AI Self-Governance for Small Businesses
Ben Johnson (BJ)
CEO and Founder of Freya Systems
Mary Kate Lo Conte (MKL)
CEO and Partner of Merz Branding
Part 1: The AI Governance Gap Is Already Here
AI is already part of how small businesses write, research, brainstorm, design, analyze, and automate. But without clear guidance, everyday use can quickly create risks around confidentiality, copyright, client trust, brand consistency, and creative ownership.
In Part 1 of this two-part conversation, Ben Johnson, CEO and Founder of Freya Systems, and Mary Kate Lo Conte, CEO and Partner of Merz Branding, discuss why AI self-governance matters now. Their message is practical: businesses do not need to wait for a perfect rulebook, but they do need to define how AI should be used, what information must be protected, how outputs should be reviewed, and how their approach will be explained to clients, employees, and partners.
Part 1 explains the risks and responsibilities small businesses need to understand. Part 2 will build on that foundation with a framework for using AI responsibly without slowing innovation.
Why are we even having this conversation right now?
BJ: Because small business owners are already in it, whether they planned to be or not. Some are getting out over their skis because they are excited about AI. Others are sitting on the sidelines and hoping it will become clearer later. I would encourage the second group to get in the game, but both groups need intent. Governance is really about understanding how AI is affecting your organization and what control you need to protect your employees, your clients, and your business.
MKL: From a branding standpoint, it is also about being clear on what AI actually means inside your business. A lot of agencies are saying they are AI-forward, but they don’t always define what that means. Our clients are not coming to us for AI. They are coming to us for strategic thinking and creativity that differentiates them. AI can support that work, but it is not the value by itself.
BJ: There is also a funny assumption that if you are using AI, everything should be faster and cheaper. Sometimes it helps. Sometimes it allows a junior person to create a 30-page report for a manager to read when a two page summary would have sufficed. At that point, you do have to ask: who is working for whom?
MKL: Exactly. AI is impactful for administrative tasks and internal efficiencies, but when it comes to the things clients truly value, it cannot replace human-centered thinking. Small businesses need to distinguish between the value AI provides to the team and the value the business provides to the client.
What does the AI governance landscape look like for a small business owner?
MKL: It looks one of two ways. If you are not aware of the risks – copyright, NDAs, confidentiality, security, client restrictions – it can look like a wide-open space. If you are aware of the risks, it looks pretty rocky. There is not one clean federal playbook for small businesses to follow, so the work falls back on owners to create their own guidelines.
BJ: And that is where the lack of guidance becomes dangerous. AI can make a good process more efficient, but it can also make a bad process faster. Making more bad, more quickly, is not a business strategy. It is just a very productive way to create problems.
MKL: For us, the goal is to be smart, safe, and consistent. Smart enough to use AI where it helps. Safe enough to protect client and company information. Consistent enough that everyone can explain how we use it without making it up on the spot.
How is the rest of the world handling this, and what does that tell us about where the U.S. may be heading?
BJ: The EU has been more intentional about data privacy, and now AI regulation. The EU AI Act is risk-based and is being applied in stages, which gives businesses a sense of where regulatory thinking is going: transparency, human oversight, risk management, and accountability. In the U.S., the picture is still more fragmented. You have voluntary frameworks, agency enforcement, and state-level activity, but not one comprehensive federal AI law that answers every practical question for a small business.
MKL: That reminds me of GDPR. When the EU moved first on data privacy, global companies started preparing around the strictest expectations. Then similar conversations started happening state by state in the U.S. That may be a useful mindset for AI, too. If you serve multiple markets or work with sophisticated clients, do not wait until someone forces you to care.
BJ: A good starting point in the U.S. is the NIST (National Institute of Standards and Technology) AI Risk Management Framework. It is voluntary, but it gives businesses a structure for thinking about AI risk. Small businesses do not need to become regulatory scholars. They do need enough structure to ask better questions.
Where does creative and branding risk show up first?
MKL: For creative work, ownership is one of the biggest issues. We create names, logos, brand identities, campaigns, and public-facing materials for clients. If something is purely AI-generated, the copyright question becomes complicated because copyright protection depends on human authorship. We are comfortable because we do not use AI as the final creative product. We use it for ideation, storyboarding, and thinking through directions. The actual creative execution is done by humans.
MKL: I had someone starting a commercial dumpster cleaning business ask about a logo. Their vision was a dumpster holding a hose with bubbles and other elements. I put the description into ChatGPT just to make sure I understood the direction. My plan was to use it as a conversation starter and then have a designer create something original. The person saw the AI-generated version and said, ‘Great, I want to run with it. How do I protect it from competitors?’ The answer was: you really cannot protect that in the way you think unless a human designer creates an original version.
BJ: That is exactly the kind of risk small businesses do not always see. There is also input risk. If someone pastes client information, proprietary process, RFP content, or confidential material into the wrong tool, the issue may not be the AI output. The issue may be what they handed over on the way in.
What happens when AI creative goes public and misses the mark?
MKL: The audience notices. The danger is not just that something looks AI-generated. It’s that it can feel generic, deceptive, or disconnected from the emotional equity of the brand. We have already seen AI creative campaigns criticized as ‘AI slop,’ third-party fake ads creating demand for products that do not exist, and holiday ads being called soulless because they replaced emotional storytelling with something that looked pretty but felt empty.
BJ: AI is a probabilistic engine. If you give it a one-shot prompt, it will often give you the average answer. It is the little black dress of ideas: recognizable, useful, and right down the middle. But brands are not built in the middle. They are built through choices, consistency, and point of view.
MKL: That is why human strategy and human creative execution become more important, not less. Everyone has access to the same tools, which means sameness is a real possibility. If a small business wants to stand out, it cannot outsource distinctiveness to the same platform everyone else is using.
What are courts and regulators telling business owners to watch?
BJ: The practical risk zones are inputs and outputs. What are employees putting into AI systems? And what is the business willing to put its name on? Copyright cases are testing questions around training data and outputs that mimic existing creations. Regulators are also watching companies that overstate or misrepresent what their AI products do.
MKL: That matters for agencies and service businesses because we sit in the middle. We touch client intellectual property on the way in, and we produce client-facing work on the way out. Both pressure points run directly through us.
BJ: The act of using AI is not automatically the problem. The danger is using it without knowing what information is being exposed, what claims are being made, and what level of review is happening before something leaves the building.
So what should a small business owner take away from the landscape?
BJ: Do not wait for perfect federal regulation to start governing AI. By the time a perfect rulebook exists, your employees will have been using AI for years. Put something in place now, even if it evolves.
MKL: And be prepared to explain your approach. Clients may not be asking every day yet, but they will. The businesses that can say, plainly and consistently, how they use AI and how they protect information will be in a stronger position than those still waving around the phrase ‘AI-forward’ and hoping no one asks a follow-up question.
BJ: That sets up the real point: a policy alone is not enough. You need the policy, but you also need a framework that helps people make good decisions in real time. That is where self-governance becomes usable.
Ben Johnson is CEO and Founder of Freya Systems, a Media, Pennsylvania-based data analytics and AI solutions firm he established in 2009. For more than 15 years, Ben has helped organizations in aviation, utilities, manufacturing, defense, and energy make data more useful, actionable, and valuable. His work focuses on AI strategy, machine learning, workflow efficiency, predictive maintenance, and practical ways to balance automation with human judgment. A Goldman Sachs 10,000 Small Businesses alumnus, Ben leads Freya with a focus on curiosity, collaboration, and sustainable solutions that support both innovation and organizational well-being. Learn more about Freya Systems at freyasystems.com
Mary Kate Lo Conte is CEO and Partner of Merz Branding, where she helps healthcare, life sciences, and nonprofit organizations build brands that drive meaningful growth. With more than 30 years of experience, Mary Kate translates research and insights into clear strategy, compelling creative, and consistent execution. Her work focuses on positioning, messaging, brand strategy, and practical ways to help organizations build trust and show up with clarity across every touchpoint. She holds an MBA in Marketing from Drexel University and is a national conference speaker on branding, bringing a strategic, hands-on perspective to building brands with long-term impact. Learn more about Merz Branding at merzbranding.com
Next in the series: Part 2: Why an AI Policy Is Not Enough
