AI Governance Checklist for Small Business: Who Checks What the AI Does
AI governance sounds like something for banks with compliance departments. In a ten-person firm it's simpler: someone decides which AI tools are allowed, someone checks what they produce, and someone can say what happened when it goes wrong. This page gives you a 12-point AI governance checklist, a who-owns-it grid and a one-page AI risk assessment template.
What is AI governance?
AI governance is the set of rules, roles and checks that decide how AI is used in your business: which tools, for which tasks, with which data, and who is accountable for the output. In a large company that means committees, platforms and policy documents. In a small firm it means a short policy, a named owner for each AI use and a habit of checking work before it reaches a client.
Governance isn't there to slow AI down. It's what lets you keep using it after the first mistake. Firms that skip it tend to find out about their AI use the hard way, when a client spots an error or staff turn out to have pasted client data into a personal account.
What risk do organizations face without clear AI governance?
- Wrong output reaching clients. AI tools can produce confident, plausible errors. Our AI hallucination check covers real public cases where nobody checked.
- Client data in the wrong place. Staff using personal accounts with no rules about what can be pasted in.
- Liability you didn't expect. In Moffatt v. Air Canada (2024), a Canadian tribunal held the airline responsible for wrong fare information its website chatbot gave a customer. The business owns what its AI says.
- Spend with no owner. Seats and subscriptions that renew while nobody can say what they're for. That's how AI ends up with no measurable return, the pattern covered in our write-up of the MIT GenAI Divide report.
The 12-point AI governance checklist
Tick what's already true in your business. Weighted items count double. The maximum is 16.
The who-owns-it grid: AI governance roles in a small firm
You don't need an AI governance committee. You need the roles below covered, even if one person holds several. In a ten-person firm the owner or office manager often holds the first two.
| Role | What they own | Typical holder |
|---|---|---|
| AI lead | Approves or stops tools, keeps the policy and tool list current, runs the quarterly review | Owner, partner or operations lead |
| Data gatekeeper | Decides which data can go into which tool; handles client questions about AI use | Office manager or whoever handles IT and privacy |
| Use owner (one per AI use) | Checks output quality, tracks cost per task, reports problems | The person who does the task day to day |
| Reviewer | Signs off client-facing AI output before it leaves the firm | Senior person on that type of work |
| Everyone | Uses approved tools only, flags mistakes, follows the data rules | All staff |
Write the names in. A role with no name next to it is a gap, and gaps are where AI governance challenges start.
AI risk assessment template
Run each AI use through this before launch, and again if the task, tool or data changes. One row per use. It takes about ten minutes a row and doubles as your AI risk register. For a weighted scoring version, see the risk scorecard on our AI policy page.
AI USE: ____________________ OWNER: ____________ DATE: ________
TOOL / PLAN: ______________ APPROVED BY: ___________
1. What does it do? (one task, in one sentence)
2. Who sees the output? internal only / client / public
3. What data goes in? none / internal / client / personal / regulated
4. What if it's wrong? annoying / costly to fix / harms a client / legal exposure
5. Who checks it, and how? (name + what they check)
6. Can we switch it off? yes, same day / with effort / no
7. Cost per finished task: before ______ after ______ (incl. review)
RISK: LOW (internal, no client data, easy to check)
MEDIUM (client-facing OR client data, checked every time)
HIGH (client-facing AND client data, or legal/financial output)
HIGH = senior review on every output, or don't launch yet.
NEXT REVIEW DATE: ________AI governance best practices that fit a small business
- Start with the tools already in use. Ask staff what they use. The honest answer is usually more than you think.
- Approve tasks, not just tools. "ChatGPT is allowed" is vague. "Drafting first versions of client letters, reviewed by the partner" is governable.
- Keep humans on anything that leaves the building. Review time belongs in the cost, which is why our AI ROI calculator asks for it.
- One page beats fifty. A short policy people read beats a long one nobody opens.
- Review on a date. Quarterly is enough for most small firms. Put it in the calendar.
An AI governance maturity model, small-firm version
- Stage 1, unmanaged: people use whatever they like; nobody knows the full list.
- Stage 2, written down: there's a policy and an approved tool list.
- Stage 3, owned: every AI use has an owner, a review step and a risk rating.
- Stage 4, measured: each use has a cost-per-task number and a review date, and weak uses get switched off.
Most small firms are at stage 1 or 2. Stage 3 is a realistic target for one quarter. For the wider picture beyond governance, take the AI readiness assessment.
For why governance is shifting from optional to expected, read AI oversight is becoming an operating requirement.
Gartner's AI browser warning: what it means for a small firm
In late 2025 Gartner published a research note titled Cybersecurity Must Block AI Browsers for Now. Its analysts recommended that organizations block AI browsers such as Perplexity Comet and OpenAI's ChatGPT Atlas "for the foreseeable future", as reported by CSO Online on December 8, 2025. The risks they named include indirect prompt injection leading to rogue agent actions, erroneous actions from inaccurate reasoning, loss of credentials if the browser is tricked into visiting a phishing site, and sensitive data sent to cloud AI services. For organizations that want to experiment, Gartner suggested small pilots on low-risk tasks that are easy to verify and roll back.
A ten-person firm has no security team to block installs, so put it in governance instead:
- Add AI browsers to your approved or not-approved tool list explicitly.
- Don't let an AI browser act while signed in to email, banking or client systems.
- If someone wants to try one, use a separate browser profile with no work logins and no client data.
- Write the rule into your AI use policy.
Access, stop controls and context: three checks to add
Access can change overnight. A model or feature you rely on can be restricted, repriced or withdrawn, so name a fallback for anything important. Score the stop controls, not just the answers. When you compare tools, ask how a person pauses the system, overrides it and sees what it did — and put that on the scorecard beside accuracy. Govern the context. An agent that can read your files will guess confidently from whatever it finds, so decide what it may see, keep sensitive material out of unvetted tools, and review that access as people and tools change.
Frequently asked questions
What is AI governance in simple terms?
The rules, roles and checks that decide how AI is used in a business: which tools, for which tasks, with which data, and who is accountable for the output.
Does a small business need AI governance?
Yes, scaled down. A one-page policy, an approved tool list, a named owner for each AI use and a human review of client-facing output cover most of the risk.
What are the main AI governance roles?
An AI lead who approves tools, a data gatekeeper, an owner for each AI use, a reviewer for client-facing output, and staff who follow the rules. One person can hold several roles.
Do I need AI governance tools or software?
Not usually at small-firm scale. A shared spreadsheet for the tool list and risk register is enough until you have many AI uses or regulated data.
How often should we review AI use?
Quarterly suits most small firms, plus a review whenever a tool, task or type of data changes.
Who is responsible when AI gets something wrong?
The business. Tribunals and courts have held companies and professionals responsible for AI output they relied on or published.