AI governance framework for small and mid-size businesses: a one-page template
By Hero Published Oct 16, 2026 · Updated Oct 16, 2026
The useful detailsAn AI governance framework is the short set of roles, decisions and review habits that keep AI use under control as tools and staff change. It is not the same as an employee AI use policy: the policy tells staff what they may do day to day; the framework tells leadership who owns AI, how a new tool gets approved, how data classes map to allowed accounts, and when the whole picture is reviewed. This page gives you a one-page framework you can copy: a RACI, a four-step tool-approval flow, a data-class rule table, and a quarterly agenda, with pointers to PIPEDA accountability and Quebec Law 25. It is practical guidance for Canadian teams of roughly 10–200 people. It is not legal advice, a certification, or an ISO 42001 implementation.
Why a framework (not only a policy)
A policy without ownership becomes a PDF nobody updates. A tool list without an approval path becomes shadow AI. The Office of the Privacy Commissioner of Canada's principles for generative AI ask organizations to establish clear internal governance for privacy compliance — defined roles, policies, and practices — and to revisit accountability measures as systems and rules evolve (OPC, Principles for responsible generative AI). NIST's AI Risk Management Framework likewise puts Govern first: culture, roles and processes before Map, Measure and Manage (NIST AI RMF Core).
For a Canadian SMB, "governance" can fit on one page if you answer four questions:
Who is accountable for AI?
How does a new tool get from request to approved (or refused)?
Which data classes may touch which kinds of accounts?
When do we look at the whole picture again?
Pair this page with the AI risk assessment template (register + vendor questionnaire) and the employee policy (staff rules). Hero's consulting work can help you fill the brackets; you can also do it yourself.
Copy into a doc. Replace brackets. Keep it to one page when printed.
[ORGANIZATION] · AI governance framework · Effective: [DATE] · Next review: [DATE + 3 months]
1. Purpose. We use AI to support work under Canadian privacy law and our client contracts. Accountability for decisions rests with people in this organization, not with any AI tool (OPC generative AI principles — Accountability).
2. Roles (RACI). See the RACI table on the accompanying sheet (or below). One named AI Owner ([NAME, ROLE]) is Accountable for the approved-tool list, this framework, and the employee policy. Privacy / compliance contact ([NAME]) is Consulted on personal-information uses. IT / admin ([NAME]) is Responsible for workspace settings and offboarding. Managers are Responsible for how their teams follow the policy. Everyone is Informed when tools or rules change.
3. Tool approval. No new AI tool, browser extension, meeting note-taker or connected app for work without the flow: Request → Check → Approve or refuse → Review. Details below. Emergency exceptions need the AI Owner's written OK the same day and a follow-up within seven days.
4. Data classes. Public / Internal / Confidential / Personal — mapped to allowed account types in the data-class table. Personal information that leaves Canada or goes to a processor needs contractual or other means to protect it (OPC, cross-border guidelines).
5. Decisions about people. Hiring, discipline, pay, credit and similar decisions stay with a named human. If we ever use personal information to make a decision based exclusively on automated processing, Quebec's private-sector Act (Law 25) s. 12.1 requires notice and, on request, the information used, the principal factors, correction rights, and a chance to submit observations to a staff member who can review the decision (LégisQuébec P-39.1 s. 12.1). Even outside Quebec, we do not treat AI output as a final people-decision.
6. Inventory and risk. We keep a living list of AI tools and uses. High-score rows from the risk register must have an owner and a next action with a date.
7. Training. New staff get the employee policy in week one. Role training on the approved tool happens before people use it on real work — see how to train employees to use AI.
8. Incidents. Same-day path: contain (revoke access / delete where possible), tell the AI Owner and privacy contact, document what left, decide whether PIPEDA / provincial breach notice applies. No blame for good-faith early reports.
9. Quarterly review. Agenda below. Minutes go to leadership. Framework owner updates the review date.
RACI: who owns AI
Decision or activity
AI Owner
Privacy contact
IT / admin
Managers
Staff
Approve / refuse new AI tools
A
C
C
I
R (request)
Maintain approved-tool list & settings
A
C
R
I
I
Employee AI policy text
A
C
C
C
I
Risk register for each tool-and-use
A
C
C
R (own rows)
C
Offboard leavers from AI workspaces
C
I
R
C
—
Allow personal data in a tool
C
A
C
C
R (flag)
Client disclosure about AI use
C
C
I
R
I
Quarterly governance review
A
R
R
C
I
R = Responsible (does the work), A = Accountable (one owner), C = Consulted, I = Informed. In a 20-person company the AI Owner and privacy contact may be the same person — write both titles anyway so coverage is clear when you grow.
Short form: tool name, who will use it, which data classes, whether it connects to email/files/calendar, vendor link
Same day
2. Check
AI Owner + IT + privacy as needed
Run the vendor questions that matter (training default, DPA, admin offboarding, data location). Score with the vendor questionnaire. Search connected-app lists for lookalikes (shadow AI guide)
3–10 business days
3. Approve or refuse
AI Owner
Written decision: approved plan/account type, allowed data classes, owner, review date — or refuse with a reason and an approved alternative if one exists
Within the check window
4. Review
AI Owner
Re-check at the review date or sooner if terms, features or use change
Quarterly or on change
Refuse loudly when the tool only offers a personal plan for work data, when there is no way to offboard a leaver, or when the vendor will not answer whether prompts train models. Approving a "temporary" personal ChatGPT login for client work is how shadow AI becomes the real system of record.
Data-class rule table
Data class
Examples
Allowed AI accounts
Notes
Public
Website copy, published prices, press quotes
Approved business or work-signed tools; personal tools OK for public-only drafting
Still check invented facts before publishing
Internal
Non-sensitive process notes, internal agendas
Approved business / work accounts only
Keep out of personal consumer accounts
Confidential
Client proposals, contracts, strategy, financials
Named business workspaces with admin control (e.g. ChatGPT Business, Claude Team, Copilot work sign-in)
Confirm processor terms; see OPC cross-border guidance
Personal
Employee or customer identifying details
Only tools and uses listed on the approved list with privacy contact sign-off
Quebec s. 12.1 if exclusive automated decisions; Ontario job-posting disclosure rules may apply when AI is used in hiring
Passwords, government ID numbers, bank/card numbers and health information stay on the never-enter list in every class — see what information should not go into AI.
Inventory delta (10 min). New tools, retired tools, connected apps found since last quarter.
Risk register (20 min). Every score 6–9: status of next actions. Any personal-data rows without privacy sign-off?
Vendor and settings (15 min). Training defaults, retention, SSO/offboarding tested for one leaver scenario.
Incidents and near-misses (10 min). What was reported; policy lines to clarify.
Training coverage (10 min). Who joined since last quarter without the policy walkthrough?
Decisions (10–15 min). Approve framework edits; set next review date; assign owners.
Send minutes to whoever is accountable for privacy in the business. If most answers are "unclear," run the AI readiness checklist before the next quarter.
Mapped to Canadian rules (plain language)
Topic
What to check
Primary source
Accountability for PI processors
Contracts / other means when personal information goes to a vendor
PIPEDA has no section that mirrors Quebec's s. 12.1 word for word, but the OPC's generative AI principles already expect organizations to give people a way to challenge significant decisions and request human review. Treat Quebec's rule as a high bar worth adopting if you make algorithmic decisions about people anywhere in Canada. This is general information, not legal advice — have counsel review high-risk uses.
Ontario employers should also confirm current ESA rules on publicly advertised job postings when AI assists hiring, and electronic monitoring policies where they apply; those sit beside this framework rather than inside the one-pager.
How this differs from related Hero resources
Resource
Job
This framework
Who owns AI, how tools are approved, data-class rules, quarterly rhythm
Help filling brackets and running the first review
First 30 days: stand the framework up
Week 1: name the AI Owner and privacy contact in writing; paste the one-pager into your wiki. Week 2: run the inventory (or the shadow AI survey if you have none) and open a blank risk register. Week 3: put every known tool through the approval flow — including tools already in use — so "grandfathered" apps get the same Check step. Week 4: walk managers through the RACI and schedule the first quarterly review. Skip certification theatre; a filled one-pager that people can find beats a 40-page binder nobody opens.
FAQ: AI governance framework
Is this an ISO 42001 or NIST certification?
No. It borrows useful ideas from NIST's Govern function and from OPC guidance. Certification against ISO/IEC 42001 is a separate, accredited exercise.
How is this different from an AI policy?
The policy is for employees. The framework is for owners and managers: roles, approval, data classes and review. You need both.
Do we need a lawyer to fill this in?
For routine office use of Copilot or ChatGPT Business on internal drafts, many teams start themselves and ask counsel to review the personal-data and automated-decision lines. High-risk uses (hiring automation, health, children's data, cross-border transfers of sensitive PI) should involve a lawyer early.
How often should we review?
At least quarterly, and whenever you add a tool that touches Confidential or Personal data, or after an incident.
Can Hero help implement this?
Yes — through AI consulting after a Fit Call, usually following or alongside an AI Readiness Assessment. You can also implement the template without Hero.
Sources checked (October 16, 2026): OPC, Principles for responsible, trustworthy and privacy-protective generative AI technologies · OPC, Guidelines for processing personal data across borders · LégisQuébec, P-39.1 s. 12.1 · NIST, AI RMF 1.0 Core.
A CLEAR NEXT STEP STARTS HERE
Not sure where to start?
Bring your checklist answers to a free 30-minute call. We’ll tell you honestly whether training, an AI readiness assessment, or AI security work comes first.