An AI Governance Framework for a Small Business: Seven Plain Rules

Why does a small business need an AI governance framework?

An AI governance framework is a short set of rules for the AI helpers in your business. You need one because they act for you, on your mailbox, your files and sometimes your money.

Picture a bakery that lets a helper answer customer emails and a second one read supplier bills. Nobody wrote down what either may do. One day an email goes out with the wrong price, and no one can say who allowed it.

Big companies have committees for this. You don't need a committee. You need one page that anyone on the team can read in two minutes.

The page has seven rules. They are the same ones we use when we build AI employees, and you can use them with any tool. Each section below takes one rule at a time.

Here are the seven in short:

• One job for each automation, written down.
• A list of what no automation may do alone.
• A named person who checks the work, and a stand-in.
• A record of every action.
• One way to stop everything, fast.
• Access only to what the job needs.
• A review on a set date.

Rule one: what is each helper's one job?

Give every automation one job, with a clear start and a clear finish. If you can't say it in a sentence, the job is too big.

Say a plumber's office has a helper for supplier bills. Its job: when a bill arrives by email, read it and prepare a draft entry in the accounts. That is the whole job. It doesn't answer customers, and it doesn't book appointments.

Small jobs are easier to check. When something goes wrong, you know exactly where to look. They're also easier to swap out, because each one stands on its own.

Here's a test. If a new colleague asked what this helper does, could you answer in one breath? If yes, the job is the right size.

Write the job on the page as a start and a finish: 'starts when a bill lands in this mailbox, ends when the draft entry and the PDF are filed.'

Rule two: what must never be sent or paid?

Write down what no automation may do on its own. The usual list is short: send an email to a customer, pay a bill, sign a contract, delete a file.

Think of a small online shop. A helper prepares a reply to an angry customer. Fine. The same helper sending that reply without anyone reading it is a different thing. The list makes the line clear before a bad day makes it for you.

Money deserves its own line. Any payment, refund or change of bank details stays with a person, however confident the helper looks.

Don't forget deleting. A helper that tidies the folder is useful, until it tidies away something you needed. Put deleting on the list too.

This list protects you and your helpers. It tells everyone, human or not, where the edge is.

Rules three and four: who checks the work, and where is it written down?

Every automation has a named person who checks its output, plus a stand-in for holidays. And every action it takes goes into a log you can read later.

Here is how we run our own AI employees: every step starts with your approval, then you choose when it goes automatic. It's the one place on this page where we say it, because it's the rule that matters most.

The log answers the question 'what happened?'. Say an accountant's office finds a bill entered twice. With a log, they see the date, the step and the file in a minute. Without one, they're guessing.

A good log line says what was done, to which item, and when. That's all.

A stand-in matters more than it sounds. If the only person who checks a helper's work is on holiday, the helper either waits or runs unchecked. Neither is good.

Rule five: how do you stop everything fast?

Someone in your business must be able to stop any automation at once, without waiting for an outside expert.

Imagine a wholesaler's helper starts filing bills under the wrong supplier. The owner shouldn't have to phone anyone. One command stops it, and the owner looks at what happened afterwards.

Stopping is not failure. It's the same idea as a fire exit: you hope never to use it, and you're glad it's there.

Write the command down where the team can find it. A stop switch nobody remembers is not much of a switch.

Test it once. Ask the person responsible to stop a helper, and see how long it takes. If the answer is 'I'd have to ask someone', fix that first.

Rules six and seven: what can it reach, and when do you review?

Each helper can reach only the accounts and folders its job needs. And the rules are reviewed on a set date, with nothing changing unless the owner says yes.

A helper that reads supplier bills has no business in the payroll folder. Giving it access to everything is easy. It's also how small mistakes become big ones.

For the review, pick a date, say every quarter, and look at three things. Did any helper do something outside its job? Did anything go wrong that the rules should have caught? Does a rule need to change? If so, the owner decides.

Take a family firm with a shared drive. The helper for quotes sees the quotes folder and nothing else. If it ever needs more, someone asks, and the owner says yes or no.

If you use several tools, check how they connect to each other. Each tool should still have one job and one set of limits. The same goes for AI operations in general: keep them dull, written down and checked.

AI best practices for employees fit on the same page. Tell your team what the helpers do, what they don't do, who to ask, and how to stop one.

Questions