Say your six-person startup uses AI to draft customer responses. An enterprise prospect asks about your AI governance. Your first thought is a policy pack and a committee.
Start closer to the work. What reaches the customer? What information goes into the service? Who decides a response is acceptable, and who handles the mistake?
Answer those four clearly and you've started governing.
Name the use and the owner
Write a short description of the workflow, its purpose and the boundaries of permitted use. Identify the person responsible for the business outcome and the people who can change the system or approve exceptions. In a six-person company, those may be the same two people. Write their names down anyway.
Specify where human review is needed. Use a representative customer case to check whether the reviewer has the information and authority required. Record the result and the changes it prompts.
NIST describes its AI Risk Management Framework as voluntary and use-case agnostic.1 A startup can choose controls that fit its work and what could go wrong. It doesn't need to copy a large company's committee structure.
Keep evidence of the decisions
Maintain a usable record of the provider, material data handling, acceptance checks, known limitations and the response route. Review relevant contractual and legal obligations with appropriate expertise; team size alone doesn't decide whether they apply.
When the prospect asks how the process works, show them the actual workflow and evidence. Separate the controls already working from the improvements still planned. A short, true answer beats a long one you can't back up.
Add formality when the operating need changes
Define triggers for further review: a new customer segment, more sensitive information, higher volume or permission for the system to take external actions. Examine the changed condition before extending the old approval to it.
Governance should help the business make and carry out responsible decisions. Start there. Add a committee when you have something for it to decide.
Related Reading
Read Beyond Approval: Where Operational Resilience and AI Governance Converge for the question every AI approval leaves open: what happens when it gets something wrong.
