The SMB AI Data Governance Checklist
Twenty checks that keep AI useful without an enterprise budget
⚠
This is a light self-assessment, not a full AI assessment. A short questionnaire cannot see your contracts, your data flows, your vendor terms, or the systems you actually run on, and it only knows what you tell it. Treat the score as an indicator of roughly where you stand and what to look at next. It is not an audit, not a finding, and not something to hand to an insurer, a client, or a regulator as evidence.
🔒
Your answers stay on this page. Scoring happens in your browser and answers are saved only on your own device. Nothing reaches us unless you ask for the 15-minute review at the bottom, which sends your score along so the conversation can start somewhere useful.
A. Know your data (what is allowed to touch AI at all)
1*
We have a written bright line: the categories of data that never go into a public AI tool (client names, financials, anything under NDA, employee and health records).
2
Everyone on the team can recite that line from memory. One sentence, not a matrix.
3
Somebody has actually looked at what the team pastes into AI tools today, without turning it into a witch hunt. You are mapping reality, not assigning blame.
4
Client contracts have been checked for confidentiality language that restricts third-party processing. If a client asked "does our data touch AI tools?", you could answer in writing.
B. Vet the tools (before they are connected, not after)
5*
Every AI tool in use is on the business tier, where the vendor commits contractually not to train on your data. Free consumer tiers are for nothing confidential, ever.
6
For each tool, you know the four answers: Does it train on our data? How long is retention? Where is the data stored? Can we delete it on exit?
7
Tools that connect to your systems (email, CRM, files) got a harder look than tools you only paste into. Connection means the tool can see everything, not just what you give it.
8
Someone owns the list of approved tools, and adding a tool has a path that is easier than sneaking one in.
9
Vendor AI features that switched on inside software you already own (CRM, accounting, meeting tools) have been reviewed like new tools, because that is what they are.
C. Control access (people change, keys should too)
10*
AI accounts are company accounts under central admin, not personal accounts with a work email.
11
When someone leaves, their AI access dies the same hour as their email. It is on the offboarding list, in writing.
12
API keys for any AI wired into your systems are stored properly, rotated on staff changes, and not sitting in a shared doc.
13
An AI assistant or agent connected to your systems has its own account with the least access that works, so you can see what it did and turn it off alone.
D. Retention and exit (assume you will leave every tool eventually)
14
You know each vendor's retention period and, where offered, have set history retention to the shortest setting that still works for you.
15*
Chat histories containing business data are treated as business records: you know they exist and roughly what lives in them.
16
You have confirmed you can export or delete your data on the way out, before you are on the way out.
17
If a regulator, insurer, or client audit asked "where does your data go?", AI tools would appear on that map rather than being the awkward omission.
E. When it goes wrong (small plans beat no plans)
18*
Everyone knows the first move if confidential data goes into the wrong tool: tell the owner immediately. No blame for reporting, ever. The cover-up is the incident.
19
The owner knows the vendor-side moves: delete the conversation, disable history, use the vendor's data deletion request, document what happened and when.
20
AI mishaps land in the same incident log as everything else, so patterns show up before they become habits.
Yes answers:0 / 20
Want to walk through your results with someone? Fifteen minutes.
We will save your score to your contact record and hand you our calendar on the next screen. The call is a review of what you just scored: what the number means for a business your size, and what the next three moves are. If the honest answer is that you can do those yourself, that is what you will hear.