A 1-5 location trades shop running Avoca on the phones, Rilla in the kitchen, ResponsiBid on the tablet, Dispatch Pro on the board, Hatch on the nurture, CallRail on the call audit, NiceJob and Podium AI Employee on the reviews, plus an in-house custom GPT or two on the marketing manager's laptop is operating 8-12 AI surfaces simultaneously — and the owner is the single point of accountability for every regulated, financial, customer-facing, and employee-facing artifact those tools produce. Most 1-5 location shops have nothing written down on who approved which tool, who owns the prompt library, who reviews the weekly AI audit, what gets escalated to the owner, or how long the call recordings live before deletion. The 2026 regulatory environment — CFPB, state AGs, FCC, state contractor boards, FCRA plaintiff firms, plus emerging state AI statutes (Colorado AI Act, Illinois HB 3773, California CPPA AI regulations) — does not credit "we hadn't gotten around to it." It credits the documented operating cadence. This lesson is the 5-page governance doc every 1-5 location shop should have signed by Q1 2026: AI tool approval workflow, prompt-library ownership, weekly AI audit, owner-escalation matrix, data-retention policy on call recordings, and the quarterly governance review that aggregates the cadence into a board-defensible, regulator-defensible operating system.

Why a 1-5 Location Shop Needs Governance, Not Process

The trap most 1-5 location owners fall into is treating AI like another tool stack — install, train, run, measure. AI is not a tool stack. It is a regulated operating system that produces customer-facing artifacts, financial-disclosure artifacts, employee-recorded artifacts, and marketing artifacts across a dozen surfaces simultaneously. Tool-stack management is operations; what AI requires is governance. Governance is the structural artifact that says who decides, who owns, who reviews, who escalates, what gets logged, what gets retained, what gets deleted. Without it, a 6-truck shop with 8 AI tools and 18 employees and 350 monthly transactions has 50,000+ AI-touched artifacts per year, with no single person able to audit any of them.

The 1-5 location shop is the right scale for the lightweight governance doc. Above 5 locations, governance gets formalized through corporate compliance, multi-location operating committees, and platform-level audit functions — Wrench Group, Authority Brands, Apex Service Partners, Sila Services, Path Light Pro, Redwood Services, ARS-Rescue Rooter all run versions. Below 5 locations, the owner is the corporate compliance function, and the doc has to be small enough that the owner actually signs it, refers to it, and updates it quarterly. 5 pages is the right size; 25 pages is corporate-compliance theater filed and never read; 1 page is insufficient against the regulatory exposure surface.

Three regulatory environments converging in 2026 make the doc the floor. The financing regime (Reg Z, FCRA) requires documented vendor configuration, prohibition discipline, audit cadence. The voice regime (TCPA, two-party consent, FCC 2024 AI-voice rulings) requires documented disclosure language, vendor configuration, audit cadence. Emerging state AI statutes (Colorado AI Act Feb 2026, Illinois HB 3773 Jan 2026, California CPPA AI 2026) introduce AI-system inventory, impact assessments on consumer-affecting AI, notification requirements when AI makes consequential decisions. The doc satisfies all three with one operating artifact. Without it, every regulatory surface is an independent build.

Section One: The AI Tool Approval Workflow

No new AI tool enters the shop without an approval. The workflow is one page and defines the gate.

Proposal. Any role can propose — marketing manager hears about a new AEO platform, service manager wants a new scorecard tool, sales manager catches a Comfort Advisor demo at the trade show. The proposal is a one-page form: tool name, vendor, problem solved, existing tool it replaces or overlaps with, projected cost, projected metric impact, regulatory surface (financing, recording, customer data, financial disclosure, scorecards), pilot duration, success criterion. 20 minutes to fill out; the discipline of the form is the governance act.

Review. The compliance officer (in a 1-5 location shop, typically the owner, a senior office manager, or a fractional compliance contractor) reviews against four criteria. (1) Does it overlap with an existing tool? (2) Does it touch a regulated surface requiring additional configuration discipline? (3) Does it require workflow discipline the shop does not yet have? (4) Is the vendor's published case data from a comparable shop? 30-45 minutes; produces pilot-approved, pilot-rejected, or returned-for-clarification.

Signoff. The owner signs every new tool approval. Not the marketing manager. Not the GM. The owner. The signature attaches accountability to the role that carries it under regulatory frameworks, lender partnership agreements, contractor-board exposure, and class-action exposure. A real signature on paper or a documented digital signature in the governance binder; "informal go-ahead" does not count. The signature is the artifact under audit.

Pilot configuration. Every approved tool enters a 30-day pilot with named owner (the proposer), single-metric success criterion, regulatory configuration checklist (system-prompt prohibition if financing-adjacent, two-party-consent disclosure if recording, data-retention configuration, audit-log access), and end-of-pilot review date. At day 30: metric movement, configuration verification, exception log. Compliance officer audits configuration; owner signs renewal-or-terminate. Tools lingering past day 30 without signoff are governance failures.

Section Two: The Prompt Library Ownership and Cadence

The shop's prompts are an asset and a liability. Asset: they encode the shop's voice, compliance discipline, coaching cadence, and accumulated operating wisdom. Liability: prompt drift produces regulated-term bleed, two-party-consent failure, FCRA reproduction failure, brand-voice drift, or coaching-error propagation. The library needs an owner.

The named owner. One person owns the prompt library across the shop. In a 1-5 location shop this is typically the marketing manager (brand-voice and customer-facing prompts), the service manager (tech and CSR scorecard prompts), or a senior office manager with cross-functional view. Named in the governance doc by title and name; role does not rotate quarterly. Owner maintains the library in a single accessible location (Notion, Google Drive, shop repository, Confluence/SharePoint if franchise-mandated), versioned by date, with each prompt tagged by tool, purpose, regulated-surface status, approval date, next-review date.

The prompt addition process. Any role proposes; the named owner reviews against five criteria. (1) Does the prompt touch a regulated surface? (2) Does it carry the appropriate system-prompt prohibition for regulated surfaces? (3) Does it match the shop's brand voice? (4) Does it overlap with existing library prompts? (5) Does it have a documented test case demonstrating expected behavior on regulated edge cases? Pass four of five to enter the library.

The quarterly prompt review. Every 90 days the named owner walks the library: unused prompts archived (eliminates stale-prompt risk); active prompts get sample-output review (10 outputs per prompt); regulated-surface prompts get explicit prohibition-adherence audit. Logged in the governance binder. Aligns with the quarterly vendor governance review from the prior two lessons; same 90-minute meeting often covers both.

The prompt-failure escalation. When the weekly AI audit catches a prompt failure (regulated-term bleed, brand-voice drift, coaching error, hallucination), the failure escalates to the named owner within 24 hours. Owner refines the prompt; tests against failure case plus 20 additional cases; deploys the refined prompt; logs the cycle. Prompt failures are not punished at the individual level; the prompt is the gap, not the user.

Section Three: The Weekly AI Audit

The weekly AI audit converts AI deployment from a tool stack into a governed system. 60-90 minutes per week. The artifact is the documented audit-pass log every regulator, plaintiff firm, lender auditor, peer-group coach, and PE partner reads first. 1-5 location shops run the audit at the owner-plus-compliance-officer level; multi-location operators distribute across location GMs feeding upward.

What gets sampled. Five buckets, 5-10 artifacts per bucket. Bucket one: customer-facing AI outputs (proposals, financing narratives, follow-up texts, review responses). Bucket two: AI-recorded calls (Avoca, CallRail, ServiceTitan, Rilla) sampled by inbound area code to catch two-party-consent state coverage. Bucket three: AI-drafted employee artifacts (tech scorecards, CSR coaching cards, advisor 1:1 prep). Bucket four: AI-drafted marketing content (Hatch nurture, NiceJob, Podium AI Employee, blog posts, AEO content). Bucket five: AI-touched financial artifacts (proposal financing blocks, soft-pull decline templates, AI-summarized payment plans).

What the audit looks for. Six checks per artifact. (1) System-prompt prohibition held (regulated-term surfaces)? (2) Two-party-consent disclosure played (recorded surfaces)? (3) FCRA adverse-action template used (decline surfaces)? (4) Brand voice matched the shop's documented voice? (5) Coaching content matched the shop's playbook? (6) Hallucinated facts (part numbers, SEER ratings, warranty terms, code citations, financing terms)? Each artifact gets pass-or-flag; flagged escalate to relevant owner.

The audit log. Date, artifacts sampled per bucket, pass-and-flag counts, escalations, remediations, prompts updated, configurations refined. 1-2 pages per week. The year-aggregated log is the compounding asset demonstrating sustained discipline. Absence of the log is presumptive non-compliance.

The bulletin board complement. Some shops complement the audit log with a physical "AI Caught a Hallucination" bulletin board in the dispatch area — date, what AI generated, what was correct, who caught it, how the prompt got refined. Cultural artifact; the audit log is the regulatory artifact.

Section Four: The Owner-Escalation Matrix

Not every AI failure escalates to the owner. The matrix defines what does and what does not, so the owner is not the bottleneck on operational decisions and is not surprised by regulatory exposure.

Escalates immediately to the owner. Regulated-term bleed in a customer-signed artifact (Reg Z violation). FCRA adverse-action template failure on a soft-pull decline. Two-party-consent failure on a recorded call in CA, PA, IL, MA, or the other all-party jurisdictions. TCPA opt-out failure producing per-violation events. State contractor board complaint involving AI-drafted scope-of-work or SEER/efficiency claim. FTC inquiry on AI review responses or endorsement language. State-AG UDAP inquiry. Class-action filing or demand letter. Lender partnership-status warning from Wisetack, GreenSky, or Synchrony. Data-breach or customer-data-exposure event on an AI surface.

Escalates to the compliance officer (owner notified at the weekly audit). Prompt-failure cycles caught by the weekly audit and remediated within 24 hours. Brand-voice drift on AI-generated marketing content. Coaching-content errors caught by the service manager. Vendor configuration drift caught by the quarterly review. Non-regulated hallucinations caught by the verify discipline.

Escalates to the relevant function manager. CSR-level workflow questions (marketing or service manager). Tech-level questions (service manager). Advisor-level questions (sales manager). Marketing-content questions (marketing manager). Function manager logs at the weekly audit if pattern emerges.

The owner's escalation discipline. 24 hours for acknowledgment and remediation-plan; 72 hours for documented remediation; counsel engagement within 48 hours if regulated. Owner's calendar holds capacity for escalation; the team knows the window; documented acknowledgment becomes the artifact under inquiry. Owner unavailability windows (vacation, peer-group retreat, busy-season blackout) trigger a documented alternate-acknowledger (fractional compliance contractor or counsel-on-retainer) so the window never lapses.

Section Five: The Data-Retention Policy on Call Recordings

Call recordings are the highest-volume regulated-data surface in the shop's AI footprint. Avoca, CallRail, ServiceTitan call recording, Jobber AI Receptionist, HCP AI Agents, Rilla, ServiceTitan Voice each produce thousands of recordings per month across a 6-truck shop. Each recording is governed by two-party-consent statutes in twelve jurisdictions, emerging state biometric statutes (Illinois BIPA on voiceprints, California CPRA biometric provisions), consumer deletion-request rights, and lender-partnership audit windows. The retention policy satisfies all four.

The retention tiers. Tier one — short retention: routine inbound/outbound CSR calls without financing or regulated content. 90-day retention; auto-delete after 90 days unless flagged for coaching, complaint, or audit. Tier two — medium retention: calls involving financing soft-pulls, financing language, or customer complaint. 24-month retention to cover lender-partnership audit cycles, FCRA/Reg Z statutes of limitations, and class-action discovery windows. Tier three — long retention: calls preserved for litigation hold, ongoing regulatory inquiry, or contractor-board complaint. Retained until the matter closes plus 7 years.

The deletion-request mechanism. Every consumer-facing AI disclosure includes "You may request deletion of any recording at [shop phone]." Consumer's request triggers within 30 days for tier-one; tier-two requires legal review (lender audit, regulatory hold) and may decline with documented reason; tier-three subject to litigation-hold preservation. Deletion log artifact: date of request, recording ID, action taken, reason if declined, requestor acknowledgment.

The biometric processing scope. Voiceprint extraction (Rilla speaker ID, Avoca sentiment voice biometrics, ServiceTitan Conversational AI voice analytics) operates within emerging state biometric statutes. Illinois BIPA per-consumer exposure $1,000-$5,000 for voiceprint use without explicit consent; California CPRA biometric provisions require deletion mechanisms and notification. Governance doc captures which AI tools perform biometric processing; the consumer-facing disclosure explicitly references AI processing of voiceprints; deletion-request mechanism includes biometric scope.

The audit cadence. Monthly audit verifies tier-one auto-delete is functioning; tier-two retention is intact; tier-three litigation-hold preservation is active. Quarterly review samples deletion-request log for response-time compliance and reason-for-decline patterns. Policy is signed by the owner; refreshed annually; produced under audit on 24-hour notice.

The Five-Page Governance Doc Structure

Each page covers one section; the structure aligns with the operating cadence.

Page one: AI tool approval workflow. Proposal form template, review criteria, owner signoff, pilot configuration, 30-day pilot-or-terminate discipline. Names the compliance officer and the owner. Signed by the owner. Refreshed annually or on personnel change.

Page two: prompt library ownership and cadence. Names the prompt-library owner; defines the addition process; defines the quarterly review; defines the failure escalation. References the storage location (Notion, Google Drive, SharePoint). Signed by owner and prompt-library owner.

Page three: weekly AI audit. Names the audit owner; defines the 5-bucket sample, the 6-check review, the audit-log location and retention, the escalation pathways. Signed by owner and audit owner. References the bulletin-board complement if used.

Page four: owner-escalation matrix. Defines what escalates immediately, what escalates to the compliance officer, what escalates to function managers. Defines the owner's response window (24-hour acknowledgment, 72-hour remediation, 48-hour counsel if regulated). Names the alternate-acknowledger. Signed by the owner.

Page five: data-retention policy on call recordings. Three retention tiers, deletion-request mechanism, biometric processing scope, monthly retention audit, quarterly deletion-log review. References AI vendors carrying recordings (Avoca, CallRail, ServiceTitan, Jobber AI Receptionist, HCP AI Agents, Rilla, ServiceTitan Voice) and per-vendor retention configuration. Signed by the owner.

Five pages. Signed by the owner. Refreshed annually. Reviewed quarterly. Produced under audit on 24-hour notice. The doc is the operating system the PE-backed platform CEO walks into the board review with; the Authority Brands or Wrench Group regional president audits in the portfolio QBR; the CFPB examiner reads under inquiry; the FCRA plaintiff firm reviews under discovery; the state-AG investigator under UDAP look; the state contractor board under complaint investigation; the lender's compliance auditor under partner audit; the emerging Colorado AI Act / Illinois HB 3773 / California CPPA AI examiner under impact-assessment review. One operating system; every audience.

The Quarterly Governance Review and the Compounding Asset

The quarterly governance review aggregates the operating cadence into the strategic artifact every regulator and platform principal reads as evidence of governance maturity. 90 minutes per quarter. Owner, compliance officer, prompt-library owner, and audit owner.

Topic one (20 minutes): audit-log roll-up. Twelve weekly audits aggregated; pass-and-flag counts per bucket; escalation patterns; remediations; prompts updated; configurations refined. Identifies systemic patterns the weekly audit cannot see — drift in a specific tool, emerging failure modes across CSR-row prompts, coaching-content error patterns from one service manager.

Topic two (20 minutes): prompt-library state. Active prompts, archived prompts, additions and refinements during the quarter, regulated-surface prompt audit results. Catches stale prompts before they fail; catches new prompts that bypassed addition; catches drift eroding brand voice or compliance discipline.

Topic three (20 minutes): vendor governance matrix. Each AI tool crossed against configuration status, regulated-surface prohibition adherence, pilot status, renewal date, partner-agreement compliance. Often integrated with the quarterly vendor governance review from the prior two lessons.

Topic four (15 minutes): data-retention audit. Tier-one auto-delete verification; tier-two retention sample; tier-three litigation-hold integrity; deletion-request log review.

Topic five (15 minutes): regulatory and strategic surface. New state AI statutes or rulings affecting the architecture; emerging plaintiff-bar patterns; lender-partnership changes; state contractor board guidance changes. The external-environment scan that catches forward-looking exposure before it lands.

The quarterly review produces a signed governance memo aggregating the five topics into a 2-3 page artifact. The memo is the substrate of the annual board-defensible AI narrative the L4 owner walks into the year-end review with — the artifact aligning with the L4 capstone defense and the strategic forward narrative from the Quarterly Strategic AI Review lesson. Four quarterly memos aggregate into the annual governance narrative; the annual narrative is the L4 capstone substrate and the PE-board, peer-group, or franchisor-QBR defense artifact.

Key Takeaways

• 1-5 location shops running 8-12 AI tools have 50,000+ AI-touched artifacts per year — tool-stack management is operations; what AI requires is governance. Five-page doc. Owner-signed. Refreshed annually. Reviewed quarterly.
• Section one: AI tool approval workflow. One-page proposal form, compliance-officer review against four criteria, owner signoff, 30-day pilot with named owner and single-metric success criterion. Tools lingering past day 30 without signoff are governance failures.
• Section two: prompt library ownership. One named owner. Five-criterion addition process. Quarterly review aligned with vendor governance. Failure escalation within 24 hours. Prompt is the gap, not the user.
• Section three: weekly AI audit. 60-90 minutes. Five buckets (customer-facing, recorded calls, employee artifacts, marketing content, financial artifacts); 5-10 artifacts per bucket; six checks per artifact. Pass-or-flag log. Optional bulletin-board complement.
• Section four: owner-escalation matrix. Regulated-term bleed, FCRA/Reg Z failure, two-party-consent failure, TCPA opt-out, state board complaint, FTC inquiry, state-AG inquiry, class action, lender partner-status warning, customer-data exposure all escalate immediately. 24-hour acknowledgment, 72-hour remediation, 48-hour counsel if regulated.
• Section five: data-retention policy. Three tiers — 90-day routine, 24-month financing-or-complaint, litigation-hold-plus-7-years. Deletion-request honored within 30 days tier-one. Biometric scope (Illinois BIPA, California CPRA). Monthly retention audit; quarterly deletion-log review.
• Quarterly governance review: 90 minutes. Audit-log roll-up; prompt-library state; vendor governance matrix; data-retention audit; regulatory and strategic surface scan. Signed memo aggregates into annual narrative.
• Three converging regulatory regimes with one operating artifact — financing (Reg Z/FCRA), voice (TCPA/two-party), emerging state AI statutes (Colorado AI Act Feb 2026, Illinois HB 3773 Jan 2026, California CPPA AI 2026).
• 5-page size is structural. Above 25 pages is corporate-compliance theater; below 1 page is insufficient. 5 pages is what the owner actually signs, refers to, and updates quarterly.
• One operating system; every audience. CFPB, FCRA plaintiff firms, state-AG UDAP, state contractor boards, lender auditors, Colorado AI Act/HB 3773/CPPA examiners, PE-portfolio QBR, Authority Brands/Wrench Group regional president, peer-group coach. The doc plus quarterly memo plus annual narrative defends in front of all.