Good AI governance for a small business is not a 100-page framework. It is knowing which AI you use, who is responsible for it, what could go wrong and how you would notice. This checklist draws on ISO/IEC 42001, the NIST AI Risk Management Framework, the EU AI Act and ICO guidance, scaled down to what a team of 5 to 250 people can realistically do.
1. Know what you have
- Keep an inventory of every AI system you build, buy or use, including AI features in existing software
- Record the purpose, owner, data used, supplier and the people affected for each one
- Review the inventory every quarter
2. Give it an owner
- Name one person accountable for AI governance, even part-time
- Give every AI system a business owner who signs off changes
- Report AI risks to the board or owners at least twice a year
3. Classify the risk
- Rate each system as minimal, transparency, high or prohibited risk under the EU AI Act, where it applies
- Flag any system that makes or supports decisions about people: hiring, credit, pricing, access to services
- Stop and review anything that might be prohibited
4. Write a short AI policy
- Set out approved tools and what staff may and may not put into them
- Ban entering confidential or personal data into unapproved public AI tools
- Explain how to request a new AI tool and who approves it
5. Protect personal data
- Confirm a lawful basis under UK GDPR for personal data used in AI
- Complete a data protection impact assessment for high-risk processing
- Offer human review for significant automated decisions
6. Check your suppliers
- Ask AI vendors where data is processed, whether it trains their models and how long it is kept
- Get documentation on testing, known limitations and intended use
- Put data processing terms in every contract
7. Keep people in the loop
- Define which actions need human approval before they happen
- Make sure reviewers have the time, training and authority to overrule the AI
- Tell customers when they are talking to a chatbot or seeing AI-generated content
8. Test before and after launch
- Agree acceptance criteria before building or buying
- Test for accuracy, bias across groups, security and failure cases
- Monitor performance and drift in production and re-test after changes
9. Log and respond
- Keep logs of inputs, outputs and decisions for high-risk uses
- Have a simple incident process: how to report, pause and fix an AI problem
- Record incidents and what you changed
10. Train your team
- Give everyone who uses AI basic training on its limits and your policy
- Give owners and reviewers deeper training on risk and oversight
- Keep a record of who has been trained
Where to start
If you only do three things this month: build the inventory, publish a one-page AI policy, and add a chatbot disclosure wherever customers talk to AI. Those three steps cover most of the risk for most small businesses.
If any of your systems make decisions about people or are sold into the EU, read our EU AI Act guide for UK businesses next.
This checklist is general information, not legal advice.