AI governance has a scaling problem.
Small and medium-sized businesses are being told they need to govern AI, and they do. But most of the guidance available to them was written for governments, large enterprises, and heavily regulated institutions. It assumes committees, dedicated staff, and budget lines that a 40-person company does not have and does not need.
That same 40-person company using AI to draft marketing copy should not be running the governance machinery of an organization using AI to decide who gets credit, process health records, or move money without a human in the loop.
So the question is not “do we need AI governance?”
The question is “how much governance is reasonable for what we are actually asking AI to do?”
Start by finding out what you are actually running
Before any framework applies, there is a step most SMBs skip: knowing which AI tools are already in use.
In practice, AI arrives in a small business the way file sharing did fifteen years ago. Nobody approves it. Someone in sales starts using a chatbot to write proposals, someone in finance discovers a summarization feature inside a tool the company already pays for, and a developer wires an API into a workflow over a weekend. None of it is malicious. All of it is invisible.
You cannot govern what you have not inventoried. A single conversation with each team leader, asking what AI tools they use and what information goes into them, is usually enough to produce a first list. That list is the real starting point.
Some obligations do not scale down
Proportionate governance is not permission to skip things.
A handful of obligations apply regardless of company size. In Quebec, Law 25 requires organizations to inform individuals when a decision about them is based exclusively on automated processing, and to give them a way to respond. Privacy legislation applies to personal information whether a person or a model is processing it. Client contracts and confidentiality agreements rarely contain an exception for AI tools. Regulated sectors carry their own requirements, and businesses serving European customers face the AI Act’s transparency obligations on their own timeline.
That is the floor. Proportionality is how you decide what sits above it.
The 3P model applied to AI
At Stratos Cyber we use a three-part model: Purpose, Prepare, Practical.
Purpose comes first. Why are we using this tool? What business outcome does it support? What information does it touch? What decisions does it influence, and what happens if it gets one wrong? Governance should begin with the purpose and the consequence of the use case, not with a catalogue of controls looking for somewhere to land.
Prepare asks what needs to be in place before the tool behaves in a way you did not plan for. Who notices? Who can stop it? What is the fallback if it goes offline, gives a confidently wrong answer, or is used for something it was never scoped to do? The greater the consequence, the more preparation the use case earns.
Practical keeps the whole thing grounded in the reality of a business with no AI governance team. Controls have to be understandable, affordable, and sustainable by the people who already have full-time jobs. Governance so heavy that employees quietly route around it does not reduce risk. It relocates it somewhere you cannot see.
What proportionate actually looks like
Most SMB AI use falls into three tiers. The tier is set by what the AI touches and how much autonomy it has, not by how impressive the technology is.
| Tier | What the AI does | Typical examples | Reasonable governance |
|---|---|---|---|
| Tier 1 — Assist | Drafts, summarizes, brainstorms. No confidential or personal information involved. | Marketing copy, internal meeting notes, code suggestions on non-sensitive projects. | Approved tool list. A one-page acceptable use policy people can actually read. A clear rule on what never gets pasted in. Human review before anything goes out. |
| Tier 2 — Handle | Processes customer, employee, or confidential business information, or shapes a decision a person still makes. | Support ticket triage, CV screening, contract or document analysis, customer correspondence. | Everything in Tier 1, plus a named owner per use case, defined data-entry rules, vendor terms checked for retention, training use and residency, usage logging, required disclosure, documented human sign-off, and annual review. |
| Tier 3 — Act | Takes action in business systems or executes decisions with limited human involvement. | Agents with access to CRM, finance, or email; automated approvals and ticket resolution. | Everything in Tier 2, plus least-privilege access and a separate identity for each agent, full action logging, approval gates, tested rollback, an authorized kill switch, pre-deployment testing, and owner or board sign-off. |
Most SMBs are entirely in Tier 1 and Tier 2. Very few need Tier 3 today, and those that do usually get there by accident, when a tool quietly gains the ability to act rather than to suggest.
The part that keeps it honest: Pulse
The three Ps give you a position. Pulse is the loop that keeps that position true.
AI systems change underneath you. Providers update models and terms. A tool that suggested last quarter now executes. Permissions expand. New staff bring new tools. A use case scoped for internal drafting drifts into client-facing work.
Pulse is a short, scheduled check—quarterly is enough for most businesses—asking three questions:
- Is each tool still being used for the purpose we approved?
- Has anything moved up a tier since we last looked?
- Are the controls we put in place actually being followed?
Purpose, Prepare, Practical, sustained by Pulse. That is the whole model.
The business case is not compliance
For most SMBs, the pressure to govern AI does not arrive from a regulator. It arrives commercially.
It is a client security questionnaire with three new AI questions on it. An insurer asking, at renewal, what AI has access to customer data. A larger prospect making the deal conditional on how you answer. A partner requiring written confirmation that their information is not being used to train someone else’s model.
In every one of those situations, what you need is evidence. Not a policy binder. A short, credible account of what AI you use, what it touches, who owns it, and what controls sit around it. Businesses that can produce that in an afternoon win work. Businesses that cannot spend three weeks assembling it under deal pressure, or lose the deal.
Reasonable is the standard
Reasonable AI governance is not weak governance. It is proportionate governance.
The objective is not to make a small business look like a large enterprise. It is to give the business enough control, accountability, and evidence to use AI confidently, without turning governance itself into the reason nothing gets adopted.
Not maximum AI governance. Not minimum AI governance. Reasonable AI governance.
Where to start
Our AI Readiness Assessment does the first three steps for you: inventories the AI already in use across the business, assigns each use case to a tier, and produces the evidence package you will be asked for by clients, insurers, and partners. Fixed scope, fixed price, delivered in weeks rather than quarters.