AI Governance for Small Business: How to Set Up a Program in 90 Days

Most small companies are in the same spot: everyone's using AI, and nobody wrote down the rules. That's fine until a customer's security questionnaire asks about your AI policy, a staffer pastes something sensitive into a chatbot, or a regulation you half-heard about turns out to apply. AI governance is how you get ahead of that — and for a small business, it's far simpler than the enterprise version makes it look. It comes down to three parts.

The three parts of an AI governance program

Skip the frameworks-of-frameworks. A working small-business program is Policy, People, and Proof.

The 90-day plan

You don't do all three at once. Sequence them so each step feeds the next.

1. Days 1–30 — Policy & inventory. Write the acceptable-use policy and list every AI tool your team actually uses. You can't govern what you haven't named, so the inventory is half the work.
2. Days 31–60 — People & classification. Train your team on the policy by role, log who completed it, and sort your AI uses by risk — a chatbot drafting marketing copy is not the same as one touching customer data.
3. Days 61–90 — Proof. Run a readiness assessment on the higher-risk uses and assemble the evidence pack: the policy, the training log, the inventory, and the assessment. That's your answer when someone asks.

If you're small, you can move faster — the point is the order, not the calendar.

Before committing to any of this, it is worth knowing which part is actually missing. The free AI Governance Gap Assessment asks 22 questions across ten domains, and holds the whole verdict at UNGOVERNED if any one of three preconditions reads zero — an inventory, a rule people follow, a named human on each decision — because everything else sits on top of those. Self-assessment, not an audit.

Why a starter program beats both extremes

Small companies usually reach for one of two bad options: a free policy template that nobody trains on and no evidence backs, or a five-figure consultant to build an enterprise program you don't need yet. The template is Policy with no People and no Proof — it looks like governance but can't answer a real question. The consultant is thorough but slow and expensive for a company just getting started.

A starter program is the middle path: the actual three parts, sized for a small team, that you own and can extend. It gets you from "we have nothing" to "here's our policy, here's who's trained, here's our evidence" — which is what a customer, an insurer, or a procurement reviewer is really asking for.

How the three tools chain together

The parts aren't independent. The policy's approved-tools list drops straight into the training, and the training log plus the readiness assessment combine into your evidence pack. Run them as one program and each output becomes the next one's input — which is exactly what the 90-day playbook orchestrates.

What this is not

Governance content earns trust by being clear about its limits. This is a good-faith on-ramp to responsible AI use — a working aid, not legal advice, not a conformity assessment, and not a certification. It doesn't replace counsel, and where a specific law applies to you, a qualified professional still owns that call. The tools help you get organized and produce evidence; the judgment stays human.

Go deeper: the Policy-People-Proof framework, how to write an AI acceptable-use policy, the getting-started checklist, and whether the EU AI Act applies to your small business.