Governance & compliance

Most small and mid-sized businesses start on AI governance the same way. Someone notices staff pasting client material into a chatbot, a policy template gets downloaded, and a document is circulated for signature. The providers who work on this problem largely agree that this sequence gets things backwards. The document describes an organisation that does not exist. The AI already in use keeps running underneath it, and when a regulator, a client or a board asks what the business's AI actually does, nobody can answer.

The more useful framing is that governance is an operational problem that surfaces as a legal one. The obligations are real. The EU AI Act, GDPR, procurement clauses and state law now reach businesses well below enterprise scale. But meeting them depends on things that have little to do with drafting.

AI is a mirror, not a new risk

The most clarifying idea here is that AI rarely creates the exposure a business fears. It reveals exposure that was already there. SNL Tech Services argues that AI exposes existing permission problems rather than causing them. LABUSA makes the same point more mechanically: an AI tool inherits the permissions of whoever runs it. If a junior employee can technically open the board folder, so can the assistant acting on their behalf, and it will find that folder far faster than they would.

This changes where the work starts. For businesses on Microsoft 365, Onset Solutions' position is to fix Microsoft permissions before turning on Copilot. BCN likewise holds that governing Copilot begins with data permissions rather than with the tool. IT Club extends the argument from data to process, warning that AI multiplies bad processes faster than anyone notices. Moniek James goes further still and defers tool selection until decision architecture is set. On this view, an organisation that cannot say who decides what should not be choosing software yet.

For a buyer, the implication is uncomfortable but useful. Some of what gets sold as AI governance is really overdue housekeeping on access and workflow. That housekeeping is worth doing regardless, and no amount of AI policy substitutes for it.

Start from what is actually running

If the policy-first instinct is wrong, the replacement is an inventory. Several providers insist on this order, and they differ on what the inventory must capture. Powehi's emphasis is to inventory the AI employees already use unofficially, not just what IT deployed, because the unofficial layer is where undocumented obligations accumulate. Acuity AI Advisory points to a less obvious gap: the hidden high-risk AI buried inside third-party software, which a business may be responsible for under the AI Act without ever having thought of itself as deploying AI. Utilistech handles the supplier side with a blunt filter: if five vendor questions go unanswered, the tool comes off the list.

LABUSA adds a step many businesses skip. It suggests reading client contracts before writing data rules, because those contracts often already dictate what can and cannot be done with client information.

Where the approaches diverge: tooling or groundwork first

There is a real disagreement about how much a governance platform should carry. Clarity Digital Agency advises businesses to choose governance-built platforms over compliance checklists, on the reasoning that controls embedded in the tooling are more reliable than controls that depend on people following a list. Aligne Technologies takes the opposite starting point: start with an AI inventory, not a governance platform. Its concern is that buying the platform first automates a picture of the business that has not yet been established.

These positions are less contradictory than they appear. They answer different questions about sequence. Still, a buyer should know which one a prospective provider holds, because it determines whether the first months are spent configuring software or mapping reality.

Channel use rather than ban it

On shadow AI, the providers are close to unanimous that prohibition backfires. PwC Ireland's position is that banning GenAI backfires; give staff bounded enterprise tools instead. Swiss Cyber Institute similarly argues for channelling shadow use toward safe alternatives. The details are where the value lies:

• Approve the right unit. SNL Tech Services approves use cases rather than products, since the same tool carries different risk in different workflows. Fornida makes the parallel point to approve license tiers, not just tools, because free tiers of an otherwise acceptable product can leak data.
• Make approval easy. Clear Gate Systems routes each tool request through two questions rather than defaulting to blanket refusals.
• Make reporting safe. Clear Gate Systems also has the policy state explicitly that an honest same-day report is treated differently from a deliberate breach. People hide mistakes they expect to be punished for.

Channelling does not mean leaving the door open. Be Structured's contribution is to block unapproved AI platforms at the network layer, not just on paper. That enforcement is what gives the sanctioned alternative its pull.

Narrow design is a compliance strategy

For businesses building AI rather than just using it, a recurring idea is that scope limits risk. Launchzy treats keeping the assistant deliberately narrow as a compliance strategy for customer-facing voice agents, not a limitation. Keystone Intelligence Group builds human review in by default and runs a transcribe, act, delete pattern for audio, so recordings are never retained and never become a liability. For autonomous agents, Iternal's rule is to give every agent a deterministic checkpoint and an explicit kill criterion.

Proof is the product

The final test is evidence. AI Applied offers a sharp diagnostic: if producing your audit trail takes a project, you do not have one. The providers differ in how they make evidence continuous:

• Vrinsoft has compliance checks re-run automatically on every model retrain.
• Consltek runs AI governance on the same cadence as security and uptime reviews.
• ADVISORI folds AI governance into the existing ISMS rather than standing up a parallel regime.

For boards, TAGC Assurance holds to a principle buyers should apply more widely: it never assesses a governance program it helped build.

Proportion and sequence

Finally, the providers who work with smaller firms push against over-engineering. Alchemy Consulting cautions that the standards supply structure but not the controls themselves, and advises treating ISO 42001 as a destination rather than day one. Ops Intel sequences remediation by legal exposure, not gap order. CAG Compliance Ltd simplifies multi-jurisdiction work by complying once against the strictest applicable rule. Octavius AI's advice about timing may be the most practical of all: set governance rules across two automations before you have fifteen.

Taken together, these approaches suggest what good looks like. It starts from an honest inventory, fixes the access and process problems AI will otherwise amplify, gives staff a sanctioned path that is easier than the shadow one, keeps what gets built narrow, and produces its own evidence as a matter of routine. A policy document should come at the end of that work, describing an organisation that actually exists.