In most SMEs we meet, AI is already there. Not in an official project: in employees' browser tabs. A salesperson has emails rephrased, an assistant summarises contracts, a project manager pastes in a cost estimate to format it. Often on free, personal accounts, whose terms do not always exclude training models on what is entered.
AI governance in an SME is first about that: bringing AI out of hiding, and giving teams a framework that allows them to use it.
What an SME does not need
Not an ethics committee, not a forty-page document nobody will read, not a blanket ban. A ban does not stop usage: it hides it. An SME needs short rules, a person who answers for them and business-grade tools made available.
The AI usage policy in 7 rules
- Approved tools. The list of validated assistants and AI tools, with business accounts in the company's name, whose terms exclude training on your data.
- Data that stays in. Personal data of clients or employees, trade secrets, sensitive pricing: what never goes into a non-approved tool.
- Human review. Nothing produced by AI goes to a client, supplier or public body without being reviewed by the person sending it.
- Accountability. Whoever sends it answers for the content, whether they wrote it alone or with AI.
- Transparency. When a client talks to an AI assistant or receives fully generated content, they are told.
- Training. Every employee who uses AI is trained on their real files: what the tool can do, what it cannot, and these rules.
- Owner and review. A named person keeps the list of tools, answers questions and reviews the policy every quarter, because tools change every three months.
These seven rules fit on one page. That is deliberate: a policy you can read in two minutes is a policy people follow.
What the AI Act really asks of an SME in 2026
The EU AI Act is intimidating because it is talked about as if it applied to everything. For an SME that uses AI tools, the obligations are simpler:
- Train and raise awareness of AI among staff. This is the so-called "AI literacy" obligation, in force since February 2025 and softened in 2026 by the amending regulation (Digital Omnibus) into a best-efforts obligation. Documented training on the tools in use meets it.
- Be transparent when a person interacts with an AI system or receives generated content, in the cases set out in the text.
- Be careful with high-risk uses: screening job applications, evaluating employees, granting credit, safety. The corresponding obligations, the heaviest ones, have been postponed to late 2027, but these are the uses to frame first.
The GDPR still applies to all personal data, AI or not. For a specific case, a lawyer remains the right contact. But for the vast majority of SME uses (drafting, summarising, research, estimating), the policy above covers the essentials.
Who owns it
Governance only exists if someone answers for it. In an SME, that is the CEO, a finance or operations director, or a fractional head of AI. What matters: they know the company's processes, have the CEO's ear, and run the review every quarter.
In the AI Maturity Score we use, governance is one of the six dimensions measured. It is often the lowest, and one of the quickest to raise.
Governance speeds up adoption
Governance is often presented as a brake. It is the opposite: as long as the rules are vague, cautious employees do not dare use AI, and the others use it badly. A clear policy and business accounts are what take a company from a few isolated uses to adoption across the team.
Codito Ergo Sum writes this policy with the CEOs it supports, sets up business accounts and trains teams as part of the Partnership, from €499 excl. VAT per month. For organisations where AI has become critical, the Enterprise Partnership takes charge of governance for the whole ecosystem. The simplest way to start: 30 minutes with the founder.
