AI governance for a small business: what owners decide

Start with a name. One person answers for AI across the business, and in a small business that is usually the owner or CEO. Give them the authority to say no.

Then split the decisions. The accountable person decides which tools are approved and what data may go in. Each tool gets its own owner, who answers for what it does and when it is reviewed.

You do not need a committee. You need a name against every row, and a place where the board sees the result. With no board, an adviser you trust can play that part.

The register is a list with one row for each AI tool or AI feature in use. Include the free tools staff sign up to. Include the AI inside software you already pay for.

Each row says what the tool does, what data it touches, who owns it, when it was approved and when it is reviewed. The rule is short: a tool that is not on the register is not approved.

In the sample, the note-taker is High risk because it hears client names, and its review date has passed. That is the row the owner reads first.

The Australian Government’s Guidance for AI Adoption has its own AI policy template and AI register template. This one is pre-filled for a small business with sample rows. Its 12 policy statements each rest on the OAIC’s words or are marked as a business choice, and it adds a never-enter list.

Download the AI register and AI policy template (Excel). It holds the register, 12 policy statements and the never-enter list. The sample rows are marked, so delete them before use.

This is the shortest decision and the one that matters most. The OAIC recommends, as best practice, that organisations ‘do not enter personal information, and particularly sensitive information, into publicly available generative AI tools’ (OAIC guidance on commercially available AI products, updated 17 January 2025).

Turn that into a never-enter list staff can read in a minute. Add what you want kept private as a business choice: bank details, passwords and results not yet released. Tell staff to report a slip the same day.

Then check which rules apply. The OAIC describes a small business as one with annual turnover of A$3 million or less, and says most are not covered (OAIC, small business). The Productivity Commission lists the exceptions, among them health service providers and credit reporting bodies (Productivity Commission report No. 111). From 10 December 2026, covered businesses must also describe in their privacy policy where a computer program makes or informs decisions that significantly affect people (OAIC). Get privacy advice where your situation is unclear.

Put one gate between a request and first use. The tool owner writes six lines on the register row, and the accountable person signs. Nothing goes live without them.

The OAIC’s due diligence list is a fair test of the six lines. It asks whether the product has been tested for the use, how human oversight is built in, what the privacy and security risks are, and who can access the information.

Worked example, sample only: an AI note-taker for client meetings. It hears names and contact details, so the register says High risk, a named person checks each summary, and the review date is six months out.

Keep the proof, not only the sign-off. For each product, the annex holds the exact plan, the task, the data sent and the date you read the vendor’s terms, with a copy of the page. It has a column for each of the five questions in the OAIC’s checklist for selecting a commercially available AI product (PDF, undated). At each review date, read the vendor’s page again. If a term has changed, log it, name who decided and update the row.

Download the AI vendor evidence annex and reassessment log (Excel). It has a filled sample of three made-up products, including a changed term traced to a decision, and blank sheets. Use it with the register above. Whether the Privacy Act applies to you is a question for a privacy adviser.

A board does not need a list of prompts. It needs to know what is in use, what changed and what went wrong. Four items a quarter cover it.

The monthly look is the owner’s. The quarterly report goes to the board. Once a year the policy is read again, including whether the privacy policy still matches the register.

The rhythm is a suggestion, not a rule. Adjust it to the size of your risk.

Governance is a cost, not a saving. The sample shows the time and the cash apart, for a 20-person business with five tools.

The template is free and the register is a spreadsheet you already own, so the cash cost is A$0. Privacy advice, where you need it, is extra. Ask the adviser for a quote.

What the time buys is a decision made before a mistake, not after. It does not promise that no mistake happens.

An hour is enough to start.