What SMEs should document before an AI audit

Most SMEs we speak to are not blocked by regulation in the abstract. They are blocked by evidence: a trail that shows decisions were deliberate, proportionate, and owned by named people.

Start with a simple inventory of systems that influence people, money, or safety. For each item, record purpose, data sources, human review points, and what you do when output looks wrong. That single page often answers half the questions in a first audit conversation.

Governance does not need a 200-page policy on day one. It needs artefacts an external reviewer can read without a guided tour of your Slack channels.