Small team, big impact

A lot of people assume AI governance scales with the size of the business, and it’s easy to see why. Much of the law does. Australia’s Privacy Act exempts most businesses with an annual turnover of $3 million or less (OAIC), and the reforms currently in draft keep that exemption. So a small team reasonably expects a lighter touch.

ISO 42001 doesn’t work that way, and neither does good governance. Size matters in some places. The standard notes that the extent of documented information can differ with the size of the organisation (clause 7.5.1), and a small team can reasonably have one person hold several roles. But the impact assessment (6.1.4) is about the people your AI affects, and they aren’t affected any less because you have five staff.

Take a small team that builds an app to help people form healthy habits around sleep, exercise and mood. Five people, modest revenue, comfortably under the threshold. If it works, it could be on a million phones within a year, making suggestions to people about their health, and some of those people will be vulnerable. Here even the law turns out to follow the activity rather than the size. Health service providers are covered by the Privacy Act whatever their turnover, and the regulator counts a gym or weight loss clinic as one when it collects health information (OAIC). An app built around healthy habits may well be in the same position. The team that assumed it was too small to be covered may not be.

Now take a small advisory firm that uses AI to help research and draft policy advice for government clients. On paper it’s a small business making ordinary use of AI tools, and a light touch seems to fit. But if that advice is adopted, it shapes programs that affect thousands or millions of people. The impact doesn’t flow through the firm’s size or its technology. It flows through what the AI helps it produce and who acts on it. A misread source or a skewed summary doesn’t stay inside a small firm.

Anyone who has built for scale knows that reach is what changes the risk. A model that is wrong once in a hundred times is a curiosity in a pilot and a pattern across a million users.

Proportionate is allowed. Thin isn’t. A small team can keep its documentation lean and have people wear several hats. What it can’t do is make the impact assessment smaller than the impact. Proportionality has to be argued from the system’s reach and the people it affects, not assumed from headcount. That starts with describing the harm, not rating it.

It’s also an advantage. A small team that has thought this through can show a buyer exactly who its AI affects and what it does about it, which is more than many larger suppliers can.

If you’d like to check whether your impact assessment matches your impact, a readiness assessment is a good place to start.