The owner of a 22-person services firm has just come off a call with her largest client. He has asked her to send across the firm’s “AI governance framework” by the end of next week. She has not got one. She has read the term in three contract amendments this year, and her investor mentioned it on the last quarterly call, and her industry body has just put a webinar on it. She closes the laptop. She is not sure whether what is being asked for is a policy document, a process, a software product, or all three.
This is where many owner-led SMEs land in 2026. The published material on AI governance was written for organisations with a Chief Information Security Officer, a Data Protection Officer, an internal audit function and a board risk committee. None of which a 22-person business has. What gets lost in translation is that the disciplines underneath enterprise governance still apply at smaller scale. They simply get compressed into the owner’s actual week with the help of one or two named people on the team.
What does AI governance mean in plain English?
AI governance is the set of disciplines a business uses to make sure its use of AI does not harm customers, staff, the firm, or the regulator’s view of the firm. At enterprise scale it produces committees, officers and policy stacks. At SME scale it produces a short document, a spreadsheet and a quarterly meeting. The disciplines are the same in both cases. The compression is what changes.
The point of governance is to be able to answer five questions in front of a customer or regulator without flinching. What is our stance on AI use. What could go wrong. What do we actually do day-to-day. Is any of it working. Can we prove it. A 22-person firm needs answers to those five just as much as a 22,000-person firm does. It does not need the same paperwork to produce them.
What are the five disciplines every SME using AI needs to cover?
There are five, and any framework worth reading is built on them. Policy and standards, the firm’s stance on what AI is acceptable. Risk identification, what could go wrong with the specific tools in use. Operational controls, the human review and access rules that turn policy into behaviour. Monitoring, the quarterly check that any of it is working. Accountability, the file you hand a customer or regulator that proves the other four exist.
NIST calls these Govern, Map, Measure and Manage. ISO/IEC 42001 wraps them in management system language. The ICO frames them through the lens of accountability under UK GDPR. The labels differ. The underlying functions do not.
What changes at SME scale is not which functions matter. Every one of the five is still needed. What changes is the size of the artefact each function produces and the number of people who hold it. Enterprises spread the five across departments. A 20-person firm holds them with two named people and a shared folder.
Who owns each one in a 20-person firm?
Two people, usually. Take a 25-person digital agency as a worked example. The owner sets and signs the policy, owns standards (what tools are allowed, what is prohibited, what disclosure looks like) and owns the governance file when a customer asks to see it. That is roughly four hours a year of her time once the policy is drafted.
The operations lead runs everything else. She maintains the risk register as a one-tab spreadsheet, keeps the incident log, runs the quarterly review and writes the one-page note that comes out of it. She is the person any staff member talks to when an AI output looks wrong or a tool starts behaving oddly. That is roughly fifteen to twenty hours a year once the rhythm is set.
A third person, almost always an external IT contractor or a technical advisor on retainer, is on call for the questions neither of them can answer. Does this new tool meet our standards, has the vendor changed its data handling, does our integration break anything we care about. The advisor sits outside governance ownership and acts as the firm’s specialist on speed-dial.
What artefacts does the function actually produce?
Four documents, kept in a single folder the owner can open in front of anyone who asks. A two-page AI use policy. A one-page risk register. A quarterly review note. An incident log. Total writing time across the year is a long afternoon a quarter once they exist. The point is having something to hand someone who asks, and something to read in the room when a tool starts behaving oddly.
The two-page policy covers acceptable use, prohibited use, required disclosure to clients, the firm’s UK GDPR posture and what happens when something breaks. The one-page register has a row per AI use case with columns for risk, likelihood, impact, existing control and named owner. The quarterly review note summarises what was reviewed, any incidents, any external changes and decisions taken. The incident log captures date, tool, what happened, what the firm did and what changed.
The four together are what the ICO calls accountability documentation, what an NHS Digital Technology Assessment Criteria review wants to see, and what a Microsoft supplier assurance questionnaire asks the firm to describe. They are also what an enterprise client RFP in 2026 increasingly demands before signing.
When should you bring in external help and what should you ask for?
Three points. First, when you draft the policy. A specialist UK solicitor on data protection and AI law should review it. The brief is not “write our policy”, the brief is “review this policy against UK GDPR and our sector regulator, flag what we need to change, flag what we need to document”. Two to four hours of solicitor time, usually £500 to £2,000.
Second, when the firm processes a significant volume of personal data through AI. A fractional Data Protection Officer on retainer (an ICO-aligned consultant on a few hours a month) is often cheaper than the executive time it would otherwise consume. The ICO publishes guidance on whether the firm legally needs a DPO at all, and the answer for many SMEs is no, but having a person to ring is still useful.
Third, when the firm is in a regulated sector or selling into one. NHS, FCA, SRA and ICAEW supplier expectations have all tightened. An advisor who has seen what those auditors actually look for is the difference between a smooth procurement conversation and three months of back-and-forth on a single contract.
What not to outsource. The policy itself, because it has to reflect the firm. The quarterly review, because it is the meeting where the owner and operations lead notice problems early. The risk register, because it has to be lived in to be useful. External advisors review what the firm has already done. Replacing the firm’s own thinking with a consultant’s deliverable defeats the point of governance.
