AI governance for SMEs starts with understanding how the business uses AI, then applying proportionate controls to the risks that matter under the EU AI Act and GDPR.
Artificial intelligence is already present in many everyday business tools, from meeting-note software and customer-service systems to recruitment platforms and generative AI assistants. For small and medium-sized enterprises (SMEs), the first governance question is often not whether to adopt AI, but where it is already being used and what information or decisions it affects. A workable approach starts with visibility, assigns responsibility and uses existing privacy and supplier-review processes rather than creating enterprise-scale bureaucracy.
SMEs need governance that fits their actual AI use.
The EU AI Act applies a risk-based approach rather than treating every AI use in the same way. An SME using a commercial tool will often be a deployer, while a business that develops, substantially modifies or markets an AI system may face provider obligations. Size matters to proportionality, but it does not remove duties that apply to a particular role or use case.
The 2026 AI Omnibus simplified parts of the AI Act’s implementation and extended some measures previously available to SMEs to small mid-cap companies. Smaller organisations should therefore check the obligations relevant to their systems rather than assuming either that every use requires the same paperwork or that a simplified regime is a general exemption.
An AI inventory gives businesses a reliable starting point.
SMEs should identify the AI systems used across the organisation, who uses them and for what purpose. The inventory should include AI features embedded in existing productivity, recruitment and customer-service software, not only tools labelled as standalone AI products. It should record the provider, the information entered or generated, whether personal data is involved and any effect on customers, employees or other individuals.
This exercise can reveal “shadow AI”: tools staff adopted without approval. A worker might paste a customer complaint into a public chatbot or upload an internal document for summarisation. Even without formal procurement, that use can create confidentiality, data protection, security and accuracy risks. Staff need an accessible way to disclose such use without making the inventory a punitive exercise.
Each use case needs a role and risk assessment.
Once AI use has been mapped, organisations should consider their role under the AI Act, the intended purpose of each system and the potential impact on individuals. Drafting an internal email has a different risk profile from screening applicants, evaluating workers or making customer-facing decisions. The assessment should distinguish a tool’s capabilities from the way the business actually uses it.
Certain prohibited practices are already restricted, and Article 50 transparency obligations have applied since 2 August 2026 to specified interactive and generative AI uses. Following the AI Omnibus, requirements for high-risk systems in Annex III are scheduled to apply from 2 December 2027, while relevant rules for high-risk AI integrated into Annex I products are scheduled for 2 August 2028. These later dates should not delay attention to obligations that already apply, including the GDPR.
A short internal policy can turn assessments into everyday rules.
The AI Act does not generally require every SME to produce a document called an “AI policy”. Nevertheless, a concise policy can make responsibilities understandable to staff. It should identify approved tools, uses that require prior review and categories of information that must not be entered into third-party systems without appropriate safeguards.
It should also set expectations for human review, checking factual accuracy, recording significant decisions, informing people where required and reporting unexpected outputs or incidents. In a small organisation, these controls may be owned by existing managers rather than a new governance department, provided there is a clear route for involving data protection, security and technical expertise when risk increases.
Existing GDPR processes should cover AI that uses personal data.
Where an AI system processes personal data, the organisation must still assess lawful basis, transparency, data minimisation, security, retention, individuals’ rights and international transfers. Supplier review should establish the provider’s role, the extent to which submitted data is retained or reused and whether subprocessors or remote access change the data flow.
A data protection impact assessment (DPIA) may be required where processing is likely to result in a high risk to individuals. SMEs can incorporate AI questions into existing procurement, DPIA, incident-response and technology-approval processes, rather than maintaining two disconnected governance structures. This also helps the DPO or privacy lead examine AI early enough to influence design and procurement choices.
AI literacy should reflect the tools employees actually use.
Article 4 of the AI Act requires providers and deployers to take measures supporting AI literacy among staff and others using AI systems on their behalf, taking account of their knowledge, experience and the context of use. The 2026 amendment clarified that organisations are not required to guarantee a prescribed level of literacy for every individual, while the Commission and Member States are expected to support smaller businesses.
For an SME, practical instruction is more useful than a generic awareness session. Staff should understand when outputs need verification, how to recognise unsupported or biased results, what data may be entered into a tool and when a use case should be escalated. Training should be refreshed when tools or responsibilities change.
Governance should develop as the business introduces new AI uses.
AI governance is not a one-off exercise. Providers add features, employees find new uses and a tool initially used for administrative support may later be introduced into recruitment or decisions affecting customers. A review cycle should update the inventory, reassess higher-risk uses, test whether controls remain effective and address incidents or complaints.
The aim is a system proportionate to the organisation’s size, resources and actual AI use. Clear ownership, a reliable inventory and targeted review allow smaller businesses to benefit from AI without letting adoption move faster than accountability.
Discover how Aphaia helps organisations establish proportionate AI governance.
Aphaia helps businesses assess AI use, navigate the EU AI Act and GDPR, and build practical governance measures that fit their operations. Through AI inventories, risk assessments, DPIAs, supplier reviews and staff guidance, Aphaia supports responsible adoption without unnecessary complexity.
