AI Governance Framework for a Small Company

Every new driver learns the rules of the road from a short pamphlet. Stay on your side of the line, and stop at the red light. Nobody reads the engineering standards behind the highway first. The pamphlet is enough to keep most people alive, because everyone on the road knows the same rules.

Most small companies hand their teams AI tools with no pamphlet at all. A salesperson pastes a customer's contract into a free chatbot to get a summary. A support reply drafted by AI promises a refund your policy doesn't allow. Nobody broke a rule, because no rule existed, and the contract paste may already have broken that customer's confidentiality clause.

A small company needs the pamphlet, and it can skip the engineering manual. Two questions decide what goes in it. What can go wrong once AI work leaves the building, and who keeps the rules current as the tools change?

AI governance at small scale

The pamphlet for AI holds three rules and one owner:

• Claims: what AI-assisted work may say about your company and about the world.
• Data: which information may go into which tools.
• Review: which outputs a person checks before anyone outside the company sees them.
• Owner: one named person who keeps the rules current and answers what the page doesn't cover.

The engineering manual exists too. NIST publishes a formal AI governance framework, the AI Risk Management Framework, released in January 2023. It's voluntary and written for organizations of any size. It sorts the work into four functions, govern, map, measure and manage, and treats governing as the one that runs through the rest. NIST says its suggested actions aren't a checklist. It added a profile for generative AI in July 2024 and is revising the framework now.

Read it for the questions it asks. A ten-person company can answer the govern questions on one page, and I'd start with the three rules below.

Claim rules

Claims come first because AI writes fluently about things it doesn't know. Ask it for a customer count or an industry figure and it produces one that reads fine, with nothing on the page to say it was invented. Give each kind of claim its own rule:

• About your company: any figure or customer name comes from one approved list, a claims register, and the proof in your messaging framework draws from the same list. Anything missing from the register doesn't get written.
• About the world: a statistic, a law or a market rate needs a link to the source that published it, with the year. No source, no claim.
• Quotes: nobody gets quoted, and no customer gets named, without their approval on record. AI never writes a testimonial. The FTC's 2024 rule on fake reviews and testimonials bans testimonials from someone who doesn't exist or never used the product, and names AI-generated fakes as an example.

Cadence, the system I build a company's context layer with, keeps that split. A claim about the company comes from the register or doesn't get written, and a claim about the world needs a cited source. The register is what makes an AI operating system governed. It turns the claim rule from something people remember into something a reviewer can check.

Data rules

A claim rule governs what comes out of a tool, and a data rule governs what goes in. Start with approved tools: one for each job your team already does with AI, on a business or team plan whose terms exclude training on your data and state how long data is kept. I'd approve a tool before banning anything. My bet is that a team with no approved tool uses personal accounts, and then the data goes where you can't see it.

Then sort data into three tiers, public, internal and confidential. Classify each document by what it contains rather than by what kind of document it is, since notes from a customer call often hold personal data and belong in the confidential tier. Confidential data goes only into a tool covered by a signed data processing agreement, and only where the customer's own contract allows it. AI data classification sorts the harder cases.

Review rules

The last rule sits at the exit. Anything a customer or the public will see gets a person's review before it leaves, because a mistake costs more the further it travels. A review that counts checks four things:

• Facts: every figure matches its source.
• Attribution: no invented quote and no misassigned name.
• Data: nothing confidential slipped into the output.
• Quality: it clears the bar a person's draft would have to clear.

Some calls stay with a person whatever an AI draft says. Hiring, signing a contract and anything filed with a regulator are three of them. Human-in-the-loop AI draws that line for internal reports and for agents that act on their own.

When review can wait: notes, brainstorms and first outlines that stay with the person who wrote them don't need a second reader. A rule that sends every draft to review teaches the team to skim.

One-page AI policy

The rules only work where the team already looks, pinned in the team chat or at the top of the handbook. A policy nobody can find doesn't govern anything.

AI policy for [company]
Owner: [name]. Re-read on: [date, at least quarterly]

Approved tools
- [Tool], [business or team plan], for [job]. Terms checked on [date]: no training on our data, kept for [period].
- [Tool], [business or team plan], for [job]. Terms checked on [date]: no training on our data, kept for [period].

Data (classify by what a document contains)
- Public, any approved tool: [examples]
- Internal, approved tools only: [examples]
- Confidential, only in tools under a signed data processing agreement, and only where the customer's contract allows: [examples]

Claims
- Facts about [company] come only from [where the claims register lives].
- Facts about the world need a linked source and its year.
- No quote or customer name without approval from [who approves].
- Testimonials are the customer's own words. AI never writes one.

Review
- Always reviewed before it leaves: [customer emails, proposals, published content]
- Reviewed by [role] before anyone acts on it: [reports, plans]
- Never decided by AI alone: [hiring, contracts, regulatory filings]
- A chatbot customers talk to says it's AI.

Questions go to [owner], who updates this page when an answer changes.

Fill it in from what the team does today. Ask each person which AI tools they opened this month and for what. That list becomes your approved tools, or the list of tools to replace.

Deciding where to start

A driver learns the rules before the highway, and a team should learn its AI rules before its first public mistake. If your team already uses AI on customer work, write the page now and start with the claim rule, since an invented figure is the mistake a customer sees. If you don't know how far AI has spread, the AI readiness assessment scores it in eight questions.

Put a name and a re-read date at the top, because the tools change faster than any policy.

Post the rules before the traffic builds.