AI governance FAQ for regulated small businesses

It is the ongoing function of deciding where AI is allowed, under what rules, on which tools, with what human oversight, and how its value is measured. In practice it is a short set of living documents (a tool inventory, an acceptable use policy, a data classification reference, a risk assessment, and an onboarding and offboarding procedure) plus the habit of keeping them current. It is a job, not a one-time project.

If anyone in your business uses AI, including personal accounts on personal devices, then yes. The choice is not whether to allow AI, it is whether the rules live in individual heads or on paper. A written policy turns invisible use into something you can see, guide, and defend.

No. A ban does not stop people from using AI, it stops them from telling you. The work still gets pasted into a chat window on a personal account with no record and no rules. Prohibition removes your visibility into the risk, not the risk. Governance beats prohibition because it brings the use into the light.

Shadow AI is staff using AI tools the business has not approved or does not know about, usually on personal accounts. It is the predictable result of having no policy or a ban. The fix is not enforcement, it is giving people an approved way to do the thing they are already doing.

Usually the tier — which plan level of the tool you buy — not the tool. A free or personal account often allows your inputs to train the underlying model, meaning what you type in leaves your control. A business or enterprise tier of the same product usually does not, and gives you admin control and documentation. Choosing and configuring the right tier is most of the gap between defensible and exposed.

It depends on the tier and the configuration. Free and personal-version tiers may use your inputs to improve the model — meaning what you paste in leaves your control — unless you turn that off in settings. Business and enterprise tiers of the major tools generally do not train on your data by default and give you a written commitment you can show later. Verify the setting and keep the documentation.

A tool inventory and approved-use registry, an acceptable use policy, a data classification quick reference, an AI risk assessment, and an onboarding and offboarding procedure. The value is in having them, keeping them current, and operating from them. AI moves fast; these documents set your pace instead of the vendors'.

One named person, an AI Program Lead, usually whoever already owns IT or operations decisions. Most AI programs stall because nobody owns them — no accountability, no follow-through.

Underneath everything. AI tools are reached through identity, so a program built on weak account and login security is documentation of holes. Multi-factor authentication (a second login step, like a phone code), account inventory, and checking whether your usernames and passwords have appeared in a breach are part of the AI program, not separate from it.

It means a person reviews AI output before any consequential action is taken. It matters for quality, because these tools produce confident output that is sometimes wrong, and for accountability, because the AI did it is not a defense a professional gets to make. The checkpoint is a design feature, not friction to remove.

Establish a baseline before you change anything: how long the task takes, what it costs, the error rate. Then run an honest before-and-after comparison on a regular schedule, quarterly works well, and tie the metrics to how the business makes money rather than vanity numbers like how many questions people typed into the AI.

ABA Formal Opinion 512, issued July 29, 2024, is the first formal ethics guidance on generative AI. It addresses competence, confidentiality, communication with the client, candor toward tribunals, supervision of lawyers and nonlawyer assistants including AI tools, and reasonable fees. It does not ban AI. It describes what responsible, documented use looks like.

It can. In United States v. Heppner (SDNY, 2026), documents a defendant created with a public AI chatbot and later shared with counsel were ruled not privileged. The lesson is that free or personal-version tools and undocumented use create exposure, and that enterprise tiers used under a defined process are more defensible. We help build that process; we do not give legal advice.

Map where protected health information actually flows in the scribe workflow, confirm a business associate agreement is in place and covers AI use, choose a tier that does not train on your data, and keep a human checkpoint before anything enters the record. This is data-handling and identity work, which is exactly what an assessment covers.

Drafting, summarizing, and organizing are high-value and low-risk. Anything that puts client financial data into a free or personal-version tool is high-risk. The governance work is deciding which uses are approved, on which tier, with what checkpoint, before busy season rather than during it.

No. We assess the container, not the contents. We examine who has access to which AI tools and what those tools can reach. We do not read your client files, patient records, or matter documents. That boundary is what makes the work appropriate for businesses bound by professional duty.

The first useful version is fast. You can build an honest tool inventory and fix the worst tier and identity gaps in days. A full foundation with finished documents and a measurement framework is typically a few weeks of part-time work, or a four to six week assessment if you want it built and handed to you.

See what is actually happening through an audit (build the tool inventory, including personal accounts). Get the floor right (correct tiers, turn off training on inputs, confirm basic account and login security). Write the minimum rules (acceptable use and data classification). Then build the rest and add measurement. Automate last, with checkpoints.