AI Governance for Small Business
One owner. Three risk tiers. Rules people remember.
Most small businesses didn’t decide to adopt AI. It arrived inside tools they already used. This book is a practical approach to AI governance for small business: clear ownership, sensible boundaries, and lightweight controls, without building a bureaucracy people route around.
Practical AI governance for small business, at any size
I wrote this for small and mid-sized businesses, whether that’s five people or a couple hundred. The risks are real at any size, and enterprise governance models, with their committees, legal review cycles, and dedicated compliance staff, don’t fit any of them.
It’s for owners, operations leaders, IT managers, and whoever has quietly become “the AI person” because someone had to answer the questions. If AI governance for small business has landed on your desk, this was written for you.
If you're trying to answer questions like these, it's written for you:
- Who is responsible for AI use in our company?
- What kinds of AI use are acceptable here, and what aren't?
- How do we evaluate AI tools without becoming experts in every vendor claim?
- How do we give employees guidance without killing experimentation?
- What do we do when something goes wrong?
Eleven controls, each one usable on its own
Each chapter covers one control in a complete AI governance framework, and is clear about what it does and doesn’t do. The controls interlock rather than stack, so you can start wherever AI is already causing uncertainty and expand only as you need to.
What Counts as AI in Your Business
One working definition of what’s in scope, including the AI already built into tools you pay for.
Finding AI Use Without Starting a Witch Hunt
Getting an honest picture of what’s already in use. Visibility first, enforcement later.
Simple Risk Tiering That Fits on One Page
A fast, consistent way to sort AI use into low, medium, or high risk.
Approval Without Bottlenecks
A deliberate pause and a recorded decision for high-risk use only, so everything else keeps moving.
Data Rules That Employees Can Remember
What’s fine, what needs care, and what never goes into an AI tool without approval.
Vendor and Tool Reality Checks
Understanding a tool well enough to use it deliberately, without procurement theater.
Logging, Monitoring, and Good-Enough Auditability
Proportional records so AI use can be reconstructed later, without surveillance.
AI Incident Response (When Things Go Wrong)
Detect, contain, document, and decide what changes before AI use continues.
Employee Guidance Without Training Theater
Simple, consistent boundaries so people can use AI productively without guessing.
Who Owns This (And What That Actually Means)
One clear owner who can make decisions and close the loop, without a committee.
Knowing If This Is Working
Checking that governance stays useful rather than ceremonial.
Ready-to-adapt tools
Sample policies to adapt into your own small business AI policy, including an AI acceptable use policy, plus intake forms, risk matrices, and a glossary.
What this book is, and what it isn't
- A working approach to AI governance for small business, built for teams without a compliance department
- Practical controls you can adopt one at a time
- Written for real constraints: overlapping roles, quick decisions, no dedicated staff
- Legal advice or a certification of compliance
- An ethics debate or a prediction about the future of work
- A technical guide to building, training, or auditing AI models
It will occasionally suggest you pause, constrain, or say no to a specific use. That isn’t the book being cautious. It’s what a deliberate decision looks like.
Companion downloads
Some of the tools that support the book don’t translate well to an ebook, so they’re available separately: printable posters, one-page reference tools, and manager-facing aids meant for posting, sharing, or adding to your own internal documentation. Printable PDF and editable formats where it makes sense.
The book stands on its own. These just make AI governance for small business easier to put in place, without recreating common documents from scratch.
The book is the framework. Governance is help putting it in place.
Plenty of teams will take this AI governance book and run with it on their own, and that’s what it’s written for. If you’d rather have someone work through it with you, setting up the policy, the risk tiers, and the review process around how your organization actually operates, that’s what my Governance service does.