AI Governance for SMEs: Start With These 5 Things

Plants.work · 2026-10-26 · industry-insights

Set practical AI rules for a small company without a big committee: five steps you can start now, based on NIST and ETDA guidance.

Picture a 40-person company. Sales uses ChatGPT to draft quotations, accounting asks AI to summarise financial statements, and HR feeds candidate resumes into an AI tool to help with screening. Everyone means well and the work really is faster. But nobody has the full picture: which AI tools the company uses, what data is leaving the building, and who is accountable when the AI gets something wrong. Many SMEs are in exactly this position, which is why AI governance is no longer only a big-company topic.

What is AI governance?

AI governance is the set of rules, roles and processes that lets an organisation use AI in a way that is useful, safe and auditable. Put simply, it means being able to answer: what do we use AI for, what data goes in, who approves it, who checks it, and how do we fix things when they go wrong.

You do not have to start from scratch. Free reference frameworks already exist. The US NIST AI Risk Management Framework (AI RMF 1.0), published in January 2023, is voluntary guidance organised into four functions: Govern, Map, Measure and Manage. In Thailand, ETDA, through its AI Governance Center (AIGC), published the AI Governance Guideline for Executive (2023), and the Ministry of Digital Economy and Society together with ETDA issued guidelines on applying generative AI with good governance for organisations in 2024. These are guidelines, not binding law, but they save you from inventing every rule yourself.

Step 1: Build an AI inventory

NIST AI RMF says in GOVERN 1.6 that organisations should have mechanisms to inventory their AI systems. For an SME, a single spreadsheet is enough:

The AI tool or system, and who uses it
What it is used for, and whether the output reaches customers
What type of data is put into it
Whether it runs on a personal or a company account

Many companies discover their staff use far more AI than expected. Knowing the reality comes before writing rules.

Step 2: Classify your data clearly

The most practical rule is telling people which data may go into AI and which may not.

An example with three levels

Allowed: public information, marketing content that is already published
Allowed only in company-approved tools: internal documents, sales figures
Not allowed: personal data of customers and employees, sensitive data, passwords, confidential contracts

Personal data always needs to be considered alongside Thailand's Personal Data Protection Act (PDPA). Read more in PDPA and employee data.

Step 3: Assign owners and accountability

AI is not accountable for the work; people are. Every use case should have an owner who can explain why it is used, how it is used and how results are measured. An SME does not need a large committee. One AI coordinator plus one executive who decides on high-risk matters is enough to begin with.

Step 4: Keep a human in the loop for high-impact work

Work whose output reaches customers, affects money or affects people, such as candidate screening, should always have a human in the loop who reviews and approves before it is used. AI can be confidently wrong and can carry hidden bias. See the HR perspective in Using AI responsibly in HR.

Step 5: Review regularly and make it easy to report problems

AI tools change fast, and rules written today can be outdated within months. Set a quarterly review, and give staff a channel to report wrong answers or data leaks immediately, without blame. A hidden problem is more dangerous than a reported one.

Good governance is not there to stop people using AI. It is there so everyone can use AI with confidence.

Watch out for

Rules so long that nobody reads them. Start with one or two pages everyone understands.
Banning AI completely. People tend to use it anyway on personal accounts, which is riskier.
Treating frameworks as law. NIST and ETDA guidance are voluntary. For legal matters such as the PDPA, consult a legal professional.

How to get started

This week, send a short survey asking your team which AI tools they use and for what.
Build your AI inventory from the answers.
Write the three-level data rules and share them with everyone.
Appoint an AI coordinator and define which tasks need human review.
Schedule your first review three months from now.

If you want help assessing readiness and setting up governance systematically, SCALE runs AI Readiness Diagnostic and AI Governance workshops for organisations; see scale.co.th. And if your team wants to build AI skills alongside the new rules, start learning at Plants.work Learn.