How do you implement AI governance in a small business?

The three-step SME AI governance starting point

For a small or medium Irish business, AI governance starts with three practical steps. Step one: build an AI inventory. This means listing every AI tool the business uses; ChatGPT, Copilot, AI features in accounting or CRM software, AI-powered customer service tools, anything. The inventory should capture what each tool does, what data it processes, who uses it, and whether the vendor has provided adequate terms around data use. Most SMEs are surprised by how many AI tools they are already using when they do this exercise properly. Step two: write an AI use policy. For an SME, this does not need to be complex; a clear, readable document that tells employees what AI use is permitted, what data can and cannot go into AI tools, and what verification is required before acting on AI outputs. Step three: check for EU AI Act high-risk exposure. If a use falls within the statutory high-risk definition, assess the additional role-specific duties and their application dates, including any relevant SME provisions.

EU AI Act obligations for small businesses

Small size does not automatically remove AI Act duties, although the legislation includes proportionate measures and support. Assess the specific use and legal role. An inventory and a policy are practical ways to organise that work, not a universal statutory document checklist for every low-risk business. You can often extend existing security, data-protection and management processes. Review the guidance when a new feature or use changes the risk, and give staff a workable route to ask about a tool before using sensitive information.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.