Playbook 5 — Roles Without a Department
Who does this at a company that doesn't have an AI Officer, a DPO, or an ethics committee
The Problem With the Textbook Version
A full AI governance model names eight distinct roles: an AI Officer, IT, Business, Legal, a Data Protection Officer, Cybersecurity, ESG, Compliance, and Procurement. At 30–150 people, that’s not a department — it’s two or three people wearing several hats each. The goal here isn’t to hire eight roles; it’s to make sure the responsibilities behind those eight roles are actually assigned to someone, even if one person holds four of them.
Role Mapping — Textbook Role to SMB Reality
The eight textbook roles, and who actually holds each at 30–150 headcount:
| Textbook role | SMB reality |
|---|---|
| AI Officer | Founder or COO |
| IT | Whoever owns the company’s systems or IT vendor relationship |
| Business | The business/ops reviewer named below |
| Legal | Outside legal contact, engaged per use case |
| Data Protection Officer | Same outside legal contact, or whoever owns GDPR compliance today |
| Cybersecurity | IT/ops, or an outside security contact for anything High tier |
| ESG | Usually not a distinct function at this size — folded into the AI Officer’s call |
| Compliance | Outside legal contact for regulated use cases; AI Officer otherwise |
| Procurement | Whoever owns vendor contracts today — often the AI Officer or ops |
Minimum Viable Governance Committee
Three people is enough, and for most 30–150 headcount companies, two is workable.
- The AI Officer (usually the founder or COO) — final call on risk tier and go/no-go.
- A business/ops reviewer — someone who wasn’t the one pushing for the tool, so there’s a second opinion.
- An outside legal contact, engaged per use case rather than sitting on a standing committee — for anything High tier (Playbook 1) or touching personal data.
Escalation Rule
WHEN THE TEAM DISAGREES
Technical wants to ship. Legal flags risk. Business isn’t sure it’s worth it.
Default rule: the AI Officer makes the final call, but cannot overrule a documented legal or compliance objection without recording why in the decision log (Playbook 6).
If personal safety, legal exposure, or a High-tier use case is involved and there’s genuine disagreement — pause and get outside legal input before deciding.
Meeting Cadence
- Quarterly: review the AI system inventory — anything new, anything that should be retired.
- Ad hoc: any time a new High-tier or vendor-supplied AI use case comes up (Playbook 1 triage triggers this automatically).
- No standing weekly meeting needed at this size — the overhead isn’t worth it until the inventory is meaningfully larger.
Next Steps
Name the two or three people above by title, not by “we’ll figure it out later.” Put their names in the AI system inventory (Playbook 6) as the owner field for every system in use.