AI Governance for SMEs: Start With Decisions, Not Committees

One employee uses AI to summarise meetings. Another drafts proposals. A manager wants to automate part of recruitment. The decisions behind those uses are very different. Who approves the tools, what information may go in, who checks the results and who owns them? Those questions are the starting point for AI governance for SMEs. **In short** - AI governance is how a business makes, records and reviews decisions about its use of AI. - Start by finding out what people are already doing and naming someone accountable for the next decisions. - Give staff usable rules, a place to ask questions and a way to suggest improvements. - Put the people who do the work at the centre of each process improvement. - Add structure as the number and impact of your AI uses grow. ## What does AI governance mean in practice? The UK government's AI Management Essentials guidance describes an AI management system as the policies, objectives, processes and other activities that support decisions about AI and the outcomes it delivers. Its self-assessment was designed primarily with SMEs and start-ups in mind; it is a starting point for improving management practices, not a certificate of compliance. [Source: Department for Science, Innovation and Technology](https://www.gov.uk/government/consultations/ai-management-essentials-tool/guidance-for-using-the-ai-management-essentials-tool). For a business leader, this means answering five questions: 1. What AI tools and features are people using, including features inside software we already buy? 2. Which business problem is each use meant to solve? 3. What information does the tool need, and what is it allowed to access? 4. Who checks the output or decision, and what happens when it is wrong? 5. Who can approve wider use, change the rules or stop an unsuitable use? Drafting from public information differs from assessing job applicants or handling personal data. The ICO says governance should be proportionate to the use and its risks. Data protection accountability remains with the organisation when AI processes personal data. [Source: ICO guidance on AI accountability](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/what-are-the-accountability-and-governance-implications-of-ai/). Our separate guide to [AI compliance and governance](https://smartaistudio.co.uk/insights/ai-compliance-governance-uk-business-owners/) covers legal and risk questions in more depth. Here, the focus is how to organise the people and decisions that turn good intentions into everyday practice. ## Begin with an honest picture of current use Ask staff where they already use AI, where they want help and which rules are unclear. Include features inside existing software. Treat the exercise as discovery: people will share more if they can speak openly about experiments. Record each tool's purpose, users, information and process owner. Note whether its output reaches customers, affects people or changes records. Our existing guide explains how to build an AI register. Then ask a harder question: **is AI helping a process the business understands?** If a proposal waits for pricing or approval, a faster draft will not remove the delay. Map the work with the people doing it before testing AI on a defined step. ## Give four parts of governance a clear job You can divide the work into four functions without immediately creating four formal groups. **Direction and decisions.** A business owner, senior leader or AI Council sets priorities, agrees what the business will and will not pursue, and resolves issues that cross departments. Someone must be accountable for decisions and resources. **Rules and boundaries.** An AI policy tells staff which tools are approved, what information they may use, where human review is required and who to ask when a situation is unclear. It should connect to existing data protection, security and employment policies. **Support and feedback.** AI Champions help colleagues learn approved ways of working, share useful examples and bring practical questions back to the decision makers. Curiosity and understanding of the work matter more than claiming to know every tool. **Process improvement.** A small working group takes one business problem through process mapping, a test plan, a limited trial and a decision based on evidence. The process owner and the people who do the work should be involved from the start. The ICO's AI audit framework lists a steering group, committee or equivalent as an *option* for oversight. It also calls for clear roles and operational guidance to support policies. That leaves room for a structure that fits the business. [Source: ICO AI governance and accountability toolkit](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/artificial-intelligence/governance-and-accountability-in-ai/). ## What might this look like in a small business? Imagine a 35-person services company receiving more customer enquiries than its team can handle promptly. People have begun using AI to draft responses, but there is no shared approach. The managing director meets monthly with operations and the relevant information security or data protection lead. They approve tests, identify uses needing further assessment and record owners. An existing management meeting can serve this purpose. They specify approved tools, permitted tasks, information rules, human review and a contact for questions. A customer service champion gathers questions. A working group finds that missing details and poor routing cause delays. It improves the intake form, tests AI classification on a limited set of enquiries and measures routing accuracy and response quality. Leaders review the evidence and decide whether to expand, change or stop the trial. ## Start with a workable rhythm A starting rhythm might be: - **Week 1:** Ask each team what AI it uses and where work gets stuck. Name an accountable leader. - **Week 2:** Record current uses and agree immediate rules for tools, information and output review. Escalate uses that may affect people or involve sensitive information for appropriate assessment. - **Weeks 3–4:** Choose one process, map it with the people doing it and define what a successful test would show. - **Monthly:** Review new requests, test results, questions, incidents and changes to the guidance. Record decisions and owners. The timings are illustrative. The NCSC asks leaders to know where AI security responsibility sits, how risks fit existing governance and what happens if a system fails. [Source: NCSC guidance for leaders](https://www.ncsc.gov.uk/guidance/ai-and-cyber-security-what-you-need-to-know). ## A good first decision A useful first decision states the problem, owner, permitted information and test of success. Staff can then explore with clarity, and leaders can pause ideas that need more evidence or care. **This week's action:** Choose one existing AI use and answer the five questions near the start of this article. If you cannot answer them yet, you have found a useful place to begin. ## Explore the governance series - [AI Council](/insights/does-your-business-need-an-ai-council/) - [AI policy](/insights/writing-an-ai-policy-your-team-will-actually-follow/) - [AI Champions](/insights/ai-champions-business-role/) - [AI working groups](/insights/ai-working-groups-process-plan-action/) - [90-day governance review](/insights/ai-governance-90-day-review/) ## FAQs ### Does a small business need an AI Council? An existing leadership meeting can handle AI decisions if responsibilities and follow-up are clear. A dedicated forum may help as uses spread. The ICO lists a steering group or equivalent as an option. Source: ICO AI governance and accountability toolkit. ### Who should be responsible for AI governance? A senior leader owns direction and resources; each use needs a process owner. Involve data protection, security, HR or other specialists where relevant, and record responsibilities. ### Do we need an AI policy if we only use ChatGPT for simple tasks? Yes: specify approved tools, permitted information, output checks and a contact for questions. The detail can grow with use. Existing data protection and confidentiality duties still apply. ### What is the first step in implementing AI governance? Find out what staff use, including AI features in existing software. Record each use's purpose and owner, then name the decision maker. ### How do we know if our approach is working? Check whether staff know the rules, decisions have owners and tests improve outcomes such as turnaround time, quality, rework or staff experience. Update the rules as use changes.

This article was written by Peter Lowe. The ideas and opinions are his own; AI was used to assist with drafting and editing.