Why small businesses can't skip this

The phrase "AI governance" conjures images of enterprise risk departments and compliance teams. Most small business owners hear it and assume it doesn't apply to them. That assumption is expensive.

If your business uses AI in any form, an AI email assistant, AI-powered CRM features, ChatGPT for content, or AI in your accounting software, you have specific risks that governance directly addresses. Those risks don't scale with company size. A five-person professional services firm that uploads client information to a consumer AI tool faces the same privacy breach consequences as a 500-person firm.

The good news: governance proportionate to a small business is genuinely not complex. It takes a few hours to establish and a few hours a year to maintain.

Step 1: Know what AI you're using

Time required: One afternoon

Ask everyone in your business, every employee, every contractor, to list every AI tool they use for work. This includes tools accessed through personal accounts. You'll probably be surprised by what you find.

Compile the responses into a simple spreadsheet: Tool name | What it's used for | Data it processes | Who approved it

Identify anything where customer data, employee personal data, or confidential business information is being entered into AI tools.

This is your AI system inventory. Even at this simple level, it is a governance asset.

You will almost certainly find tools being used that you were not aware of, processing data you did not intend to be in those tools.

Step 2: Decide what's approved and what isn't

Time required: One to two hours

With your inventory in hand, make explicit decisions about each tool: approved as-is, approved with conditions, or prohibited.

Default rule if uncertain: free consumer versions of AI tools (free ChatGPT, etc.) may not be used for work tasks that involve client information, customer data, or confidential business information.

Write down your decisions, even informally. "We have decided that [Tool] is approved for [Purpose] but not for [Purpose]. Customer names and details must not be entered." This is now policy.

Step 3: Write a one-page AI usage policy

Time required: Two to three hours

A one-page policy is enough to start. It needs to cover:

  • Approved tools and what they may be used for
  • What data must never be entered into AI tools (customer names, email addresses, financial information, health information, commercially sensitive information)
  • When employees must tell clients that AI was used in producing work
  • Who to contact if an employee is not sure whether a use is approved
  • When you will next review and update this policy

Keep it short, specific, and written in plain language. A policy written in corporate-legal language that your team will never read provides no protection.

Step 4: Assign an owner

Time required: Five minutes

AI governance without a named owner doesn't stay current. In a small business, the owner is likely you, your operations manager, or whoever handles compliance and HR.

Give that person a recurring calendar reminder to review the AI tool inventory and policy every six months.

If a new AI tool is adopted by the business, that person reviews it before it goes into use.

Step 5: Tell your people

Time required: Thirty minutes

Send the policy to all employees and contractors with a brief explanation of why it matters. For businesses with ten or more employees, consider a brief team meeting or Q&A. Include the AI policy in onboarding for new employees and contractors.

The regulatory obligations small businesses need to know

Australian Privacy Act: Applies to businesses with turnover above $3M, health service providers, and some other categories. If you collect and use personal information of Australian residents with AI tools, obligations apply. Privacy Act amendments effective December 2026 introduce new automated decision-making transparency requirements.

EU AI Act (if you serve EU customers): Applies to any provider or deployer of AI systems used by EU residents, regardless of where the business is headquartered. Small businesses benefit from simplified requirements, but the Act's prohibited practices and transparency requirements apply to all organisations.

Australian Consumer Law: ACL prohibitions on misleading and deceptive conduct apply to AI-generated content. If AI produces inaccurate claims about your products or services, your business bears the liability, not the AI tool provider.

Sector-specific obligations: Financial services, healthcare, legal services, and accounting each have sector-specific regulatory frameworks that may impose additional obligations on AI use. If your business operates in a regulated sector, seek sector-specific advice.