AI Governance for Small Businesses: Where to Start

Written By Sarah Bennett

AI governance can sound like something for banks and government departments. For a small business, it often comes down to a few clear agreements about how your people use AI, who is responsible, and what never goes into an AI tool. A one-page list of dos and don'ts is a good place to start.

Korikori - the latest sculpture on the Geraldine Sculpture Trail

What AI governance means in a small business

Governance is the set of decisions that stops AI use from happening by accident: which tools are okay to use, what information can go into them, who decides, and what happens when something goes wrong.

If you have staff, AI is probably already in use in your business, whether or not you actively chose it. Personal accounts, free tools, meeting note-takers and AI features inside software you already pay for all count. The question often isn't whether AI is being used. It's this: Is there any AI use occurring today that the business could not confidently explain to an auditor, customer, or regulator?

Three everyday situations to think through

Would each of these be okay in your business?

  • A staff member uploads a client contract to their personal ChatGPT account, from a work phone, to ask questions about it.

  • Someone runs a personal AI note-taking app during an onsite meeting where confidential things may be discussed.

  • Someone uses AI to draft a customer quote or email and sends it without anyone checking it.

Often the honest answer is "it depends": on the tool, the account, the information, and what you've promised your clients. Being able to say what it depends on is where governance starts.

Right-sized, not scaled-down

Most governance guidance is written for large organisations, which can make it feel out of reach when you have ten or fifty people. One resource that tries to close that gap is Australia's Guidance for AI Adoption (AI6), released by the National AI Centre and hosted by SafeAI-Aus. It is built around six essential practices, and each one comes with a note for smaller organisations. For example:

Even if you only have a few people, write down who: signs off AI use, checks risks, responds if something goes wrong.

That is the spirit worth borrowing: not a bigger bureaucracy, just clear ownership, written down. It is an Australian guide, but the ideas often travel well to New Zealand businesses.

Start with a quick guide of dos and don'ts

A speaker at a conference once said that governance is about making it easy for people to do the right thing. For a business just starting out, a one-page list is a simple way to do that, and is often enough to get everyone pointing the same way. SafeAI-Aus's AI Use Policy template includes a quick guide like this. Adapted, it looks something like:

Do

  • Use only tools the business has approved.

  • Keep sensitive and confidential information secure.

  • Check AI output before it goes to a customer or anyone outside the business.

  • Tell customers when AI is involved in your work for them, where it matters.

  • Learn the basics of a tool before using it for real work.

Don't

  • Paste confidential, client or personal information into public AI tools.

  • Let AI make final decisions without a person reviewing them.

  • Use AI tools or data you don't have the right to use.

  • Assume AI-generated content is free of copyright issues.

A list like this only works if it fits how your business actually operates. Which tools are approved? What counts as confidential in your work? Which decisions are too important to hand to AI without review? The answers might look quite different for a transport firm and an accounting practice.

Where Teal fits

Teal helps kiwi businesses right-size AI governance. We start with basic guidelines your staff will actually follow, and build on them only as your use of AI grows. Often that begins with a conversation about where AI is already being used, which information matters most, and what a sensible set of ground rules looks like for your business.

If you're just starting out and would like a hand, book a chat.

Sources

We use the AI Contribution Scale defined by Blair Enns to disclose the use of AI in our written content.  This article is rated as: AI-4: AI Drafted. The content was drafted by Claude from our own content and ideas, we then refined the output.

Sarah Bennett
Next

Skills: The New Building Block for Business AI