Somewhere in your business, at this moment, someone is pasting a customer email into a free AI tool to draft a reply. They are not being reckless. They are trying to be helpful, and no one has told them the rules, because there are not yet any.
That is the essential case for AI governance in a small business. It does not call for a committee or a 40-page policy that nobody reads, but for a few decisions made once, set out on a single page and understood by everyone. Having run businesses ourselves, we know that anything longer is filed and forgotten. We therefore suggest a framework in four parts, and we will examine each in turn.
1. Decide which tools are approved
Begin with an accurate picture of what people already use. In our experience, the answer surprises owners: the free versions of two or three well-known tools, a browser extension that someone found, and whatever came bundled with the accounting software. The quickest way to establish this is a 5-minute anonymous survey. Anonymity matters – you will hear about the tools people actually use only if no one is penalised for disclosing them.
Then make a decision. For most businesses, that means one business-grade platform with proper administrative controls, paid for by the company, and a short list of anything else that is permitted. Anything not on the list is excluded from company work. That single rule removes most of the risk.
2. Decide which data may and may not be used
This is the most important part, and it is simpler than it sounds. Three categories are usually sufficient:
- Permitted. Your own published material, general questions and drafting from scratch.
- Approved tools only. Internal documents, customer correspondence and anything commercially sensitive.
- Never. Personal data about customers or staff, unless the tool has been assessed for that purpose and your data protection lead has agreed. Card details, passwords and health information also belong in this category.
If your business processes personal data in an AI tool, you should also complete a short data protection impact assessment (DPIA) for that use. It is a one-off piece of work, and your data protection lead should own it. We are not lawyers, and none of this constitutes legal advice; it is the practical groundwork that makes the legal discussion shorter.
3. Decide how output is checked
An AI draft is a draft. The question is who checks it before it reaches a customer, a supplier or the accounts. Our rule is that every use of AI has a named owner, and that owner checks the work. Your people own the first and last step. AI does the heavy lifting in between.
Set out, for each use, what ‘checked’ means. A reply to an enquiry may need only a brief read-through. A quote or a contract clause requires a proper review by the person who would otherwise have written it. Keep it proportionate and specific, so that no one has to guess.
4. Keep a short risk register, and review it
It would be easy to stop at the policy. However, tools change every few months, and so does the way people use them. A risk register need not be elaborate: one line for each way you use AI, recording the risk, the control, the owner and a review date. For most businesses, 10 lines are sufficient. Review it quarterly, and whenever a tool changes its terms or you introduce a new use.
That register also serves as your AI risk assessment, should a customer or an insurer ask for one. Being able to produce it in 30 seconds says more than any statement of intent.
Putting it on a page: the company AI policy
Record the four decisions on a single page, in plain English, and call it your AI policy. Some organisations prefer ‘acceptable use policy’ or ‘AI usage policy’; the name matters less than the contents. Add a one-page quick guide for staff that answers the two questions they actually have: which tools may I use, and what may I put into them? Then brief everyone, in person, once. A policy announced by email is a policy that nobody reads.
Keep a version date on it. When the tools change, the page should change too.
The limits of this framework
It is not a certification, and it will not satisfy a formal standard on its own. If you require one, the framework above remains the right starting point, because it provides the evidence those standards ask for. Nor is it a reason to delay using AI. Most businesses can settle all four decisions within a fortnight, which takes far less time than the problems it prevents.
How Team Agentic can help
Team Agentic’s AI Policy & Governance service delivers precisely this, working with you: a staff survey and short interviews, then a practical policy, a risk register covering up to 10 uses, one DPIA and the staff quick guide, typically within 3–4 weeks. If you would prefer to do it yourselves, the four decisions above are the entire method, and we would be glad to discuss it with you on a free call in either case.
