AI Governance Starter Kit for SMEs

Enterprise AI governance assumes a compliance department. An SME has the same exposure - customer data in prompts, unreviewed output reaching customers, staff using unapproved tools - with none of the staff. This kit is a minimum viable policy: four documents and one habit, enough to answer 'what is our AI policy?' credibly in front of a customer or an auditor.

• Approved tools list - which AI services staff may use for work, and which accounts (company-managed, not personal)
• Data classes - what may never enter a prompt: personal data of customers, credentials, unpublished financials, contract text of third parties
• Output rules - AI output is a draft; external-facing text, code and analysis requires human review before use
• Disclosure - when customers must be told AI contributed (support replies, assessments, generated media)

One named person approves: new tools, new use-cases for personal data, and anything AI-generated that leaves the company under the company name. The workflow is deliberately short - a request in writing, a yes/no with conditions, a line in the register. If approval takes more than a day, people route around it.

A single spreadsheet with three tabs answers most audit questions: tools in use (name, purpose, account owner, data classes allowed), prompts and templates in production use, and AI-assisted deliverables shipped to customers. It takes ten minutes a week to maintain and is the difference between 'we have governance' as a claim and as a fact.

• Under FADP (the Swiss data protection act), personal data fed to an external AI service is a disclosure to a third party - document the legal basis or do not send it
• Prefer tools with contractual no-training terms for anything involving customer data
• Self-hosted inference is an option for sensitive workloads - it removes the third-party question entirely, at the cost of operating it properly
• Log retention: decide how long prompts and outputs are kept and who can see them

• Acceptable-use page written and distributed
• Named approver for new tools and data uses
• Register exists: tools, prompts, shipped deliverables
• Data classes defined; customer data rules explicit
• Quarterly review scheduled