Summer 2026 audits and partner questionnaires began asking SMEs the same questions large firms get: who approved the model, where the data sits, and what happens when the output is wrong.

AI governance for a small company does not need a hundred-page binder. What actually costs money is the absence of a named owner and clear rules for sensitive data. A one-page working policy — allowed tools, banned data types, and who may call a stop — usually beats a thick document nobody follows.

For every live use case, record three things: the business goal, the data source, and the acceptance test for outputs. Keep exceptions with a human and define escalation in advance so decisions do not become ad hoc under pressure.

If you sell to a larger partner, prepare those three answers before the contract is signed; slow governance replies delay deals more often than model quality does.

Manager action: Write a one-page AI use policy: approved tools, banned data types, and who can say stop.