What is an AI governance policy, and what does a small company need?

What AI governance means

NIST's AI Risk Management Framework, released on 26 January 2023 and intended for voluntary use, organizes AI risk work into four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile (NIST AI 600-1) on 26 July 2024. "Govern" is the part a small company starts with: who decides, which rules apply, and how people learn them.

In the EU, Article 4 of the AI Act asks providers and deployers of AI systems to take measures to support AI literacy among their staff and other people using AI on their behalf, such as contractors. The European Commission's Q&A says the obligation has applied since 2 February 2025, that national supervision starts on 2 August 2026, and that no certificate is needed; internal records of training are enough. It also notes that the article was amended in 2026. Check the current text, or ask a lawyer, for your situation.

The UK Government's AI Playbook, written for civil servants, shows what plain-language rules look like: know what AI can and can't do, use it lawfully and securely, and keep meaningful human control at the right stages.

Why a small team should care

• People already use AI. The 2024 Work Trend Index found 78% of AI users bring their own AI tools to work. Without rules, each person sets their own.
• One paste can be a breach. A customer list in a personal chat account may break your own privacy promises.
• Clients ask. Security questionnaires increasingly ask how you use AI. A one-page policy is the answer.

A worked example

Illustration: a made-up business. Northpoint Accounting, a 12-person firm, finds that staff use three different AI tools, two on personal accounts, and one person pasted a client's payroll file into a chat. The partner writes a one-page policy in an afternoon: two approved tools on company accounts; a "never paste" list (client personal data, bank details, tax IDs, anything under NDA); every AI-drafted client email read by its sender; AI help mentioned when a client asks; the operations manager as owner; review every six months.

The team's shared AI skills carry the same rules, so the AI itself reminds people not to include client identifiers. A 30-minute session covers the page, with a short record of who attended.

How to write a one-page policy

1. List the AI tools people use today, by asking, not guessing, and choose the approved ones.
2. Write the never-paste list from your contracts, privacy notice and client promises.
3. Set review and disclosure rules for anything that leaves the company.
4. Name an owner and a review date, and mark the points a lawyer should check.
5. Train everyone who uses AI, contractors included, and keep a simple record.

Common confusions

• "Governance means banning AI." A ban pushes use onto personal accounts. Approved tools with clear limits work better.
• "It's an IT document." It is a working rule for everyone who writes, sells or supports.
• "Write once." Tools and laws change. Review on a date. Before connecting new tools to your AI, run a connector review.

Questions

Does a small company need an AI policy?

If anyone uses AI at work, yes, even a one-page one. Microsoft and LinkedIn's 2024 Work Trend Index found 78% of AI users brought their own AI tools to work. A policy says which tools are approved, what data must never go in, and who checks the output.

What does the EU AI Act require from a small company using AI?

Article 4 (AI literacy) asks providers and deployers of AI systems to take measures to support AI literacy among their staff and others using AI on their behalf, such as contractors. The European Commission's Q&A says it has applied since 2 February 2025, supervision starts on 2 August 2026, and no certificate is required. It was amended in 2026, so check the current text. This page is not legal advice.

What is the NIST AI RMF?

A voluntary framework from the US National Institute of Standards and Technology for managing AI risks, released on 26 January 2023, with four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile (NIST AI 600-1) on 26 July 2024.