AI Governance Policy Template for Small Companies: What to Include

An acceptable use policy tells employees what they can do with AI. A governance policy tells the company how it decides. Who approves a new AI tool? Who owns the risk when a model drafts customer emails or screens invoices? What happens when an AI agent with access to your systems does something nobody expected?

Large enterprises answer these questions with committees and frameworks. A small company needs the same answers on a few pages. This guide covers what to include, what to leave out and a sample outline you can adapt.

Governance policy vs. acceptable use policy

They work together, but they do different jobs:

If you only have time for one, write the acceptable use policy first. Staff are using AI today. Then add the governance policy so the decisions behind that list stop living in one person's head.

1. Purpose and scope

Start with two or three sentences. Say why the policy exists (to use AI productively while protecting customers, staff and company data) and what it covers. Be explicit that scope includes:

• Standalone AI tools (chat assistants, image and code generators)
• AI features built into software you already pay for
• AI agents or automations that take actions, not just produce text
• Models or AI services your company builds into its own products

The built-in features are the ones most often missed. A note-taker that switches itself on in meetings is in scope, even if nobody "bought an AI tool".

2. Roles and accountability

Small companies don't need a committee. They need names next to decisions. Define at least:

• AI owner: one person accountable for the policy and the AI inventory. Often the operations lead or the person who already owns IT.
• System owners: for each approved AI use, the person who answers for how it's used and what it outputs.
• Approvers: who can say yes to a new tool or use case, and the threshold at which the owner or leadership must sign off.
• Everyone: report incidents and unexpected AI behaviour, and follow the acceptable use policy.

Write roles, not job titles that will change. "The person responsible for IT" survives a reorganization better than a name.

3. AI inventory

You can't govern what you can't see. Require a simple register with one row per AI use:

• Tool or feature name and vendor
• Business purpose and system owner
• Data it can access (public, internal, confidential, personal, regulated)
• Whether it can take actions (send, delete, purchase, change settings)
• Risk tier (see below)
• Date approved and next review date

A spreadsheet is fine. Update it whenever a tool is approved or retired, and at each quarterly review.

4. Risk tiers

Not every AI use deserves the same scrutiny. Three tiers are usually enough:

• Low: public or non-sensitive data, a human reviews every output, no actions taken. Example: drafting a blog outline. Approval by the system owner.
• Medium: internal or confidential data, or outputs that reach customers. Example: summarizing support tickets. Requires AI owner approval and a vendor check.
• High: personal or regulated data, decisions about people (hiring, credit, pricing for individuals), or AI that takes actions in your systems. Requires leadership approval, a documented risk assessment, and named human oversight.

The tier drives everything else: how much vendor review, how often to check outputs, and who signs off.

5. Approval process for new tools and use cases

Describe the path from "I'd like to use this" to "approved":

1. Requester fills in a short intake form: tool, purpose, data involved, who will use it.
2. AI owner assigns a risk tier.
3. Vendor review proportional to the tier (see next section).
4. Decision recorded in the inventory, with any conditions ("internal data only", "outputs reviewed before sending").

Set a target turnaround, such as five working days for low-risk requests. If approval is slow, people route around it.

6. Vendor and contract requirements

For medium and high tiers, check the vendor terms before approval. Key questions:

• Does the vendor train models on your inputs or outputs? Can you opt out, and is it off by default on your plan?
• How long are prompts and outputs retained, and where?
• Is there a data processing agreement covering personal data?
• Can you get admin controls: single sign-on, audit logs, the ability to disable features?
• Who owns the outputs, and what indemnity, if any, does the vendor offer?

Record the answers. Terms change, so re-check at each review.

7. Human oversight and output quality

AI makes confident mistakes. The policy should state plainly that a person remains accountable for anything AI produces or does on the company's behalf. For each tier, define:

• Whether every output is reviewed before use, or a sample is checked
• Who reviews it and what they check (accuracy, tone, bias, confidential content)
• For AI that takes actions: what it may do unattended, what needs confirmation, and spending or permission limits

For agents in particular, give them the least access they need, use separate accounts so their actions are logged, and keep a documented way to switch them off quickly.

8. Fairness, transparency and people decisions

If AI touches decisions about people (job applicants, employees, customers), add specific rules:

• AI may assist, but a person makes the final decision.
• Check outputs for patterns that disadvantage particular groups.
• Tell people when they are interacting with AI or when AI materially contributed to a decision about them, where the law requires or it's simply the decent thing to do.

Several jurisdictions now regulate automated decisions in hiring and lending. Flag this section for legal review.

9. Incidents

Define what counts as an AI incident: confidential data entered into an unapproved tool, a harmful or wrong output that reached a customer, an agent taking an unexpected action. Then route it into your existing incident process: who to tell, how fast, and how to record lessons learned. You don't need a separate AI incident plan.

10. Training and awareness

A short annual session plus onboarding is enough for most small companies. Cover the acceptable use rules, how to request a new tool, and how to report a problem. Keep a record of who completed it.

11. Review cycle

AI tools and terms change fast. Commit to:

• A quarterly review of the inventory and approved tool list
• An annual review of the policy itself
• An ad hoc review when a major vendor changes terms or a new regulation applies to you

Sample outline

Copy this structure and fill it in:

1. Purpose and scope
2. Definitions (AI tool, AI feature, AI agent, personal data, confidential data)
3. Roles and responsibilities
4. AI inventory requirements
5. Risk tiers and criteria
6. Approval process
7. Vendor and contract requirements
8. Human oversight and output review
9. People decisions, fairness and transparency
10. Incident reporting
11. Training
12. Review and exceptions
13. Related policies (acceptable use, data classification, information security, privacy)

Common mistakes to avoid

• Copying an enterprise framework wholesale. Forty pages nobody reads protects nobody. Start small and add detail where your real risks are.
• No owner. A policy without a named accountable person decays within a quarter.
• Ignoring agents. Tools that can act on your behalf need tighter limits than tools that only write text.
• Treating approval as one-off. Re-check vendors and uses at every review.

This is general guidance, not legal advice. Have qualified counsel review your final policy, especially if you handle regulated data or make automated decisions about people.

Resources: Free AI acceptable use policy template · AI agent policy, agent inventory and permission register, NIST AI RMF risk assessment, ISO/IEC 42001 clause-mapping workbook, human-in-the-loop and kill-switch runbook, incident playbook, vendor questionnaire, EU AI Act checklist and board one-pager: AI Agent & Robotics Governance Kit ($249; code LAUNCH30 takes 30% off paid templates through Oct 31, 2026). I make these templates.

Drafted with AI assistance and reviewed for accuracy.

Not affiliated with, endorsed by, or sponsored by NIST, ISO, IEC or the European Union.