwork, but a small firm with client data has the same basic questions. A one-page policy, an approved tool list and a review rule cover most of it. **Who should own AI governance in a small business?** Usually the owner or office manager, with input from whoever handles IT and anyone with legal or compliance duties. What matters is that one named person can say yes or no to a new tool. [All AI glossary terms, A to Z](https://learn.ynteractive.com/content/glossary) · [Free prompt templates](https://learn.ynteractive.com/content/prompts)