AI governance for a small company is a short, current set of decisions about what AI may know, see and do in the business: which records it reads, whose access it inherits, what it may send without a person, and what record it leaves. For a company of 1 to 100 people, it fits on one page.
Why small companies need AI governance now
In a large company, AI adoption goes through procurement, security review and legal. In a small one it goes through whoever found the tool, often in an afternoon. That speed is an advantage, and it means a company of twenty can end up with AI reading its inbox, drafting to its customers and summarising its board updates before anyone has asked what it should be allowed to see.
The risks are concrete rather than abstract: an assistant that shows a contractor the salary sheet, an automation that emails a customer a draft nobody checked, an answer quoted in a sales call that came from a superseded price list. None of these needs a regulator to be expensive. Governance is the habit that prevents them, and it is far cheaper to start at ten people than to retrofit at a hundred.
The pillars of AI governance, sized for a small company
Most published frameworks name a similar set of principles: accountability, transparency, privacy and security, fairness, and reliability or safety. They are right, and they are written for organisations with a risk function. Translated into what a small company actually does, they become five pillars.
- Ownership. One named person decides the rules and reviews them. Accountability starts with a name.
- Data and access. Decide which records AI may read, and make AI inherit each person's access rather than a shared super-user's.
- Human approval. AI may draft the message to a customer, but a person sends it. Drafting is free; sending is a decision.
- Traceability. An answer should name its source or say it has none, and significant actions should leave a record you can inspect.
- Review. Look at the record regularly, revisit the rules when the work changes, and remove access that is no longer needed.
What it looks like at different sizes
The first problem changes with headcount, so the first governance step does too.
- 1 to 5 people. The company runs on what one person remembers. The first step is writing down decisions with their reasoning, so AI has something better to read than the founder's inbox.
- 6 to 20 people. Knowledge splits across people, chat, meetings and documents. The first step is one shared memory, and deciding which parts of it each role may see.
- 21 to 50 people. Each team works from a different fragment of company context. The first step is consistent access rules across teams, so AI does not become the one place where the walls fall down.
- 51 to 100 people. What people and agents may know, see and do is often not defined at all. The first step is an explicit list of roles, approvals and the record that shows they held.
A one-page AI governance starter
Copy this into a document, fill in each line, and review it every quarter. It is enough for most companies under 100 people.
- Owner: the one person who decides AI rules and reviews the record.
- Inventory: every AI tool, automation and integration with access to company data, and what each one can reach.
- Allowed data: what AI may read, what it may not, and any data that must never leave the company.
- Access: whether each tool reads with each person's own access or with a shared account, and the plan to fix any shared accounts.
- Approval: which actions need a person before they happen. At minimum, anything sent outside the company.
- Sources: where answers that matter must come from, and what the team does when an answer has no source.
- Record: where significant AI actions are logged, and who looks at that log and how often.
- Revocation: how to remove a tool's access the same day someone leaves or a tool is retired.
A policy on its own enforces nothing, so the next step is moving each line into software that applies it by default. That is what an operating governance layer for AI is for.
Frameworks and rules worth knowing
You do not need to adopt a formal framework to govern AI well at this size, but knowing the main ones helps when a customer or investor asks.
- The NIST AI Risk Management Framework, from the US National Institute of Standards and Technology, is voluntary and organises the work into four functions: Govern, Map, Measure and Manage.
- ISO/IEC 42001 is an international standard for an AI management system. It is certifiable, and is most relevant once larger customers start asking for formal assurance.
- The EU AI Act regulates AI by level of risk, and can apply to companies outside the EU whose AI systems are used there. Whether and how it applies to you depends on what your AI does.
This guide is general information, not legal advice. Check obligations that apply to your company with a qualified adviser.
About Hoppflow
Where Hoppflow fits
Hoppflow is built for companies of 1 to 100 people, and it covers several of the pillars above in the product rather than in a document.
- Data and access: roles define who can see, run and approve supported parts of a workspace, and supported company-brain retrieval paths apply each person's access rules. Connecting a supported tool does not make its contents searchable by default.
- Human approval: an agent's outgoing draft waits until a person has said yes.
- Traceability: a company-brain answer names its source or says it has none, and approvals and external agent actions are kept in a tamper-evident authorization record.
- Revocation: disconnecting a supported integration revokes Hoppflow's ongoing access to that account, and access is checked again before a supported external action is sent.
Ownership and review stay with you: Hoppflow keeps the record, and a person still has to read it. Hoppflow does not claim certification against any framework named in this guide. The controls are on Security and trust, routine work with approval is on Automations, plans are on Pricing, and access is through the waitlist.
Questions people ask
What are the pillars of AI governance?
Published frameworks usually name accountability, transparency, privacy and security, fairness, and reliability. For a small company those become five practical pillars: a named owner, rules on data and access, human approval before anything leaves the company, traceability of answers and actions, and regular review.
Does a startup need an AI governance policy?
Yes, and it can be one page. Name an owner, list the AI tools with access to company data, decide what they may read and send, require a person to approve anything external, and say where actions are recorded. Review it each quarter.
How do you start AI governance in a small business?
List every AI tool that can reach company data, name one owner, and pick one use case to govern properly first. Make AI inherit each person's access, make anything external wait for approval, and keep a record of significant actions that someone reviews.
Is AI governance the same as AI compliance?
No. Compliance is meeting a specific external rule or standard. Governance is how the company decides and enforces what AI may know, see and do. Good governance makes compliance easier, but a company can be compliant on paper and still have no control over what its AI tools see.
What AI governance frameworks should a small company know?
The NIST AI Risk Management Framework, which is voluntary and organised into Govern, Map, Measure and Manage; ISO/IEC 42001, a certifiable standard for an AI management system; and the EU AI Act, which regulates AI by risk and can reach companies outside the EU.