- AI governance is a short set of rules and owners for how your business picks, uses and checks AI tools. For a small business it fits on a few pages.
- Start with an AI usage policy: approved tools, what data can go in, when a human must review, and who to ask. A template is below.
- The NIST AI RMF is the most practical free framework. The EU AI Act matters if your AI touches people in the EU; its high-risk rules now apply from December 2027.
- Canada has no AI-specific federal law as of November 2026; privacy law (PIPEDA, Quebec's Law 25) and sector rules still apply to AI use.
AI governance consulting helps a business decide which AI tools it may use, for what, with which data, and who checks the results. For a small or mid-sized business, good governance is not a committee. It is an AI inventory, a short usage policy, a review step for higher-risk uses, and an owner for each system. You can do much of it yourself with the template in this guide; outside help is useful when you handle sensitive data or sell into regulated markets.
Below: what governance covers, responsible AI examples you can copy, a usable AI usage policy, and where the NIST AI RMF, the EU AI Act and Canada’s approach stand as of November 2026.
What AI governance means for a small business
Governance answers four questions:
- What AI are we using? Include the obvious (ChatGPT, Copilot) and the hidden (AI features inside your CRM, phone system or accounting app).
- What could go wrong? Data leaks, wrong answers sent to clients, unfair decisions, surprise costs.
- What are the rules? Approved tools, data limits, review steps.
- Who is responsible? One owner per system, and one person who keeps the inventory.
Most governance failures in small firms are mundane: an employee pastes a client contract into a free AI tool, or an AI-drafted email with a wrong price goes out unreviewed. A policy and a few habits prevent most of them.
What responsible AI looks like in practice
| Principle | What it means day to day | Example |
|---|---|---|
| Transparency | People know when they’re dealing with AI | AI receptionist says it’s an assistant |
| Human oversight | A person reviews high-stakes output | Lawyer checks every AI-drafted clause |
| Privacy | Sensitive data stays out of unapproved tools | Patient data only in approved systems |
| Fairness | AI doesn’t screen people out unfairly | No AI-only rejection of job applicants |
| Accuracy | Output is checked against sources | RAG assistant cites the policy it used |
| Accountability | Someone owns each system | Office manager owns the scheduling bot |
These map closely to the EU’s 2019 Ethics Guidelines for Trustworthy AI, which many later frameworks build on.
Responsible AI implementation in 6 steps
- Inventory. List every AI tool and AI feature in use, who uses it, and what data it sees. A shared spreadsheet is fine.
- Classify risk. Low: drafting marketing copy. Medium: summarizing client files. High: anything that affects hiring, credit, health, legal outcomes or pricing for individuals.
- Set data rules. Decide what can go into which tools (see the traffic-light chart below).
- Define review. Medium and high-risk uses need a named human check before output leaves the business.
- Train. A 30-minute session with real examples from your work beats a long slide deck.
- Review quarterly. Tools change fast. Update the inventory and policy every three months.
A sample rule set. Adjust it to your industry, contracts and privacy obligations.
Governance for AI workflow automation
Automations and agents need a few extra controls because they act without someone watching each step:
- Least privilege: each workflow gets only the access it needs.
- Human approval before payments, deletions or messages to customers in new situations.
- Logs of inputs, AI outputs and actions, kept for a set period.
- Kill switch: a simple way to pause a workflow.
- Change control: someone reviews prompt and workflow changes before they go live.
Our workflow automation guide covers how to build these into tools like n8n and Make, and our generative AI integration guide covers the security risks specific to language models.
AI usage policy template
Copy this, replace the bracketed parts, and cut anything that doesn’t apply. Keep it under three pages so people actually read it.
The template
[Company name] AI Usage Policy Version [1.0] · Effective [date] · Owner: [name, role] · Next review: [date + 3 months]
1. Purpose This policy explains how staff at [Company] may use artificial intelligence (AI) tools at work, so we get the benefits while protecting clients, staff and the business.
2. Scope This policy covers all employees, contractors and interns, and any AI tool used for [Company] work, including AI features built into other software (email, CRM, phone, accounting, design tools).
3. Approved tools You may use only these AI tools for work:
- [Tool, plan] for [purpose], e.g. “ChatGPT Business for drafting and summarizing”
- [Tool, plan] for [purpose], e.g. “Microsoft 365 Copilot for email and documents”
- [Tool] for [purpose]
To request a new tool, email [owner]. Don’t use personal or free accounts for work.
4. Data rules
- Green (any approved tool): public information, general questions, marketing drafts with no client details.
- Yellow (approved business tools only): internal documents, client names and contact details, pricing, non-sensitive project information.
- Red (never, unless [owner] approves in writing): health information, government ID numbers (SIN, SSN), payment card or bank details, passwords and API keys, information covered by a confidentiality agreement that forbids it, [other].
5. Human review A person must review AI output before it is:
- sent to a client, patient, tenant or the public;
- used to make or support a decision about a person (hiring, pricing, credit, service eligibility);
- used in legal, financial, medical or safety-related work.
The person who sends or uses the output is responsible for it.
6. Transparency Tell people when they are talking to an AI system (for example, an AI phone assistant or chatbot). Don’t present AI-generated images, voices or text as a real person’s words.
7. Prohibited uses
- Making final decisions about hiring, firing, discipline or pay with AI alone.
- Creating deceptive content, impersonating real people, or generating content that harasses or discriminates.
- Uploading content you don’t have the right to share.
- Trying to bypass a tool’s safety settings.
8. Automations and AI agents Automated workflows that use AI must have a named owner, use the minimum access needed, log their actions, and require human approval for [payments / deletions / first-time customer messages]. Changes go through [owner] before going live.
9. Incidents If AI output causes or could cause harm, or you shared red data by mistake, tell [owner] within [24 hours]. Don’t try to hide or fix it alone.
10. Training and review Everyone completes [30-minute] AI training when they join and when this policy changes. [Owner] reviews this policy and the AI inventory every [three months].
I have read and understood this policy: [name, signature, date]
AI governance frameworks and laws (as of November 2026)
NIST AI Risk Management Framework (US, voluntary)
The NIST AI RMF 1.0 is free, voluntary and the most practical starting point for North American businesses. It organizes the work into four functions:
- Govern: policies, roles, accountability.
- Map: understand the context and risks of each AI use.
- Measure: test and track performance, bias and failures.
- Manage: prioritize and act on risks, including incidents.
NIST added a Generative AI Profile (NIST AI 600-1) in July 2024 that lists risks specific to generative AI, such as confabulation (confident wrong answers), data privacy and information security. A small business doesn’t need to adopt the whole framework. Using its four functions as section headings in your own policy is a reasonable start.
EU AI Act
The EU AI Act sorts AI systems by risk. It can apply to US and Canadian companies when their AI systems are placed on the EU market or their output is used in the EU.
Key dates after the 2026 “AI Omnibus” amendment, which EU lawmakers formally adopted in mid-2026:
- February 2025: prohibited practices banned; AI literacy duty for providers and deployers.
- August 2025: rules for general-purpose AI models.
- August 2026: transparency duties (for example, telling people they’re interacting with AI and labeling synthetic content), with a grace period to December 2026 for some systems already on the market.
- December 2027: obligations for stand-alone high-risk systems (Annex III, such as hiring and credit scoring), moved from August 2026.
- August 2028: high-risk AI embedded in regulated products (Annex I).
For a North American service business with EU clients, the practical items are AI literacy (train your staff), transparency (disclose AI chatbots and synthetic media) and avoiding high-risk uses like AI-only hiring decisions without proper controls.
Canada’s approach
Canada still has no comprehensive federal AI law. The proposed Artificial Intelligence and Data Act (AIDA) died when Parliament was prorogued in January 2025. The national strategy “AI for All”, released in June 2026, focuses on adoption, skills and trust and does not propose comprehensive AI legislation, with targeted rules expected on specific issues instead.
What applies today:
- Privacy law. PIPEDA covers personal information used in AI tools by private businesses. Quebec’s Law 25 adds a duty to inform people when a decision about them is based exclusively on automated processing.
- Voluntary code. The federal Voluntary Code of Conduct for advanced generative AI systems is a useful checklist even if you don’t sign it.
- Sector and human rights rules. Professional regulators (law societies, health colleges) and human rights codes apply to AI-assisted work just as they do to any other work.
United States
There is no comprehensive federal AI law. Existing laws still apply: FTC rules on deceptive practices, anti-discrimination laws in hiring and lending, and sector rules like HIPAA. State laws are growing, but several (including Colorado’s AI Act) have been delayed or challenged, so check current status for any state where you operate before relying on a date.
When AI governance consulting makes sense
You can likely handle governance yourself if you use a few mainstream AI tools, don’t make automated decisions about people, and don’t handle health or financial records.
Bring in an AI governance consultant (or AI ethics consultant) when:
- you handle health, legal, financial or children’s data;
- you use AI in hiring, lending, insurance, tenant screening or pricing for individuals (our guide to AI for HR covers the hiring side);
- you sell AI-enabled services to EU customers or large enterprises with vendor questionnaires;
- you’re deploying agents that act without real-time human review.
What a governance engagement should deliver
| Deliverable | Typical effort for an SMB |
|---|---|
| AI inventory and risk classification | 1–2 weeks |
| AI usage policy and approval process | 1 week |
| Framework mapping (NIST AI RMF, EU AI Act) | 1–2 weeks |
| Vendor review checklist | Days |
| Staff training session | Half a day |
Governance works best when it’s part of the plan from the start. Our AI strategy consulting guide shows where it fits in a 90-day roadmap.
Automating compliance work
AI can also reduce the cost of compliance itself, with care:
- Policy acknowledgment: a workflow sends the policy to new hires and tracks signatures.
- Access reviews: a monthly automation lists who has access to which systems and asks owners to confirm.
- Data subject requests: a form routes privacy requests, finds records and tracks deadlines.
- Vendor questionnaires: a RAG assistant drafts answers from your existing security documents for a person to review.
Keep humans responsible for the final call on anything legal. AI drafts, people decide.
If you’d like help writing your first AI policy or reviewing an automation for risk, opsmigo can do a short review alongside any build we take on.
We build a free demo on your own services and hours.
FAQ
What does an AI governance consultant do?
An AI governance consultant inventories the AI tools you use, assesses their risks, writes policies and approval steps, and maps your obligations under laws and frameworks like the NIST AI RMF and the EU AI Act. For small businesses this is often a few weeks of work, not an ongoing program.
Does a small business need an AI policy?
Yes, if any employee uses AI tools for work, which is most businesses now. A one-to-three-page policy prevents the most common problems, such as client data pasted into free tools and AI-written content sent without review.
Does the EU AI Act apply to US or Canadian companies?
It can. The Act covers providers and deployers outside the EU when their AI systems are placed on the EU market or their output is used in the EU. A local service business with no EU customers is unlikely to be affected.
Is there an AI law in Canada?
Not a comprehensive federal one as of November 2026. The proposed Artificial Intelligence and Data Act died in January 2025, and the June 2026 national AI strategy did not revive it. Privacy, human rights and consumer protection laws still apply to AI use.
What is responsible AI?
Responsible AI means using AI in ways that are fair, safe, transparent and accountable: people know when AI is involved, decisions can be explained and challenged, data is protected, and a named person is responsible for each system.