When Does a Small Business Need an AI Audit?

Why does an AI audit sound like something only big companies need?

Most owners hear the word audit and picture a large company with a compliance department, a long report, and a bill to match. So the thought goes: we are a fifteen-person business, we barely use AI, this is not for us. I understand that reaction, and sometimes it is correct.

Here is what that reaction usually misses. In many small businesses, AI did not arrive through a decision. It arrived through a staff member's free account, a browser extension, or a feature a software vendor switched on in a tool you already pay for. The owner who says we barely use AI is often describing what they approved, not what is running.

An AI audit is not about size. It is about whether you can answer three plain questions: which AI tools are in use, what information they touch, and who is responsible for what they produce. If you can answer all three with confidence, you may not need one. If you cannot, the size of your company does not reduce the risk. It only reduces the number of people who will notice when something goes wrong.

What are the signs a small business needs an AI audit?

Any one of these is a reason to look closely. Two or more usually means it is time.

1. 01People on your team use AI tools you did not approve, or you are not sure whether they do.
2. 02A vendor has added AI features to software you already pay for, such as your CRM, phone system, email, or accounting tool, and nobody has decided whether to turn them on or off.
3. 03AI now talks to customers directly, through a website chat, a phone agent, or automated email and text replies.
4. 04A client has asked how you use AI in their work, or a contract now includes language about it.
5. 05You are about to spend real money on an AI build, platform, or subscription and want an independent read before you commit.
6. 06Something has already gone wrong: a wrong answer reached a customer, sensitive information was pasted into a tool, or an automation did something nobody expected.
7. 07You cannot name the person who owns each AI output that leaves the building.

Notice that most of these are not technology problems. They are ownership and visibility problems. That is exactly what an audit is meant to surface.

When does a small business not need an AI audit yet?

I would rather tell you when to wait than sell you something early. You probably do not need an audit yet if no one in the business uses AI tools for work, no vendor has added AI features you depend on, and you have no plans to buy anything in the next few months. In that case, a short AI policy is the better first step, and A Practical AI Policy for a 20-Person Company gives you a one-page outline.

There is a second case. If the question you are really asking is whether AI belongs in your business at all, an audit is the wrong starting point. An audit reviews what is in use or proposed. A decision about whether and where AI should go comes first. That is the job of the AI Verdict: a written answer on readiness and what to fix first, before anything is audited or built.

What should an AI audit actually cover?

Whoever does it, a useful AI audit for a small business should look at more than the tools. At minimum, it should cover:

• Every AI tool in use or proposed, including the ones staff found on their own.
• The business decision or task each tool is supposed to support.
• What information each tool can see, store, or send, and who else has access to it.
• Who owns each output, and who answers for it when it is wrong.
• Where a person reviews the work before it reaches a customer, and what happens when the tool fails.
• Whether the business can actually support each use today, in money, skills, time, and relationships.

The output should be a decision document, not a shopping list: what to keep, what to pause, what to stop, and what must be true before anything new is turned on. If an audit ends with a recommendation to buy the auditor's own product, it was a sales process with a better name.

That last point is why independence matters. A reviewer who earns nothing from the tools they review can tell you to switch something off. If you want the detailed version of how TCC runs one, the AI audit page walks through each step, and the review of owners and controls connects directly to AI governance consulting.

How do you prepare for an AI audit, or run a first pass yourself?

You can do the first pass this week in about an hour, with nothing more than a spreadsheet. Even if you never hire anyone, this page will tell you most of what you need to know.

1. 01Ask your team, without judgment, which AI tools they use for work and what they use them for. Make it safe to answer honestly, or you will only hear about the approved tools.
2. 02Open the settings of the software you already pay for and look for anything labeled AI, assistant, copilot, or automation. Write down what is on.
3. 03For each tool, write one row: what it does, who uses it, what information it touches, what it produces, and who reviews that output.
4. 04Circle every row where the information column includes client, financial, health, or personnel data.
5. 05Circle every row where the reviewer column is blank or says nobody.

The circled rows are your audit. If there are none, you are in better shape than most, and a policy will keep you there. If there are several, you now know where to start, and any outside help you bring in will spend its time on your real risks instead of discovering them.

One more check while you are in the settings: for anything that must never happen, such as a refund, a transfer, or a price quote, see whether the tool can still do it. If it can, a written instruction is not enough. I explain why in A Prompt Is Not a Control.