AI app governance means knowing which AI-built tools your company has, who can build and use them, what data goes into them, and who is accountable when something changes or breaks. A company without an IT department can cover it with five things: a one-page policy, simple rules for which data goes where, defined roles, a register of every app with a named owner, and a one-hour quarterly review. Choosing a platform that enforces roles and keeps a complete record does most of the work for you.
Large companies have IT departments, security teams and procurement processes to decide which software gets used and how. A 15-person contractor, a 40-person clinic or a 25-person nonprofit has an owner, an office manager and a lot of work to get done. When that team starts building its own tools with AI, the question of who keeps it safe lands on people who already have full-time jobs.
The good news is that governance for a small company does not need to look like governance at a bank. It needs to answer a few questions clearly and keep the answers true over time. This guide gives you a complete, plain-English kit to do that: what governance means, a one-page policy you can adapt, simple data rules, roles, an app register, a quarterly review, and the platform features that do most of the work for you.
Why this matters now
Building with AI is no longer an experiment for small businesses. Pax8's October 2026 survey of leaders at AI-engaged businesses with 5 to 499 employees found that 67 percent have built one or more AI solutions now in regular use, and 35 percent discovered shadow AI, meaning AI used without approval, in the past six months alone. PagerDuty's 2026 survey found that two-thirds of office professionals who use AI at work had used AI tools they believed were not permitted.
At the same time, the old answer of "ask IT" was never fast. In MuleSoft's 2022 Connectivity Benchmark, only 37 percent of IT leaders said they completed every project asked of them the year before. If larger companies with full IT teams cannot keep up, a small company without one needs a lighter approach that still keeps data safe.
And the risk is concrete. An August 2026 scan by reeve.page of 18,554 apps built with Lovable found that 57 percent of the 3,553 databases it could check had tables readable without logging in. Apps built quickly, without rules, are where data leaks.
What governance actually means
Strip away the jargon and AI app governance is four questions the owner should be able to answer at any time:
- What tools do we have? Every AI-built app, in one list.
- Who can build and who can use each one? Names and roles, kept current.
- What data is in them? Customer, employee, financial or none.
- Who is responsible for each? A named person for each tool, and a clear owner of the rules.
Everything below exists to keep those four answers true as your team grows and changes.
The five-part governance kit
1. A one-page policy
You do not need a binder. You need one page that every employee reads once and every new hire reads on day one. Here is a template to adapt:
- Approved platform. "We build internal tools on [platform]. Do not build work tools on personal accounts or other AI builders."
- Who builds. "People with a builder seat may create and change tools. Anyone can request a tool from a builder or their manager."
- Data rules. "Follow the green, yellow, red data rules below. When in doubt, ask [admin name]."
- Access. "Access to tools is by invite from [admin name]. Do not share tool links outside the company."
- Leaving. "When someone leaves, [admin name] removes their access on their last day. Their tools stay with the company."
- Problems. "If a tool shows data it should not, stops working, or behaves strangely, tell [admin name] immediately. Nobody gets in trouble for reporting."
- Review. "These rules are reviewed every quarter by [owner name]."
2. Simple data rules
Most people do not need a data classification scheme. They need three colors.
| Color | What it covers | Examples | Rule |
|---|---|---|---|
| Green | Information that would cause no harm if seen outside the company | Public price lists, published hours, general how-to notes | Fine in any approved tool |
| Yellow | Internal business information | Schedules, job notes, inventory, vendor lists, internal costs | Approved platform only, access limited to the team that needs it |
| Red | Sensitive personal or regulated information | Customer payment details, health information, employee pay and ID numbers, passwords | Approved platform only, smallest possible group, and check with your compliance advisor before building |
The red category matters most. If your work touches health records or payment cards, read our guide to compliance for AI-built apps and talk to your advisor before any of that data goes into a new tool.
3. Defined roles
Roles decide who can do what. Four are enough for almost every small company.
| Role | Who usually holds it | What they can do |
|---|---|---|
| Owner | The business owner or general manager | Everything, including billing and who holds which role |
| Admin | Office manager or operations lead | Invite and remove people, assign roles, see the activity record |
| Builder | The people who create and change tools | Build new tools and request changes to existing ones |
| App user | Everyone else | Use the tools they are given, without changing them |
The principle is called least access: everyone gets exactly the access their job needs and no more. Our guide to role-based access for employee-built apps explains it in more depth.
4. An app register
An app register is a list of every tool, kept in one place. For each tool, record:
- Name and purpose. One sentence on what it does.
- Business owner. The person whose team relies on it and who decides on changes.
- Builder. Who created it and who maintains it.
- Data color. Green, yellow or red.
- Who uses it. A team, a role or a list of names.
- Status. In use, being tested, or retired.
On a platform that keeps every app inside your company with a full record, most of this list exists already. You only add the business owner and data color.
5. A one-hour quarterly review
Put it on the calendar now. Every quarter, the owner and admin run through this checklist:
- Compare the people list to payroll. Anyone who left should have no access.
- Walk the app register. Is every tool still used? Retire the ones that are not.
- Check the red tools. Confirm only the smallest necessary group can reach them.
- Look at the activity record. Scan for changes nobody expected or new tools nobody mentioned.
- Ask team leads about shadow tools. "Is anyone using a tool that is not on our list?" Our guide to shadow AI has a full discovery routine.
- Review spending. Compare the quarter's AI spending to the budget.
- Test one tool. Pick one important tool and run the pre-launch test checklist on it again.
- Update the policy. Change anything that did not work, and re-share it.
Who is accountable for what
When something goes wrong, small teams lose time arguing about whose job it was. Settle it in advance.
| Situation | Who acts | Who decides |
|---|---|---|
| A new tool is needed | Builder | Business owner of that work |
| A tool shows data it should not | Admin restricts access immediately | Owner, with legal or compliance advice if customer data was involved |
| Someone leaves | Admin removes access on the last day | Owner confirms who takes over their tools |
| A tool stops working | Builder | Business owner decides priority |
| Spending is running high | Admin | Owner |
Our guide to who is responsible when employee-built software breaks goes through this in detail.
Governance features to require from your platform
Policies are only as strong as the system that enforces them. A small company cannot police rules by hand, so pick a platform that does it automatically. Require:
- Every app inside your company. Requests from outside the company get nothing back.
- Invite-only joining. No public sign-up, and invites that work once.
- Roles enforced by the platform. App users cannot change tools. Only owners and admins assign roles.
- One-step removal. Removing a person ends their access immediately, and their tools stay with the company.
- A complete record. Every build and every change, with who or what did it.
- Security checks built in. Every piece checked before it is saved, so safety does not depend on each builder.
- Spending controls. Caps you set, alerts before you hit them, and nothing that bills by itself.
Keep people in the loop
Governance is not only about blocking mistakes. It is also about making sure a person stays responsible for what AI produces. Microsoft's 2026 Work Trend Index found that 86 percent of AI users treat AI output as a starting point. That instinct is healthy. Build it into your process: every new tool has a business owner who tries it with real work before the team relies on it, and every important change gets a quick look from that same person.
A 30-day plan to get governance in place
If you are starting from nothing, this is a realistic order for a small company. It assumes one owner and one admin, each spending a few hours across the month.
- Week 1: find what exists. Run the shadow AI discovery steps, list every tool your team uses or built, and mark each one green, yellow or red.
- Week 1: choose the platform. Pick one approved platform using the requirements above, and name your admin.
- Week 2: write and share the policy. Adapt the one-page template, then walk the team through it in a short meeting rather than sending it by email alone.
- Week 2: assign roles. Decide who holds builder seats. Start with the people who already showed they will build.
- Week 3: move the red tools first. Rebuild any tool holding sensitive data on the approved platform, test it, and retire the old version.
- Week 4: start the register and book the review. Record a business owner and data color for every tool, and put the first quarterly review on the calendar.
After the first month, governance mostly runs itself: new tools are built on the approved platform, the record fills in automatically, and the quarterly hour keeps everything current.
Common mistakes to avoid
- Writing a policy nobody reads. One page, shared in person, beats ten pages in a shared drive.
- Banning AI outright. It pushes building out of sight instead of stopping it.
- Letting tools live on personal accounts. When the person leaves, the tool and its data go with them.
- Giving everyone builder access. Most people need to use tools, not change them.
- Skipping the quarterly review. Access drifts. People leave and links stay live.
- Charging teams to add users. If adding a coworker costs money, people share logins instead.
How FORGE handles it
FORGE was built so a small company gets strong governance without hiring anyone to run it. The platform enforces the rules your policy describes.
- Every app lives inside your company. Anyone outside gets nothing back, not even a hint the app exists.
- Only the people you invite. Your admin invites each person by email, each invite works once and expires on its own, and there is no public sign-up.
- Four roles, enforced. Owners, admins, builders and app users each see and do exactly what their role allows. Owners and admins decide who holds a seat.
- People leave, tools stay. Removing someone ends their access immediately, and every tool they built stays with your company.
- A complete record. Every step of every build is recorded with who or what did it.
- Security checked before it exists. Every piece of every app is checked for quality and security before it is ever saved, no matter who asked for it.
- Spending you control. $49 a seat a month for each person who builds, with 3 builds included. App users are free. Admins can cap pack use, owners get alerts at 80 and 100 percent, and nothing ever bills by itself.
Onboarding is done by our team and starts with a workflow workshop, which includes a walkthrough for whoever looks after technology in your company, on your real work. Talk to us to set one up.
Questions people ask
What does AI app governance mean for a small company?
It means the owner can answer four questions at any time: which AI-built tools do we have, who can build and use each one, what data is in them, and who is responsible for each. Everything else in governance exists to keep those answers true.
Do we need an IT department to govern AI-built apps?
No. Most of the work is deciding a few rules once and choosing a platform that enforces them. A small company can run governance with an owner, one admin and an hour a quarter.
Who should own AI governance in a small business?
Usually the owner or general manager sets the rules and an operations or office lead acts as admin day to day. Each app also needs a named business owner, the person whose team relies on it.
What should an AI use policy include?
Which platform is approved for building, which kinds of data may and may not go into AI tools, who may build, how people get and lose access, how to report a problem, and how often the rules are reviewed. One page is enough.
How often should we review our AI-built apps?
Quarterly works for most small companies. Review the app register, remove people who left, retire tools nobody uses, check spending against the budget, and look at the activity record for anything unexpected.
What is an app register?
An app register is a simple list of every tool your team has built or uses, with its purpose, its business owner, the data it holds and who can use it. It can live in a single page or a spreadsheet.
How does FORGE help with governance?
FORGE enforces the hard parts for you. Every app lives inside your company, people join only by invite, owners and admins decide who builds, each role sees exactly what it should, every step is recorded with who or what did it, and spending has caps and alerts at 80 and 100 percent.
See what FORGE builds for your team
We onboard every team ourselves, starting with the work that costs you the most time.
Talk to us
