Proportionality: governance that fits your size

A common failure mode when firms first take AI governance seriously is copying what a large enterprise does: an AI ethics committee, a lengthy framework document, a multi-stage approval workflow. For a small or mid-sized firm this is almost always the wrong answer. It consumes effort nobody has, and because it's unusable, it gets ignored, which leaves you worse off than a modest policy people actually follow.

Match the effort to the risk and the headcount

A five-person professional services firm probably needs:

• A one-page acceptable use policy: which tools are approved, what data must never go in, when a human must review output.
• One named person who owns AI decisions and can answer "can I use this?" quickly.
• A short conversation at team meetings a few times a year to keep it live.

A 200-person firm with regulated work will need more: a proper tool approval process, DPIAs for uses involving personal data, structured training, and documented review. The principle is the same at both ends: the governance should be the minimum that gives you genuine visibility and control, and no more.

Signals you've got the balance wrong

Too light: you can't name the tools in use, you've never turned a use case down, and nobody has asked a question about the policy in months because nobody has read it.

Too heavy: approval takes weeks, staff have stopped asking, and shadow AI is growing while the official process sits idle.

Start small and iterate

A one-page policy issued this month beats a comprehensive framework issued next year. You will learn more from three months of governed real-world use than from any amount of upfront drafting, and the policy is a living document you'll revise anyway, as the final section of this course covers.