AI governance for SMEs: how to keep control of AI

By now, AI is in more places in your business than anyone can list. In Copilot, in the CRM, in a chat window someone opened themselves, perhaps in an agent that sorts email. Nobody ever decided on it in one go. It just grew. The question only comes up when something goes wrong, or when a customer asks in a questionnaire how your use of AI is managed.

AI governance is the answer to that question: the arrangements for who decides what, which AI is running, what risk comes with it and what you record. For a large corporation that's a programme with a committee. For a small or medium-sized business it fits in a few pages and a list you keep up to date. This article covers what goes into it and how to start.

This article is general information, not legal advice. Have your approach checked by your lawyer or data protection officer.

What is AI governance?

AI governance is the set of roles, rules and controls an organisation uses to decide how it uses AI. It isn't about the technology itself but about the questions around it. Who may switch on a new tool? Which data may go into it? Who checks the output? And how do you see afterwards what happened?

The difference from an AI policy: the policy is the document with the house rules. Governance is how you make sure those rules are followed, updated and checked. The policy is one part of it.

Why SMEs need to deal with it now

• AI arrives uninvited. New AI features appear in software you already use, from your office suite to your accounting package. Without an agreement, something is switched on before anyone has assessed it.
• AI is moving from answering to acting. An assistant returns text. An AI agent takes steps in your systems: creating a record, sending an email. Then you want to know who allowed that.
• Questions come from outside. Customers and contracting authorities ask about AI governance in supplier questionnaires. And the EU AI Act asks you, as a user of AI, to take measures, including for AI literacy.

The aim isn't to slow AI down. The aim is to be able to use more AI without losing track. If you know what's running, you'll be confident taking the next step.

Six building blocks of AI governance

For a small or medium-sized business, these are the six building blocks that matter. Start with the first two. The rest builds on them.

1. Ownership

Appoint one person as the owner of AI in your organisation. Not as a full-time role, but with a name and a mandate. That person keeps the register, assesses new tools and is the point of contact for incidents. Senior management remains ultimately responsible.

Also assign an owner to each use: the person responsible for what that use does. For AI in customer service, that's the customer service team lead, not IT. IT manages access. The department owns the outcome.

"IT" or "everyone" isn't an owner. Without a name, new tools don't get assessed and incidents don't get reported.

2. A register of AI use

You can't assess what you don't know about. Keep a list of all AI used in your business, including what grew outside IT. For each use:

• name, vendor and type of account: personal or business;
• what it's used for and by whom;
• what data goes in, and whether that includes personal data;
• what happens to the output: a tool for a person, or a step that does something in a system by itself;
• the owner and the date of the last review.

A spreadsheet is enough. The register ties in with your record of processing under the GDPR, and it's the same overview you need to make AI literacy demonstrable. The first version is almost always longer than expected.

3. Risk classification

Not every use needs the same care. Summarising a public report is different from pre-screening job applicants. Classify each line in the register with two questions: does personal data go in, and does the output lead to a decision about someone?

Use three groups: normal use, extra attention, and not without an assessment. Rougher than the law, but workable straight away. The AI Act has its own classification, with a separate category for high-risk AI, such as AI used in recruitment. If a use might fall into that category, have it checked legally. The steps are in the AI Act and GDPR: what you need to sort out.

4. Logging and audit

When something goes wrong, you want to be able to see what happened. What was the input, which sources did the system use, what was the output and who approved it? With a chat assistant, the vendor handles part of that in its admin environment. With an agent that acts in your systems, you set it up yourself.

Three rules. Log per action, not just per conversation. Make the log append-only, so nobody can tidy anything away afterwards. And look at it regularly, not only when there's a complaint. For high-risk AI, logging is mandatory; in every other case it's the only way to trace a mistake.

An example: for a retail organisation we built AI agents with an overview layer in the client's own Azure tenant. The agents are connected to the existing ERP, CRM, webshop and ticketing systems, and every action goes into an append-only audit log.

5. Policy and human oversight

The policy sets out the house rules: which tools are approved, which data may go in, who checks and how to request a new tool. Keep it short: two to four pages, plus one sheet of A4 for everyday use. How to structure it is covered in writing an AI policy.

Also record where a person stays in the loop. AI produces drafts and proposals. A person decides on anything you can't undo: an email to a customer, a booking, a decision about someone. That person does need to see the reasoning, be able to overrule it and have time to do so. An approve button everyone clicks blindly isn't oversight.

6. AI literacy

Rules only work if people understand them. Article 4 of the EU AI Act asks organisations that use AI to take measures that support their people's AI literacy. Since the amendment by Regulation (EU) 2026/1744, you don't have to guarantee a specific level per person. You do have to be able to show which measures you take.

Train by role and on people's own work. Everyone needs to know that a language model can be convincingly wrong, which data must not go in and who to report to when something goes wrong. How to approach that is covered in the AI literacy requirement.

What it looks like in practice

An illustration, not a client case. A wholesaler with forty employees makes the operations manager the owner of AI, with a few hours a month. The register has a dozen lines, from Copilot for everyone to an agent that reads order confirmations. Most are in the normal-use group. Two need extra attention because customer data goes in. One tool that pre-sorts CVs is on hold until it has been assessed. A new tool goes past the owner through a short form. And every quarter the owner goes through the register with management, with two real examples of what went well and what went wrong.

What AI governance isn't

• Not a ban. A ban without an alternative leads to use on personal accounts, out of sight.
• Not a committee. In an SME, one owner with a mandate works better than a meeting that gets postponed every month.
• Not a one-off project. Tools change, vendors update their terms and new features appear. Schedule a fixed moment to review the register and the policy.
• Not a certification programme. There is an international standard for an AI management system, ISO/IEC 42001 (ISO). For most SMEs that's a later step. The six building blocks above are where you start.

Governance for agents and custom builds

The more AI does by itself, the more the rules need to live in the software rather than in a document. For an agent that writes to your ERP, you set out:

• its own account for the agent, with only the permissions the task needs;
• per action what's allowed: always, after approval, or never;
• a log per action with input, source, output and who approved;
• one place where the agent's boundaries are recorded, so the owner can review them.

That way governance isn't an extra layer of paper but a property of the system. How a custom agent works in your own systems is covered under AI agent development.

How do you start?

• Appoint an owner and ask each team which AI tools they use, including free accounts.
• Put everything in the register and place each line in one of the three groups.
• Adopt the policy and arrange an introductory session for everyone.
• Review the register every quarter, and only switch on a new tool after a short check by the owner.

The register is the most work, and it shows more than your risks. You also see where AI already saves time and where it could do more. If you want to use that overview to decide where AI delivers most in your processes, we do that in the AI Opportunity Audit. It doesn't make you compliant; that remains your own responsibility. Your Tech Club is ISO 9001 and ISO 27001 certified by Kiwa. That covers how we work and doesn't replace an assessment of your own uses.

Sources, checked on 18 October 2026: EU AI Act, Regulation (EU) 2024/1689, Regulation (EU) 2026/1744 (Digital Omnibus on AI), ISO/IEC 42001.