AI governance for SMBs: five rules and a policy you can copy
Your staff already use AI. Some use it to write emails, some to sum up long documents, and some to tidy a spreadsheet. Most started without asking anyone, because the tools are free and quick.
That isn’t a problem in itself. The risk is that nobody has said what’s allowed. Without a few clear rules, a client’s details can end up in a public chatbot. A wrong answer can reach a customer before anyone checks it.
AI governance sounds like a big project. For a firm your size, the core fits on one page. You can put the basics in place this quarter with the people you already have. This guide gives you the five rules, the templates that back them up and a 90-day plan.
What AI governance means for an SMB
For a small or mid-sized firm, AI governance comes down to three things. You know which AI tools your people use and what they use them for. You have written down a few rules about data, checking and ownership. One person keeps those rules up to date.
It isn’t a certificate, a committee or a thick binder. It’s a habit, backed by a one-page policy and two short lists.
Which standards and laws matter, and which can wait
There are many AI standards, and you don’t need all of them. Here is how I’d sort them for a UK firm whose staff use tools like ChatGPT or Copilot.
UK GDPR and the ICO apply today
If staff put personal data into an AI tool, UK GDPR already applies. For most firms, it’s the law that matters first. If a new use of AI is likely to put people’s rights at high risk, you must do a data protection impact assessment (DPIA) before you start.
The Data (Use and Access) Act 2025 changed parts of UK data protection law, including the rules on automated decisions. All of its data protection changes are now in force. The ICO’s guidance on AI and its AI risk toolkit are under review as a result, but they are still a good free place to start.
The UK government’s approach
The UK has no general AI Act. In its 2023 white paper, the government set out five principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. They aren’t law. Existing regulators, such as the ICO, apply them in their own areas.
In October 2026 the government said it would look at stronger protection from serious AI risks for essential services, such as hospitals. That work isn’t aimed at everyday office use. Earlier in 2026 it dropped its planned AI Management Essentials tool and said it would write simpler guidance for SMEs instead.
When the EU AI Act reaches a UK firm
The EU AI Act can apply to a UK firm. It covers firms outside the EU when the output of their AI system is used in the EU. If your AI outputs reach people in the EU, or you have a base there, take it seriously. If not, note that and move on.
The EU changed the Act’s timetable through the Digital Omnibus on AI, which came into force on 27 July 2026. As it stands in October 2026:
- the bans on certain AI practices and the AI literacy duty have applied since 2 February 2025
- most of the rest, including the duty to label deepfakes, has applied since 2 August 2026
- rules for the high-risk uses listed in Annex III, such as AI that screens job applicants, apply from 2 December 2027
- rules for high-risk AI built into regulated products apply from 2 August 2028.
The same change softened the AI literacy duty. Firms in scope must take steps to support their staff’s AI literacy, but they don’t have to guarantee a set level.
Standards you can use without getting certified
- ISO/IEC 42001:2023 is the international standard for an AI management system. It’s the one to point to if a large client asks how you govern AI.
- ISO/IEC 27001:2022 covers information security. If you already follow it, add AI tools to your existing risk process.
- ISO/IEC 23894:2023 gives guidance on managing AI risk. Use it when you build your risk register.
- ISO 15489-1:2016 sets out the basics of records management. It helps you decide which prompts and outputs to keep.
- The NIST AI Risk Management Framework is free and voluntary. It sorts the work into four functions: govern, map, measure and manage. Its Generative AI Profile (NIST AI 600-1) applies it to tools like chatbots. NIST says a revised version of the framework is in progress.
Most firms your size need to line up with these standards, not get certified to them. Certification is a separate step, done by an outside body, and you can decide later whether a client needs it.
The five rules a short AI policy needs
Each rule comes with the lists and checks that make it work.
1. Use approved tools only
Keep a short list of the AI tools staff may use for work, and say which accounts to use them with. Work accounts usually come with admin settings and a business contract. Record each use in an AI use register: who uses which tool, for what, and with what data. Run each new tool through the vendor checklist before you add it.
2. Never paste in protected data
Name the data that must never go into an AI tool, such as client details, personal data, passwords and financial records. Then decide what happens to the prompts and outputs that get stored. UK GDPR says you must not keep personal data longer than you need it, and the ICO expects a retention policy with set periods where possible. Add AI prompts and outputs to the policy you already have.
3. Check every output
A person reads and checks anything AI produces before it goes to a client or into a decision. This matters most when the decision is about a person, such as a hire. Under UK GDPR, a significant decision with no meaningful human involvement counts as solely automated, and extra safeguards apply. A quick glance isn’t a real check. The person checking should be able to change the answer.
4. Give AI one owner
Name one person who approves new tools, keeps the registers and answers questions about AI use. Pick someone with the time and the authority. The owner also keeps a short risk register of what could go wrong, how likely it is, and what you’re doing about it. Take it to the leadership team at each review.
5. Teach the rules and review them often
Rules only work if people know them. Walk each team through the policy, using examples from their own work, and do the same for new starters. AI tools change fast, so review the policy and the registers every three months. For help with the teaching, my AI Training works on the tools your team already pays for.
How the five rules line up with the standards
Where a cell names a clause, I checked it at its official source. ISO standards are paid documents, so for those I name the topic only, not clause numbers.
| Rule | ISO/IEC 42001 | ISO/IEC 27001 | NIST AI RMF | EU AI Act (if in scope) | UK GDPR and ICO |
|---|---|---|---|---|---|
| 1. Approved tools, use register, vendor checks | AI policy and processes | Information security risk management | GOVERN 1.6 (inventory of AI systems); GOVERN 6.1 and MANAGE 3.1 (third parties) | Article 2 (who is in scope); Article 26 (users of high-risk systems) | Article 28 (processor contracts); Article 35 (DPIA) |
| 2. Protected data and retention | Topic covered (paid standard, clause not cited) | Confidentiality, integrity and availability | MEASURE 2.10 (privacy risk) | None checked here | Article 5(1)(e) (storage limitation); Article 5(1)(f) (security) |
| 3. Human check | Topic covered (paid standard, clause not cited) | Named only | MAP 3.5 (human oversight) | Article 26(2) (human oversight of high-risk systems); Article 50(4) (deepfakes) | Articles 22A to 22D (automated decisions) |
| 4. One owner and a risk register | Risk assessment and treatment (with ISO/IEC 23894 as a guide) | Risk management process | GOVERN 2.1 (roles); GOVERN 2.3 (leaders own AI risk); MANAGE 1.2 (risk priorities) | Article 26(2) (oversight by people with competence, training and authority) | Article 5(2) (accountability) |
| 5. Training and review | Continual improvement | Continual improvement | GOVERN 2.2 (training); GOVERN 1.5 (periodic review) | Article 4 (AI literacy, as amended in 2026) | ICO guidance on AI and data protection (under review) |
AI policy template and registers to copy
Copy these, fill in the brackets, and share them with your team.
AI policy template
[Company name] AI policy
Approved tools. You may use these AI tools for work: [list tools]. Use your work account, not a personal one. Ask [owner] before trying anything new.
Tell us what you use it for. When you start using AI for a new task, tell [owner] so it goes on our AI use register.
Data you must never paste in. Never put these into an AI tool: [client names and details, personal data, passwords, financial records, anything marked confidential].
Keeping records. Save any AI output you rely on in [system], with the rest of the work. Delete chats and uploads you no longer need, in line with our retention policy.
Check the output. You are responsible for anything AI helps you make. Read it and check the facts before you send it or act on it. Never let AI make a decision about a person without a real human check.
New tools and suppliers. [Owner] checks every new AI tool against our vendor checklist before anyone uses it for work.
Who owns this. [Name, role] approves new tools, keeps the registers and answers questions about AI. If something goes wrong, such as data pasted into the wrong tool, tell them straight away.
Training. Everyone goes through this policy when they join and after each review.
Review. We will review this policy every [three] months. Last reviewed: [date].
AI use register
| Tool | Owner | Team | What it’s used for | Data types | Personal data (Y/N) | Output reaches customers (Y/N) | Risk level | Review date |
|---|---|---|---|---|---|---|---|---|
| Example: [chat assistant, work account] | [Head of Sales] | Sales | Drafting proposal emails | Client names, deal notes | Y | Y | Medium | [date] |
AI risk register
The rows below are examples to show the format. They aren’t from any client.
| Risk | Likelihood | Impact | Owner | Control | Residual risk | Review date |
|---|---|---|---|---|---|---|
| Example: Staff paste client personal data into a personal chatbot account | Medium | High | [AI owner] | Approved tools on work accounts; protected data list; training | Low | [date] |
| Example: An AI draft with a wrong figure goes to a customer | Medium | Medium | [Team lead] | Rule 3 check before anything is sent | Low | [date] |
| Example: A supplier changes its terms to train on customer data | Low | High | [AI owner] | Vendor checklist at every review | Low | [date] |
Retention rules for prompts and outputs
Personal data in any of these is covered by UK GDPR’s storage limitation rule. ISO 15489-1 can guide how you treat them as records. Set every period from your own records policy.
| What | Keep it? | Where | How long |
|---|---|---|---|
| Prompts and chat history | Only if the work needs it | In the approved tool, on a work account | [set by your records policy] |
| Files uploaded to AI tools | Only while the task is live | In the approved tool | [set by your records policy] |
| AI outputs you rely on (sent to clients or used in decisions) | Yes, as part of the work record | [your document system] | [same as the work record it belongs to] |
| Drafts you threw away | No | Nowhere | Delete |
| AI policy versions, use register and risk register | Yes | [shared drive] | [set by your records policy] |
Vendor checklist
Answer yes or no for each AI tool before you approve it.
- Does the vendor keep our prompts, files and outputs out of its model training, or let us switch training off?
- Do we know where our data is stored and processed?
- Do we know how long the vendor keeps our data, and can we delete it?
- Does it list its sub-processors and tell us when they change?
- Will it sign a data processing agreement that covers UK GDPR Article 28?
- Does it hold security certifications, such as ISO/IEC 27001, and have we seen the certificate?
- Can an admin control who uses it and which features are switched on?
- Can we see logs of how it’s used?
- Can staff sign in with their work accounts?
- Will it tell us promptly about a data breach?
- Can we export our data and close the account cleanly?
- Do its terms say who owns what the tool produces?
Your first 90 days
Days 1 to 30
- Name the AI owner.
- Ask each team lead which AI tools their people use and what for, and fill in the use register.
- Agree the approved tools and the protected data list.
- Share the one-page policy with everyone.
Days 31 to 60
- Run the vendor checklist on each approved tool, and move staff onto work accounts.
- Start the risk register with your biggest risks.
- Add prompts and outputs to your retention policy.
- Walk each team through the policy.
- Check whether any AI use needs a DPIA.
Days 61 to 90
- Spot-check AI outputs in one or two teams.
- Check whether the EU AI Act reaches you, for example through EU customers or AI used in hiring.
- Take both registers to the leadership team for the first review, and set the next review date.
What this guide can’t do, and what comes next
This guide is general information, not legal advice. Following it won’t make your firm compliant with any law or certified to any standard. For a specific question, ask a qualified lawyer or your data protection lead.
Once your rules are in place, the next question is where AI should help most. If you want someone senior to own AI across the firm, a Fractional AI Lead gives you a fractional head of AI, one day a week or more.
Pick one process, and my AI Audit will show where AI should go in.