AI glossary for businesses
AI governance
In short
AI governance is the set of roles, rules and routines a company uses to decide which AI it uses, how, and who is responsible. It covers approving tools, protecting data, checking quality, meeting legal duties such as the EU AI Act and GDPR, and reviewing results over time. For an SME it can be light, but it should be clear.
How AI governance works
Governance answers four simple questions. Who decides which AI tools we use? What are the rules for using them? How do we check that they work and stay within the law? What happens when something goes wrong?
An analogy is a company car policy. Someone approves which cars are bought, drivers follow clear rules, the cars get serviced, and there is a process after an accident. AI governance applies the same discipline to AI tools.
In large companies this can mean committees and long frameworks. For a small business, a light version is usually enough:
An owner: one person responsible for AI decisions, often the owner or operations manager.
An inventory: a list of AI tools in use, for which tasks, with which data.
Rules: a short AI usage policy that staff actually read.
Checks: human review of important outputs and a quarterly look at what works.
Training: enough AI literacy for each role.
In practice for a small business
A 60-person hotel group in Crete uses ChatGPT for guest emails, a chatbot on its booking site and Microsoft 365 Copilot in the office. Without governance, each department picks its own tools and no one knows which guest data goes where. With a light setup, the operations manager keeps the inventory, approves new tools and checks with the DPO before any tool touches guest data. Every quarter, the team reviews errors and time saved, and drops what does not help.
Why it matters and what to watch out for
Shadow AI is the real risk. Staff often use personal AI accounts for work. Governance brings that into the open instead of banning it outright.
Legal duties need an owner. The EU AI Act's AI literacy duty already applies, and GDPR applies to any personal data. Someone must track both.
Keep it proportionate. Too much process kills adoption. Match the effort to the risk of each use.
Vendor terms matter. Check data storage, training use and contract terms before you approve a tool. The guide to ChatGPT and Copilot at work under GDPR covers the basics.
Not legal advice. For sensitive uses, check with your DPO or legal advisor.