AI governance can sound like a project for large enterprises with compliance departments. In practice, it is a short list of questions every business using AI should be able to answer. Which AI tools do we use? Who approved them? What data goes into them? Who checks the output? And could we show any of that to an insurer, an auditor, or a customer who asks?
This guide gives small and mid-sized businesses a practical place to start. You do not need a large budget or a dedicated team. You need a clear inventory, a short policy, a sensible way to rank risk, and a habit of reviewing it.
This guide is general information, not legal advice. For questions about how a specific law applies to your business, talk with your attorney.
Why governance matters now
Three pressures are pushing AI governance onto the agenda for businesses of every size.
Regulation is evolving. The EU AI Act sorts AI uses into risk categories with different obligations. U.S. states, including Colorado, have passed or proposed laws aimed at AI used in consequential decisions such as employment, lending, housing, insurance, and healthcare. Existing sector rules already apply when AI touches protected data. These laws keep changing, and whether they apply to you depends mostly on how you use AI, not on how big you are.
Insurers are asking. Cyber and liability carriers have begun adding AI questions to applications and renewals. Common questions include whether you have a written AI policy, whether you keep an inventory of AI tools, whether outputs are reviewed, and whether sensitive data is kept out of public AI tools.
Customers are asking. Larger customers and partners increasingly include AI questions in vendor security reviews and contracts. A clear answer can help you win business, and a vague one can slow a deal down.
Step 1: Build an AI inventory
You cannot govern what you cannot see. Start with a simple list of every AI tool used in the business, including:
- Standalone AI tools staff signed up for on their own (often called shadow AI)
- AI features built into software you already use
- AI platforms you have deployed on purpose, such as chat assistants or automation
- Meeting note-takers and browser extensions
For each tool, record the owner, what it is used for, what kinds of data it touches, the type of account (personal, free, or business), and whether it was formally approved. A spreadsheet is fine to start. What matters is that it exists and someone keeps it current.
Step 2: Write an acceptable use policy
An AI acceptable use policy tells staff what is allowed, in plain language. Keep it short enough that people will actually read it. It should cover:
- Approved tools. Which AI tools staff may use for work, and on which accounts.
- Data rules. What must never go into an AI tool, such as client records, health or financial information, passwords, and confidential contracts.
- Review requirements. When a person must check AI output before it is used or sent.
- Disclosure. When customers or others should be told they are interacting with AI or reading AI-assisted content.
- New tools. How to request approval for a tool that is not on the list.
- Ownership. Who to ask with questions and who is accountable for AI risk.
Have every employee read and acknowledge it, and revisit it when your tools or the rules change.
Step 3: Sort AI uses into risk tiers
Not every AI use deserves the same scrutiny. A simple three-tier approach keeps effort proportional.
Lower risk
Internal drafting, brainstorming, and summarizing with no sensitive data, where a person reviews the result before it goes anywhere. Approve the tool, apply the policy, and move on.
Moderate risk
Uses that touch customer or internal business data, or produce content customers will see, such as chat assistants, marketing content, and document processing. These need a business-grade account, vendor review, defined human review steps, and access controls.
Higher risk
Uses that influence decisions about people, such as hiring, lending, pricing, eligibility, or healthcare, or that process regulated data. These are the uses that new AI laws focus on. They call for documented risk assessment, strong human oversight, careful testing, and, often, a conversation with your attorney before you go live.
Step 4: Keep a human in the loop
Human oversight is the single most practical control for most businesses. Decide, for each moderate- and higher-risk use, where a person reviews or approves the AI’s work. Examples include approving content before it is published, reviewing documents the AI is unsure about, and making the final call on any decision that affects a customer or employee.
Pair oversight with an audit trail. Where possible, use tools that log what the AI did, when, and who approved it. That record is what lets you answer an insurer or auditor with evidence rather than memory.
Step 5: Do vendor due diligence
Most businesses use AI built by someone else, so much of your risk sits with your vendors. Before approving a tool for moderate- or higher-risk use, find out:
- Whether your inputs are stored, for how long, and where
- Whether your data is used to train the vendor’s models, and whether you can opt out
- What security controls the vendor has and what independent assessments it can share
- Who can access your data, including subcontractors
- What the contract says about data ownership, breach notification, and liability
Business and enterprise plans often have very different terms from free accounts. Read them, or have someone read them for you.
Use recognized frameworks as your backbone
Rather than reacting to each new rule, anchor your program to established frameworks. You do not need to adopt them in full to benefit from their structure.
NIST AI Risk Management Framework
The NIST AI RMF is a voluntary U.S. framework organized around four functions:
- Govern: set the policies, roles, and accountability for AI across the organization.
- Map: understand the context of each AI use, including its purpose, the people affected, and the potential harms.
- Measure: assess and track AI risks, including accuracy, reliability, bias, and security.
- Manage: prioritize and act on those risks, and keep monitoring over time.
The steps in this guide line up with those functions: policy and ownership (Govern), inventory and risk tiers (Map), review and monitoring (Measure), and controls and vendor decisions (Manage).
ISO/IEC 42001
ISO/IEC 42001 is an international standard for an AI management system, similar in approach to how ISO/IEC 27001 covers information security. It describes how an organization establishes, operates, and continually improves its governance of AI. Most small businesses will not pursue certification, but using its structure helps if larger customers or partners expect formal practices.
Get ready for insurance questionnaires
When your next cyber insurance application or renewal arrives, you will be in a far better position if you can answer these questions with a clear yes and supporting evidence:
- We have a written AI use policy that staff have acknowledged
- We keep an inventory of the AI tools in use
- AI outputs are reviewed before they reach customers or drive decisions
- Sensitive data is kept out of public AI tools
- AI vendors are reviewed for security and data handling
- Staff have been trained on AI risks and the policy
Keep the evidence together: the policy, the acknowledgments, the inventory, and your vendor reviews. Work with your broker on how to answer, and remember that coverage decisions belong to your carrier.
Make it a habit, not a project
AI governance is never really finished. New tools appear, vendors change their terms, staff find new uses, and laws and insurer expectations continue to evolve. Set a regular review, quarterly is a reasonable starting point, to update the inventory, revisit risk tiers, check that controls are working, and refresh the policy. Small, regular updates are far easier than an annual scramble.
How we can help
We build AI governance programs for small and mid-sized businesses: we inventory and assess your AI use, write a plain-language policy, put controls in place for human review, access, data boundaries, and vendor due diligence, document it all for auditors and insurers, and monitor and report over time. Programs are aligned to the NIST AI RMF and ISO/IEC 42001, and when legal interpretation is needed, we work alongside your attorney. If you are not sure where to begin, a Shadow AI Assessment or an AI readiness consultation is a good first step.