AI governance for small business works best, in my view, as a half hour on the calendar every month, and the binder can stay on the shelf. Somewhere in your office there’s a document with your AI rules in it. It described your firm exactly as it was the month somebody wrote it. Since then a team adopted a new tool, a staffer started pasting client text into an app nobody approved, and an agent picked up a permission nobody remembers granting. The binder still says what it says. The office does something else.
For an Alberta firm this is also a privacy question. Client details that land in an AI tool are still covered by the Personal Information Protection Act, and Canada’s privacy commissioners say in their principles for generative AI that accountability stays with the organization, not the tool.
The gap between the binder and the office is where AI risk actually lives in a firm your size. It rarely lives in the dramatic places, the rogue agent story from the news. It lives in the distance between the rules on paper and the practice on screens, growing a little wider every week nobody looks. A once-a-year review finds the gap after it has had a year to grow teeth.
Why does the once-a-year check fail with AI?
It fails because the thing being checked changes between checks. A fire inspection works on a building because the building mostly sits still. Your firm’s AI use does not sit still for a month, let alone a year.
Seats change hands. Free trials turn into habits. A tool that was a toy in March is holding client work by October, and no single decision ever announced the change.
Checking once a year also teaches the wrong lesson inside the firm. It teaches everyone that the rules are a season, a scramble before the review and a relaxation after it. A habit teaches the opposite lesson. The check is always a few weeks away, so the practice stays close to the paper all year, because keeping it close is less work than rebuilding it.
What does a working check look like at your size?
It looks like half an hour, once a month, with the same four questions every time. Which tools and seats does the firm hold right now, and does the list match what people actually open in a day.
What real AI work went out since the last check, and has a person read a sample of it, not the summary, the work itself. What data went where, in plain terms, especially client data. And what moved since last month, one new tool, one new use, one rule that practice has outgrown and the paper needs to catch up on.
Thirty minutes, four questions, one short note of what changed. That is the whole machine. It’s ordinary management. It doesn’t need a consultant or a platform. It needs a recurring slot in a calendar and a person who owns it, the way payroll has an owner. Firms that run it find their problems while the problems are still small enough to fix with a sentence in the rules and a word in the hallway.
What belongs on the one control list?
One list, kept where people can find it, in plain words. The tools the firm has approved. What may go into each one, and what may never go into any of them, client names and figures being the usual line.
Who can approve a new tool, and how long an approval takes, so nobody routes around a slow process. And who reads the samples each month, by name.
One list beats a shelf of policies because people follow what they can hold in their heads. This is the same design sense behind the checks before output counts as done, where the proof sits inside the work instead of beside it, and behind the standing rule that work nobody reviewed does not get sent. A rule the team can repeat back to you is a rule that runs on the days you are not watching. If I had to pick one control to start with, it would be this list.
How do you start the monthly AI check this week?
Open your calendar and book the half hour, recurring, monthly, with a named owner who is not you if you can help it. Then write the control list from how work actually runs today, not from how the binder wishes it ran.
One page with four sections, written in plain words. The first monthly check will find a gap or two. That is the system working, and it cost you thirty minutes to find out in October instead of next October. If you want the habit built into a wider rollout, I build it into the AI strategy roadmap from the first month instead of bolting it on at the end.
What people ask about AI governance for small business
How often should a small business review its AI use?
Monthly. AI use changes between checks: seats change hands, free trials turn into habits and a tool that was a toy in March holds client work by October. A 30-minute monthly review with the same four questions catches that drift while one line in the rules can still fix it.
What goes on an AI control list?
One page in plain words. The tools the firm has approved, what may go into each one and what may never go into any of them, who can approve a new tool and how long that takes, and who reads the monthly work samples, by name.
Who should own AI governance in a small firm?
One named person, the way payroll has an owner. It works best when that person isn’t the business owner, so the check survives a busy month. Their job is to book the half hour, run the four questions and keep the control list current.
Book the first half hour and put one name beside it. More decisions like that show up weekly in the AI Newsletter with ZAK.
7 Comments