The AI governance starter guide for mid-sized firms

AI governance sounds like something only large enterprises need. In reality, mid-sized firms often need it more. You have enough people for AI use to spread quickly, but rarely a dedicated team to keep track of it.

This guide sets out what AI governance actually involves, in plain terms, and how to get started without a big programme.

What AI governance means

AI governance is how your business decides which AI is used, how it’s used, and how you know it’s working as intended. Think of it as the same discipline you already apply to finance or data protection, applied to AI.

Good governance is:

• Practical. It fits how your people actually work.
• Proportionate. Effort matches risk. A grammar checker isn’t treated like a tool that makes decisions about clients.
• Evidenced. You can show what you do, not just say it.
• Living. It updates as tools, use and rules change.

The five building blocks

1. Visibility

Know which AI tools and features are in use, who uses them, and what information goes into them. Everything else depends on this.

2. Policy

A short, clear AI acceptable use policy. What’s approved, what’s not, what information must never be entered into an AI tool, and when output needs a human check.

3. Risk assessment

A simple way to sort AI use by risk. Consider the data involved, whether output reaches clients, and whether AI influences decisions about people.

4. People

Training so staff understand both the rules and how to use AI well. Confidence matters as much as compliance.

5. Evidence and review

A record of what you’ve approved, assessed and trained, reviewed on a regular rhythm. This is what lets you answer questions from clients, insurers and auditors.

Who should own it

You don’t need a new department. You do need clear names.

• An accountable lead. Usually a director or partner who owns AI governance at board level.
• A day-to-day owner. Often in operations, risk, compliance or IT. They keep the register and policy current.
• Team champions. People in each team who know how AI is used locally and can flag new tools.

A 90-day starting plan

1. Days 1 to 30: see it. Build an inventory of AI tools and use. Talk to teams. Check software settings and expenses.
2. Days 31 to 60: set the rules. Publish a short AI policy. Approve a small set of tools. Assess the higher-risk uses.
3. Days 61 to 90: build the habit. Train staff. Set a review date. Start keeping evidence in one place.

After 90 days you won’t be finished. Governance doesn’t finish. But you’ll be in control, and that’s the point.

Common pitfalls

• Writing a policy nobody reads. Keep it short and specific.
• Treating every tool the same. Proportionate beats thorough.
• Doing it once. New AI features arrive constantly. Build in a review rhythm.
• Leading with fear. People hide what they’re worried about. Make it safe to be open.

How TURMA helps

TURMA brings this together in one product with three modules. Snapshot shows what AI you’re actually running. Assured helps you run governance day to day, with policies, controls and evidence that stay current. Passport trains your people and gives you a credential you can show clients and insurers.

See it. Control it. Prove it.