What AI governance does a company of 500 people actually need?

Everyone tells us we need "AI governance" but the frameworks I see online are written for large enterprises with dedicated AI teams and legal departments. We're a 500-person company with a 3-person IT department and no dedicated AI staff. We're starting to use AI tools across the business — customer service, document review, marketing — and I need to put something sensible in place without creating bureaucracy that slows us down. What's actually appropriate for our size?