AI governance — the policies, roles and checks that decide how an organization uses AI: which tools are approved, what data may go into them, who reviews the output, and what happens when something goes wrong.
What it looks like at small-business scale
Not a committee. Usually a few pages that answer five questions: which AI tools staff may use; what information must never be pasted into them; which uses need a person to review the output; who owns each AI-driven workflow; and how a mistake gets reported and fixed.
Without a policy, AI use happens anyway — on personal accounts, with client data, invisibly. The document is less about restriction than about bringing that use somewhere it can be seen.
The reference framework
The most widely used public framework is NIST’s AI Risk Management Framework (AI RMF 1.0, January 2023), which organizes the work into four functions: Govern, Map, Measure and Manage. It is voluntary and written for organizations of any size — a reasonable spine for a small-business policy, even if much of it will never apply.
For health and wellness practices, an AI policy does not replace HIPAA obligations and is not legal advice. It is the operational layer that sits on top of them.
Source: NIST, AI Risk Management Framework (AI RMF 1.0), January 2023.
Related: human-in-the-loop, prompt injection, AI integration.