Governance that fits a small organization

In this lesson you'll

• Explain why small organizations need AI governance even without a security team
• Learn from two real cases where AI use went wrong for an organization
• Use ETA's ADAPT framework as the everyday habit governance builds on

Welcome

Welcome to AI Governance for Small Organizations from the Enterprise Technology Association (ETA). This course is for owners, executive directors, operations managers and office leads at small businesses, nonprofits, practices and small public bodies: places where one person often wears the IT, HR and compliance hats at once. Your team is already using AI, whether or not anyone approved it. Governance is how you make that use safe, consistent and worth it, in a way that fits a team of 5 or 150. This course assumes you've completed Level 1: Foundations of the ETA Applied AI Professional Certificate (free).

Governance is a few habits, not a department

Large companies have AI councils, risk committees and security teams. You don't need any of that. Small-organization AI governance comes down to a handful of things done consistently:

1. One owner who keeps the list, answers questions and makes calls.
2. An inventory of the AI tools and features you use.
3. A one-page policy that says which tools are approved, what data stays out and who checks what.
4. Risk levels so low-risk uses move fast and high-risk uses get a closer look.
5. Vendor checks before you sign up or turn on a feature.
6. An incident plan for when something goes wrong.
7. A short review every quarter.

That's the whole course in one list. Each lesson turns one item into something you can use on Monday.

Two cases worth knowing

Samsung, 2023. Reports in 2023 said engineers at Samsung pasted confidential source code and internal meeting notes into a public AI chatbot to get help with their work. The company then restricted employee use of generative AI tools. Nobody meant harm; they were trying to work faster. The gap was missing rules and missing approved tools.

Air Canada, 2024. Air Canada's website chatbot told a grieving customer he could claim a bereavement fare discount after flying. The airline's actual policy said otherwise, and it refused the refund. A Canadian tribunal ruled for the customer and rejected the airline's argument that the chatbot was responsible for its own words. The lesson for any organization: you own what your AI tells customers.

Both cases are about large organizations, and both happen every day at small ones, just without the headlines.

Why small organizations are exposed

Small organizations often hold sensitive data (client files, donor records, patient or student information, payroll) with fewer controls. AI arrives through free accounts, browser extensions, meeting bots and features switched on in tools you already pay for. Customers and funders are starting to ask how you use AI. A little structure now prevents expensive surprises later.

Workplace example: a 20-person marketing agency

The owner of a 20-person agency asked her team what AI tools they used. She expected three; the answer was eleven, including two browser extensions with access to client email. She named her operations manager as AI owner, picked two approved tools with business terms, wrote a one-page policy and removed the extensions. It took two afternoons. A month later, a new client's security questionnaire asked about AI use, and she answered it in ten minutes.

Try it

Start your governance plan in your approved AI tool:

Goal: Draft a starter AI governance plan for my organization.
Context: We are a [size] [type of organization]. We hold [types of sensitive data]. AI tools I know we use: [list]. The person who could own AI governance: [role].
Constraints: Cover the seven habits: owner, inventory, one-page policy, risk levels, vendor checks, incident plan, quarterly review. For each, give one first step that takes under two hours. No jargon.
Format: A numbered list with a first step and an owner for each habit.
Done criteria: I could start the first step this week.

Pick the first step you'll actually do this week and put it on your calendar.

Key takeaways

• Small-organization AI governance is seven habits, owned by one person, not a department.
• Missing rules and approved tools cause most data leaks; you own what your AI tells customers.
• ADAPT is the everyday habit; governance makes it consistent across your team.

Sources

• Moffatt v. Air Canada, 2024 BCCRT 149 (CanLII) (opens in a new tab)
• Samsung bans staff's AI use after spotting ChatGPT data leak (Bloomberg) (opens in a new tab)