Clear rules for AI, before an accident writes them for you

The realistic small-business AI risk

The common failure is not a rogue model. It is a well-intentioned employee pasting a customer contract, a payroll spreadsheet, or a patient message into a consumer AI tool to save fifteen minutes. Once it leaves your systems, you cannot pull it back, and you may not be able to answer a customer who asks where their data went.

What good AI governance looks like at this size

• An approved tool list. Short, specific, and owned by one person.
• Prohibited inputs. Customer personal data, payment details, employee and health records, credentials, and confidential contract material.
• Human accountability. AI output is a draft; the person using it owns the result. AI must not be the sole basis for hiring, termination, credit, pricing, safety, legal, or medical decisions.
• Disclosure rules. Customer-facing content is reviewed by a person. Recording and transcription bots require participant consent.
• Account hygiene. Company email, individual logins, MFA, and training-on-your-data disabled where the setting exists.
• An inventory. Including AI features inside software you already pay for, which is where most unmanaged AI actually lives.

What ComplianceAnvil generates for you

A personalized AI Acceptable Use and Governance Policy naming the tools you reported, an AI Tool Inventory to maintain, and a safe-AI-use training module for your team. Policies are generated from controlled templates — AI helps personalize wording, it never invents obligations.

What we will not tell you

We will not tell you that a policy makes you compliant with any specific AI law. AI regulation is moving quickly and varies by jurisdiction and sector. Where your situation implicates specific regulation, we flag it for qualified professional review.