AI governance for a small business is a short written policy plus a list of where AI is used. It names approved tools, sorts data into fine, needs approval and never, sets who approves new uses, requires human review of anything customer-facing, bans connecting personal AI agents to work accounts without approval, and says who to tell when something goes wrong.
What does AI governance mean for a small business?
Operating rules, not a framework document. Governance is working when anyone can answer four questions without asking: which tools are approved, what may I put in them, who checks the output, and who do I tell if something goes wrong.
The sections below produce seven pieces: an inventory, data tiers, approval tiers, a personal-agent rule, a vendor check, a review rule and an incident path. Most small teams can draft all seven in an afternoon.
How do you find out where AI is already used?
Ask, without blame, and write it down. Employees already use AI tools, some on personal accounts. An amnesty-style survey gets a truer picture than a ban.
| Column | What to record | Example |
|---|---|---|
| Use | The task, in plain words | Drafting replies to customer emails |
| Tool and account | Product and whether it is a company or personal account | Claude, personal Pro account |
| Data involved | The most sensitive thing that goes in | Customer names and order history |
| Access granted | Anything the tool can reach on its own: mailbox, calendar, drive, browser | None; text is pasted in |
| Output and reviewer | What comes out and who checks it before it leaves | Draft email, sent by the account manager |
| Owner | The person accountable for this use | Head of customer service |
Each row then gets a decision: keep, move to an approved company account, or stop.
What data can employees put into AI tools?
Sort data into three tiers and name the categories in each, so nobody has to interpret an abstract word like "confidential".
- Fine to use in approved tools: public information, your own marketing copy, internal notes with no personal or client detail, general research.
- Needs approval, and only in a company-controlled workspace: customer records, contracts, pricing, financial reports, employee information, anything under a client confidentiality clause.
- Never: passwords and API keys, full payment card or bank details, and regulated data (health, government ID numbers, anything a law or contract restricts) unless a specific tool has been approved for it.
The tier depends on the account as much as the data. Business plans from the major vendors state that they do not train on your content by default; consumer accounts have different defaults and sit outside your admin controls. Company work belongs in company accounts.
What should the policy say about personal AI agents?
Unlike a chat window, a personal agent asks for standing access to your accounts and acts on its own. The rule is simple: no personal agent is connected to a work email, calendar, drive, messaging or payment account without written approval.
Meta launched Muse on September 8, 2026, as a consumer personal agent in the US on iOS, Android and the web. Meta pitches it as an agent that runs errands and manages schedules across apps such as email, calendars and payments. The user chooses whether it may only read their mail or also send on their behalf, and it can open a browser and fill in forms. Instinct, an invite-only assistant people reach by text or phone, raised a $250 million Series B in August 2026 and links to email, calendars and messaging apps to act on a user's behalf.
Neither is a business product. When an employee authorizes a consumer agent on a work mailbox, client mail flows to a vendor under that person's consumer terms, and the agent can send mail or make commitments in their name. Nobody at the company chose it. See personal AI agents for business for the products.
A clause you can adapt:
Personal AI agents. Do not connect any AI assistant or agent to a
company email, calendar, file storage, messaging, CRM or payment
account unless it appears on the approved tools list. This includes
consumer agents that ask to read or send email, manage your calendar,
use a browser for you or make purchases. Personal use on personal
accounts is your business; company accounts and company data are not.
If an agent would help your work, ask [owner] and we will review it.Back the rule with the setting that enforces it. In Google Workspace, an admin can restrict which third-party apps may access Gmail, Drive and Calendar under Security, API controls, App access control, and block apps that have not been reviewed. In Microsoft 365, Entra ID's user consent settings can require admin approval before any app is granted access to company data. Either one turns the policy from a request into a control.
Who approves a new AI use?
Three tiers, so most uses need no meeting.
- Low risk, manager awareness: drafting internal documents, summarizing public material, brainstorming, in an approved tool.
- Medium risk, owner sign-off: anything using tier-two data, any new connector to a company system, any output that reaches a customer after human review.
- High risk, leadership approval: anything that makes or recommends decisions about employment, credit, pricing for an individual, legal positions or financial commitments, and any agent that can act without a person approving each step.
How should a small business review an AI vendor?
Answer these on one page and file it before a tool becomes part of daily work:
- Does the vendor train on our content, and what is the default on the plan we would buy?
- How long is data retained, and can we delete it?
- Is there single sign-on, and can we remove a departing employee's access in one place?
- What can the tool reach on its own (mailbox, drive, calendar, browser), and can an admin limit it?
- Is there an admin log of who used what?
- Can we export our work if we leave?
- What happens to the workflow if the tool is down or the price changes?
Mark it approved, approved with limits (name them), or rejected. Record the owner and renewal date.
What review, logging and incident rules are enough?
A person checks anything that goes to a customer, a regulator or an employee file, and anything involving money or legal terms, before it leaves. Internal drafts can be spot-checked.
Logging can be light: keep the inventory current and note issues against the row they belong to. For incidents, write down five names: who receives the report, who pauses the workflow or revokes the tool's access, who checks what was affected, who tells anyone impacted, and who approves a restart. Know where in your admin console access is revoked before you need it.
Common questions
Does a small business need an AI policy?
Yes, if anyone on the team uses AI tools, which is nearly every team. One or two pages on approved tools, data tiers, review, personal agents and who to tell prevents most problems and takes an afternoon.
Can employees connect personal AI agents like Meta Muse to work email?
Not without written approval. Consumer agents such as Muse ask for access to email, calendars and payments and act under consumer terms your company never agreed to. Block unreviewed apps in your Google Workspace or Microsoft 365 admin settings.
Should we ban AI tools until the policy is written?
Usually not. A ban pushes use onto personal accounts where you cannot see it. Approve one business-plan tool quickly, tell people what data stays out, and write the fuller policy over the following weeks.
Who should own AI governance in a small company?
One named person, often the operations lead or a founder, who keeps the tool list current, answers questions and approves new uses. It is not a full-time role.