Your staff are already using AI at work. Some of them are pasting customer emails into a free chatbot right now. The only question an AI governance framework answers is whether anyone wrote down the rules before something went wrong.
Start by finding the tools already in use, including AI features inside existing software. An inventory of your own business is more useful than a headline about how many other firms have a policy.
The short answer: an AI governance framework for an SME is a short set of decisions about who owns AI, which tools are approved, what data can go into them, where a human must check the output, and how you review it. It fits on a few pages. Borrow the structure from the NIST AI RMF, size it to your risk, and add more only when a regulator or customer requires it.
Key points:
- Six parts cover most SMEs: an owner, a register, approved tools, data rules, human review and incident handling.
- The EU AI Act already expects providers and deployers to support AI literacy, and its heavy high-risk rules now start on 2 December 2027.
- UK rules on solely automated decisions changed on 5 February 2026. Hiring, credit and pricing decisions need the most care.
- Consider ISO/IEC 42001 certification when its assurance value justifies the effort, including where customers require it.
What is an AI governance framework?
It's the operating rules for AI in your business. Who can buy or switch on an AI tool, what it's allowed to touch, who checks what it produces, and what happens when it gets something wrong.
Most of what ranks for this term describes something built for a bank: model risk committees, a Chief AI Officer, lifecycle platforms. That's the wrong size for a 60-person accountancy practice running Copilot and a website chatbot.
For most SMEs the honest definition is narrower. Governance is knowing what AI you use, what it can see and who is accountable for it. Everything else is detail you add as your risk grows.
Does a small business really need AI governance?
Yes, though probably less of it than a governance software vendor would like to sell you. A few pressures make it hard to skip.
Data protection already applies. UK GDPR doesn't care that the processing happened inside a chatbot. The ICO's guidance on AI and data protection treats accountability, fairness and DPIAs as your job, not the vendor's. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so expect updates.
Automated decisions have specific rules. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of UK GDPR with new Articles 22A to 22D, in force since 5 February 2026. Solely automated decisions with a significant effect on someone are now permitted in more cases, but you must let people get information about the decision, make representations, get human intervention and contest it. Decisions using special category data, such as health data, remain tightly restricted.
The EU AI Act can reach UK firms, depending on their role and where systems or outputs are used. Its amended Article 4 requires providers and deployers to take measures to support the AI literacy of their staff. The Digital Omnibus, Regulation (EU) 2026/1744, softened that duty and moved the high-risk rules to 2 December 2027. The detail is in my guide to EU AI Act compliance for UK businesses.
Commercial pressure often arrives first. Larger customers now send supplier questionnaires asking how you use AI on their data, and "we don't really have a policy" lands badly with a procurement team.
What should an AI governance framework include?
Six parts. Each one is a decision plus a named owner, not a document for its own sake.
| Part | The decision it records | Minimum viable version |
|---|---|---|
| 1. Ownership | Who is accountable for AI use overall | One named director, plus a deputy |
| 2. AI register | What AI you use, for what, on which data | A spreadsheet: tool, owner, purpose, data types, risk level, review date |
| 3. Approved tools | Which tools and plans staff may use | A short list, business plans only, consumer accounts banned for work data |
| 4. Data rules | What may never go into an AI tool | Red, amber, green data classes in plain English |
| 5. Human review | Where a person must check before output is used | Mandatory sign-off for anything sent to clients or affecting a person |
| 6. Incidents and review | What happens when it goes wrong, and when you revisit | A reporting route, a log, and a quarterly review |
The register does most of the work. Once every AI tool is listed, the risk conversation becomes obvious. A marketing copy assistant and a CV screening tool should not get the same treatment.
Use risk tiers to keep it proportionate. Low risk: drafting, summarising, internal research on non-sensitive data. Medium: anything touching personal or client data. High: anything that makes or shapes decisions about people, such as hiring, credit, pricing or access to a service. The EU AI Act's Annex III is a useful checklist for what "high" looks like.
Is an AI policy for business the same as a governance framework?
No. The AI policy is the part your staff read. The framework is the machinery behind it.
An AI use policy tells people what they can and can't do: approved tools, banned data, when to disclose AI use to a client, who to ask. Keep it to two pages or nobody reads it. The framework is the register, the risk tiers, the review cycle and the owner who keeps the policy true.
A policy without the framework goes stale within a quarter, because the tools change faster than the document. Write the policy last, once you know what you're actually allowing.
What a good one-page AI policy covers:
- The approved tools and plans, and a ban on personal accounts for work data.
- Data you must never enter: client confidential material, special category data, credentials, unreleased financials.
- Output you must check before it leaves the building, and who signs it off.
- When to tell a client or customer that AI was involved.
- How to request a new tool, and how to report a mistake without getting punished for it.
Should you use the NIST AI RMF or ISO 42001?
Borrow from NIST. Certify against ISO only when someone asks.
The NIST AI Risk Management Framework was released in January 2023 and is voluntary. Its four functions, Govern, Map, Measure and Manage, are a clean skeleton for any size of business. NIST added a Generative AI Profile in July 2024 and says the framework is being revised. Use the four functions as headings and keep your answers short.
ISO/IEC 42001:2023 is different. It's a certifiable AI management system standard, built like ISO 27001, and it brings audits, documented procedures and an external certifier. That's valuable if you sell AI products into enterprises or the public sector and they want proof. For a firm that only uses AI tools internally, certification is usually expensive paperwork. Align with it loosely, then certify when a contract makes it pay.
The UK government's own approach rests on five principles applied by existing regulators: safety, transparency, fairness, accountability, and contestability and redress. They're a reasonable test for your own framework. Don't expect an official SME template, though. DSIT consulted on an AI Management Essentials self-assessment tool, then said in February 2026 that it will not be publishing it, promising future guidance aimed at SMEs instead.
When is AI governance consulting worth paying for?
When the stakes or the complexity outrun what a sensible director can sort out with a spreadsheet and an afternoon.
Bring in outside help if you use AI in hiring, lending, insurance pricing or health; if you sell AI products into the EU; if a major customer wants ISO 42001; or if you're about to let AI agents act in your systems. Agents raise the stakes, because a bad output becomes a bad action. More on that in AI agents for small business.
Good AI governance consulting should leave you with a working register, a policy your staff understand and an owner who can run it without the consultant. If the deliverable is a 60-page framework document, you've bought shelfware. My guide on how to choose an AI consultancy has the questions to ask.
What I've seen
Shadow AI is the starting point, not the exception. A failure pattern to watch for: leadership believes the business "hasn't started with AI yet", while half the team uses personal ChatGPT accounts for client work. Banning it rarely works. Giving people an approved, paid business tool with sensible data rules usually does.
The AI features you didn't buy are the ones you forget. CRMs, helpdesks and meeting recorders now ship AI features, some switched on by default. They belong in the register.
Approval gates beat policies. In my own lab, Ascendancy IQ, AI agents do real work, but anything consequential stops at a human approval gate, with actions recorded for review. That's governance built into the workflow rather than written in a binder. The best control is the one people can't forget to follow.
My take: start smaller than you think. A register and a two-page policy that people actually use will protect you more than a framework that took three months to write and nobody has opened since.
How to set up AI governance in 30 days
- Week 1: name the owner and run the inventory. One director owns it. Ask each team lead which AI tools they use, free ones included, and check your software admin panels for AI features.
- Week 1: build the register. One row per use: tool, plan, owner, purpose, data types, risk tier, review date.
- Week 2: decide approved tools. Move work onto business plans with appropriate data terms. Retire consumer accounts for work data.
- Week 2: set data rules. Red, amber, green classes. Red never goes into an AI tool. Amber only into approved tools.
- Week 3: define human review. List the outputs that must be checked and by whom. For any significant automated decision about a person, design in the UK safeguards: information, representations, human intervention and a route to contest.
- Week 3: write the two-page policy. Plain English, tested on someone who wasn't involved.
- Week 4: train and launch. A short session per team on the policy and the tools, which also counts towards AI literacy. My AI readiness checklist is a useful pre-flight.
- Week 4: set the review rhythm. Quarterly register review, an incident log, and a trigger to review before any new high-risk use goes live.
Once that's running, governance stops being a project and becomes part of how you implement AI.
Give the incident route a real owner
A useful incident record says what happened, which tool and data were involved, what was paused, who was informed and what changed before restart. Give staff a reporting route that works outside the AI tool itself. Agree who assesses any legal notification duty; the register is an operational aid, not a substitute for that assessment.
Frequently asked questions
What are the main components of an AI governance framework? For an SME: a named owner, an AI register, an approved tools list, data rules, human review points, and an incident and review process. Larger firms add committees, model testing and formal audits.
Do I need an AI policy if my business only uses ChatGPT or Copilot? Yes. The main risks for most SMEs come from everyday tools: confidential data going into consumer accounts and unchecked output reaching clients. A short use policy and a business plan with proper data terms address most of it.
Is there a free AI governance framework template? The NIST AI RMF and its playbook are free and voluntary, and its Govern, Map, Measure and Manage functions make good headings. The UK government decided not to publish its draft AI Management Essentials tool, so do not mistake that draft for a published government assessment tool.
Is ISO 42001 certification required by law? No. ISO/IEC 42001 is a voluntary standard. It becomes worthwhile when customers or tenders require it, usually for firms selling AI products or services.
How often should you review AI governance? Quarterly is a sensible start, because tools and features change quickly. Review immediately before any new use that makes or shapes decisions about people.
Sources
- Data (Use and Access) Act 2025, section 80, legislation.gov.uk
- Guidance on AI and data protection, Information Commissioner's Office
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- EU AI Act, Annex III: high-risk AI systems, European Commission AI Act Service Desk
- AI Risk Management Framework, NIST
- ISO/IEC 42001:2023, AI management systems, ISO
- A pro-innovation approach to AI regulation: government response, DSIT, 6 February 2024
- AI Management Essentials tool: government response, DSIT, 6 February 2026
If you want a second pair of eyes on your AI register, or help sizing governance to the risks you actually have, let's talk.
