For an owner-managed service firm, "governance" usually conjures images of policy documents and compliance committees built for organisations five times the size. That version doesn't fit, and it doesn't need to. Good AI governance at this scale isn't a framework you buy or a document you file away. It's a small set of decisions, clearly owned, that stop AI use from drifting into the kind of scattered, ungoverned adoption that creates risk without anyone noticing.
Governance starts with knowing what's actually happening
Most partners underestimate how much AI is already in use across their firm: drafted in personal accounts, on tools nobody signed off, on data nobody reviewed. You cannot govern what you haven't mapped. The starting point is not a policy; it's an honest inventory of where AI is touching client work today, however informal that use is.
Four things that matter more than a policy document
- A named owner for AI decisions: not a committee, one partner accountable for what's approved and why
- Clear rules on what client data can and cannot go near a given tool
- A lightweight review step before AI-assisted work reaches a client, proportionate to the risk of the task
- A single approved list of tools staff can use, replacing the informal spread that builds up by default
Proportionate, not bureaucratic
The right amount of governance for a 30-person firm is not a scaled-down version of what a bank needs. It's the minimum that lets a partner sleep at night knowing what's touched client data and who signed off on it, and no more than that. Over-engineering governance is as much a failure as ignoring it; it just fails by slowing the firm down instead of exposing it.
Firms that get this right treat governance as an enabler, not a brake: clear ownership and simple rules let staff use AI with confidence, because everyone knows where the line is. Firms that skip it don't avoid the risk; they just find out about it later, usually from a client.
Governance, done properly at this scale, is four decisions and one accountable owner, not a programme.