AI Governance Assessment for Small Businesses

An AI governance assessment is a structured review of how your business uses AI: which tools staff use, what data goes in, who owns each one, what your policy says and what insurers will ask. You get a finished AI policy, an AI tools register, a gap list and a 90-day plan aligned to NIST AI RMF and ISO/IEC 42001.

KEY TAKEAWAYS – Governance is about rules, owners and records, not just security settings. – You leave with documents you can hand to an insurer, a client or your team. – Scope and timing are agreed on the free call, before any work starts. – It’s aligned to NIST AI RMF and ISO/IEC 42001, written for teams without a compliance department.

What does an AI governance assessment cover?

It covers six areas. First, every AI tool in use, including shadow AI. Second, the data each tool can see. Third, who owns each tool and decision. Fourth, your AI policy and staff training. Fifth, vendors, AI agents and connectors. Sixth, how you’d answer insurer and client AI questions, and how you’d handle an AI incident.

Area	What we look at	What you get
AI inventory	Every AI tool, account type and AI feature inside other software, including personal accounts used for work	A complete AI tools register with an owner per tool
Data	What each tool can read, store or train on; client, personal and payment data exposure	A data-level rule per tool
Ownership	Who signs off new tools, who checks output, who staff ask	A named AI owner and a simple sign-off path
Policy and training	Your current policy (or none), acknowledgements, training	A finished AI acceptable use policy and one-page staff guide
Vendors and agents	AI inside vendor products, agents and connectors that can act on their own	Vendor questions and agent permission rules
Insurer, client and incident readiness	AI questions on insurance applications and client questionnaires; what happens after an AI mistake	Draft answers with evidence, and an AI incident step in your response plan

How is it different from an AI security assessment?

An AI security assessment tests one AI tool or agent’s technical controls: access, credentials, data flows, logging and the kill switch. An AI governance assessment looks at your whole AI program: which tools are allowed, who owns them, what the policy says and what you can prove to insurers. Many businesses do governance first, then test their riskiest tool.

Need the technical test? See our AI security assessment. Want to do a first pass yourself? Start with the free AI risk assessment template. New to the topic? Read AI governance for small business.

What do you get at the end?

You get documents, not just a slide deck: a completed AI tools register, a finished AI acceptable use policy and staff guide, a prioritized gap list, draft answers to common insurer and client AI questions with the evidence for each one, and a 90-day plan that names an owner and a date for every fix. You keep all of it.

WHAT YOU GET 1. AI tools register (every tool, account, data level, owner) 2. AI acceptable use policy + one-page staff guide, customized 3. Gap list, ranked by risk and effort 4. Insurer and client AI answer sheet, with evidence 5. 90-day plan with owners and dates 6. A walkthrough call to go through it all together

Who is the AI governance assessment for?

It’s for small and mid-sized businesses whose staff already use ChatGPT, Microsoft Copilot or AI features in everyday software, and who now face questions from an insurer, a client, a board or their own team. It suits firms without a compliance department, such as professional services, healthcare offices, nonprofits and growing startups.

Signs you’re ready: – An insurance renewal or client security questionnaire asked about AI. – You don’t know every AI tool your team uses. – You’re turning on Microsoft 365 Copilot or an AI agent. – You have a policy, but nobody’s sure it’s followed.

How does the AI governance assessment work?

It runs in four steps. A free 30-minute call to agree scope and timing. A short discovery: interviews with a few people plus a read-only review of your tools and settings. A written findings package. A walkthrough call on the gaps and the 90-day plan. Scope and timing are confirmed in writing before any work starts.

1. Free 30-min call: your goals, tools and deadlines (for example, an insurance renewal).
2. Discovery: short interviews and a read-only look at accounts and settings. No changes to your systems.
3. Findings package: register, policy, gap list, answer sheet, 90-day plan.
4. Walkthrough: we go through it together and agree the first fixes.

Prefer to start on your own? Get the free AI acceptable use policy template kit, run a 1-hour shadow AI discovery, or ask Sophia, our free AI advisor.

Frequently asked questions

Is the AI governance assessment a formal ISO audit?

No. It’s a practical review aligned to NIST AI RMF and ISO/IEC 42001, written for small businesses. It shows where you stand and what to fix. It isn’t a formal ISO audit and doesn’t replace legal advice.

How long does an AI governance assessment take?

It depends on your size and how many tools you use. We agree the timing on the free call and confirm it in writing before we start.

Do you need admin access to our systems?

Usually only read-only access to look at settings, or a screen-share with your admin. We don’t change your systems during the assessment.

What if we already have an AI policy?

Good. We check it against how people actually use AI, fill the gaps and update it, rather than starting over.

Can it help with our cyber insurance renewal?

Yes. We prepare draft answers to common AI questions on insurance applications, with the evidence for each one, so you and your broker can review them before you submit.

JR Secure Design is led by founder James DeCrescenzo, with 25+ years of building systems that can’t go down.

Prefer email? Write to sales@jrsdi.com, or send us a message.