Before you hire an AI governance consultant, write a one-page AI policy yourself: which tools are approved, what data never goes into them, and who owns each AI workflow. Bring in outside help when you handle regulated data, sell into the EU, use AI in decisions about people, or a client asks you to prove how you use AI. What follows is general information, not legal advice.
TL;DR
- A one-page policy covers approved tools, off-limits data, owners and review.
- Regulated data, EU customers or client audits are reasons to get help.
- AI rules vary by place and keep changing; check the ones that apply to you.
What does AI governance mean for a business your size?
Rules for three things: which AI tools people may use, what information may go into them, and who checks the output before it matters. Large companies build committees and frameworks for this. A small business needs the same decisions, written down, in a form people will actually read.
The US federal framework is voluntary. NIST's AI Risk Management Framework "is intended for voluntary use" to help organizations build trustworthiness into how they design and use AI. It's a useful reference, and far more than a ten-person business needs to start.
What goes in a one-page AI policy?
- Approved tools. Which AI tools are allowed, on business accounts in the business's name, not personal logins.
- Off-limits data. What never goes into an AI tool: client confidential files, health or payment details, passwords, and personal information you don't have permission to share.
- Owners. One named person for each AI workflow, who checks its output and notices when it drifts.
- Review. Anything AI writes for a customer gets read by a person before it goes out.
- Mistakes. What to do when AI gets something wrong, and who to tell.
- Training. A short session so everyone knows the rules and the reasons.
Keep it to one page and put it where people will see it, like the shared drive's front folder or your onboarding checklist.
Data leaks are the risk to plan for first. A 2026 guide for small businesses from New Zealand's National Cyber Security Centre, written with Australian partners, lists data leaks and privacy breaches among the main risks of using AI tools. For the practical side of keeping data safe without an IT department, see the data rules in an AI implementation strategy for a business with no IT team.
Which rules should you know about?
A few to be aware of, with the caveat that this changes often and a lawyer should confirm what applies to you:
- The EU AI Act. The European Commission says the Act "became applicable on 2 August 2026, with some exceptions," and that its AI literacy obligations applied from 2 February 2025. Some rules for high-risk uses were pushed to December 2027 or later. If you sell to customers in the EU, check where you fall.
- State and local rules. Some US states have passed or proposed their own AI laws, some of them aimed at AI used in decisions about people. Check the rules where you operate and where your customers are.
- Existing law still applies. At the federal level, the FTC said in 2024 that "there is no AI exemption from the laws on the books." Claims you make about your product, and how you treat customer data, are covered whether or not AI was involved.
How do you roll the policy out?
Keep it short and say it out loud. Walk through the page with everyone in fifteen minutes, explain the reason behind each rule, and answer questions. People follow rules they understand; they work around rules that seem arbitrary. Then make the approved path the easy one: set up business accounts for the approved tools so nobody has a reason to use a personal login.
Review it when something changes: a new tool, a new kind of client, a new law where you do business. At minimum, look at it once a year. A policy that describes tools you stopped using doesn't protect anyone.
When does a small business need an AI governance consultant?
- You handle regulated data: health, financial, or children's information.
- Clients send you security questionnaires that now ask about AI.
- You sell into the EU or other places with AI-specific rules.
- AI plays a part in decisions about people, like hiring, lending or housing.
- Several teams use different AI tools and nobody knows what data goes where.
If none of those apply, the one-page policy and a yearly review are a proportionate place to be.
What should a governance consultant hand you?
Something sized to your business, and something your team helped shape, because they know which tools are already in use. You may find AI tools in use that nobody approved; a good review surfaces them without blame and decides which to keep.
The deliverable itself should be practical: a written policy your people can follow, a list of the AI tools in use with their data settings, a map of which workflows touch sensitive information, review steps, and a short training. Be wary of a sixty-page framework built for an enterprise. If nobody reads it, it doesn't protect you. Ask to see an example of what they've handed a business your size before you sign, and check that it fits on a few pages.
Do you need a consultant, a lawyer, or both?
A lawyer tells you what the law requires of you. A consultant helps you put it into practice: settings, accounts, workflows, training. For regulated data or EU sales, you may need both. For writing a first policy and setting up tools sensibly, a consultant or your own careful afternoon may be enough.
AI Marketing Labs consulting doesn't give legal advice, but a straight review of the AI tools you use and how the work runs is part of what Rick Kranz does, and it's a natural place for a policy to start. For what that kind of work should leave behind, see what a good AI consultant should leave you with.
Related articles
Frequently asked questions
Is the NIST AI Risk Management Framework required?
No. NIST describes it as voluntary. It's a helpful reference for thinking about risk, but a small business can start with a short written policy instead.
Do employees' personal AI accounts count under our policy?
They should. Say in the policy whether work information may go into personal accounts at all. Business accounts in the company's name are easier to control and to close when someone leaves.
Does a solo business need an AI policy?
A short one helps, mostly for clients. Writing down which tools you use and what data you keep out of them gives you a ready answer when someone asks.
