Proportionate AI governance: enough to be safe, light enough to use

Governance nobody follows is worse than none, because it creates false comfort. Here's how a growing business can match its AI governance to its real risks.

Edge AI Partners · 8 September 2026 · 4 min read

The biggest governance risk in a small business isn't having too little. It's having a document that looks complete, sits in a shared drive and changes nothing about how people work. It gives leaders comfort they haven't earned, and it fails at the first real test.

Proportionate governance fixes that. It means the effort you put into overseeing an AI use matches what could go wrong with it. Not every use needs the same treatment, and pretending otherwise is how good intentions turn into shelfware.

Three tests for whether your governance is proportionate

Does each rule have an owner? If nobody is accountable for a control, it isn't one. One named person per AI use is enough to start.

Could a new starter follow it in ten minutes? If your AI policy needs a training session to understand, most people won't read it. Two clear pages beat twenty thorough ones.

Does it change when the use changes? A tool approved for internal drafting isn't automatically approved for customer emails. Good governance notices the difference.

Match the effort to the risk

A simple three-level approach works for most growing businesses:

• Low risk: internal drafting, summarising your own meeting notes, brainstorming. Basic rules on what data can go in, and that's about it.
• Medium risk: anything a customer sees, or anything using client or personal data. Add a human review step, an approved tool list and a named owner.
• High risk: anything that informs a decision about a person (hiring, credit, access to a service), or that affects health, safety or money. Add a written risk assessment, sign-off before use, and a clear way for someone to challenge the outcome.

Most of your AI use will probably sit in the first two levels. That's the point. You spend your effort where it matters and keep the rest light.

A starting kit for a growing business

You don't need a governance team to get this right. Four things will carry most businesses through their first year of serious AI use:

• An AI use register. A spreadsheet is fine. Tool, team, purpose, data involved, risk level, owner.
• A two-page acceptable-use policy. What's allowed, what isn't, and who to ask.
• One accountable lead. Usually a director or senior manager, with the authority to say no.
• A review rhythm. A short check every quarter, plus the triggers below.

That's it. It won't satisfy every auditor on day one, and it isn't meant to. It gives you an accurate picture of where AI is being used and a way to act on what you find. Everything more formal can be built on top of it when the business needs it.

Keeping pace without rewriting everything

AI tools change monthly. Your governance doesn't need to. What it needs is clear triggers for a review:

• a new tool, or a new use for an existing one
• new types of data going in
• a supplier changing its terms or how it handles your data
• a mistake, complaint or near miss

Put those triggers in writing and you have governance that moves with the business instead of lagging a year behind it. In The Edge AI Governance Cycle™ this is the Monitor and Improve stages: watching how AI use actually develops, then adjusting controls to fit.

What proportionate doesn't mean

It doesn't mean optional. Some things don't scale down: data protection law applies to a five-person firm as much as a large one, and if you're a provider or deployer of AI in the EU, the AI Act's AI literacy duty in Article 4 already applies. Proportionate governance is about how you meet expectations, not whether you do.

It doesn't mean static either. A light approach that worked at 15 people may not work at 60. Revisit it as you grow.

The aim is governance people use without being chased. If your team can tell you, without looking anything up, which AI tools they're allowed to use and when to ask for help, you're most of the way there.

What this means for

• AI startups selling to enterprise: EU AI Act Article 4 (in force, as amended in 2026) applies if you provide AI systems in the EU market. Expect buyers to ask how you support AI literacy among your staff, and keep a record of what you do.
• Startups implementing AI governance: If you deploy AI and operate in the EU, Article 4 (in force, as amended) applies; in the UK, data protection law applies to AI use whatever your size. A short policy, an approved tool list and named owners are a proportionate start.
• SMEs implementing AI governance: UK data protection law applies to your AI use now; the ICO's AI guidance is under review following the Data (Use and Access) Act 2025. If you deploy AI in the EU, Article 4 also applies. Focus effort on customer-facing and people-related uses first.

This is general information, not legal advice.

Sources

Back to Insights