AI Governance Checklist for SMEs

AI governance is the set of decisions, roles and records that keep AI use aligned with the business. An SME does not need a large committee to begin, but it does need named responsibility and a consistent way to approve, review and stop a workflow.

This checklist is a practical baseline. Apply more detailed legal, security or sector controls where the use requires them.

Ownership

Name a senior owner for AI use across the organisation.
Name a business owner for each approved workflow.
Define who approves tools, data use and major changes.
Give staff a clear route for questions and incident reporting.

Inventory

Record approved tools and account types.
Record each business use, owner and purpose.
Include features built into existing software.
Review informal or unapproved use without discouraging honest reporting.

Data and access

Classify information before it enters a workflow.
Use the minimum information needed for the task.
Review supplier data handling and retention.
Apply access controls and remove unused accounts.
Keep logs where the risk and system allow.

Use the live ICO AI and data protection risk toolkit where personal data is involved.

Assessment and approval

Describe the purpose and expected outcome.
Compare AI with a simpler process or rules-based option.
Assess possible harm to customers, staff and other people.
Document supplier, security and operational dependencies.
Approve the remaining risk before live use.

Testing

Use ordinary, difficult and unusual examples.
Define unacceptable errors before testing.
Check source use, accuracy and consistency.
Test permissions, fallback and recovery.
Record the approved configuration and evidence.

People and training

Explain approved and prohibited uses.
Train staff to check outputs and protect information.
Make human review meaningful rather than automatic approval.
Update training when the workflow changes.

Monitoring and change

Track outcomes, corrections and exceptions.
Review supplier and model changes.
Set warning levels and stop conditions.
Repeat the risk assessment after material changes.
Retire workflows that no longer serve the purpose.

Records

Keep the decision, risk assessment, test evidence, owner, approved use, training record, review dates and incidents together. The AICC Responsible AI tools can help organisations create practical governance records.

Keep governance proportionate

A low-risk drafting aid using public information does not need the same approval as a workflow using customer records or influencing an important decision. Define simple risk levels and the review required for each. This helps routine ideas move without weakening control over sensitive work.

Governance should also fit existing management. Use current security, data protection, procurement and change processes where they work. Add AI-specific questions rather than creating a separate bureaucracy that nobody follows.