From free-for-all to control in five simple steps

Your team is experimenting with ChatGPT, Gemini, Copilot or Claude. Excellent for productivity, but a ticking time bomb for your liability. Because be honest: who carries the responsibility when an AI model makes a critical mistake or leaks company secrets?

Most directors stare into the distance at that question. Not out of unwillingness, but simply because nobody has told them where the line is.

Governance is not a dirty word

Terms like ISO 42001, NIST or the EU AI Act are flying around. They sound heavy, bureaucratic and above all: very much "not for now". But for a healthy small or mid-sized company, getting a grip on AI does not have to be complicated at all. Forget the thick reports and expensive lawyers for a moment.

Effective AI risk management starts with the basics. You do not need weighty manuals — you need five practical documents that take less than an hour each to draw up.

The five essential documents

No reports. No consultants. Just do it.

1. Approved tools and data etiquette

Which AI tools are safe, and which data — think customer records or source code — must absolutely never end up in a prompt?

2. Error protocol

What is the procedure the moment an AI output turns out to be wrong? Who picks it up, who communicates externally, and how do you prevent a repeat?

3. The AI inventory

A simple overview of which applications are actually in use inside your walls right now. You can only steer what you know about.

4. Decision mandate

Who is ultimately responsible when an AI system influences a business decision? That has to be on paper, not in everyone's head.

5. Transparent privacy statement

An update to your privacy policy that actually covers the impact of generative AI. Not the standard boilerplate from three years ago.

In almost every small and mid-sized company, technology adoption runs miles ahead of control. That is not an IT problem, it is a gap in your leadership. It is the difference between a director who holds the reins and a director who merely hopes he does.

AI is not an IT project you do on the side. It is a fundamental leadership question.

If you have no clear answer right now to the question of who is responsible, you have just found your first action point.

About the author:

Rick Hermanns is Commercial Director and AI Strategy at ai-werkers. He concentrates on returns and results, with a data-driven, no-nonsense approach.