Before the office closes: the AI access review nobody schedules
Quiet weeks are when automated things run unwatched. Four checks worth half an hour before you lock the door.
Between Christmas and New Year most Swiss SMEs run on a skeleton crew. Systems keep running; the people who would notice something odd are not there. It is worth half an hour before the break.
Four checks
1. What runs on a schedule and who reads the result. Automated exports, report mails, sync jobs, anything with an AI feature that fires on a timer. List them and note who would see a failure. If the answer for any of them is « nobody until January », decide now whether that is acceptable or whether it should be paused.
2. Accounts that are not people. Service accounts, API keys, integration users. These do not go on holiday and they rarely get reviewed. Two questions: does each one still correspond to something you actually use, and would you notice if one started doing something new?
3. Who can approve a payment while the office is empty. Holiday periods are peak season for invoice fraud and impersonation precisely because verification is harder. Confirm that the two-channel rule holds over the break and that the person on duty knows they are allowed to say no to an urgent request from a senior name.
4. Departing staff. Year-end is when people leave. Personal AI accounts used for work are not in your offboarding checklist, because nobody put them there. If a colleague has been drafting quotations in a personal chatbot, that history goes with them.
Why this is governance and not IT housekeeping
Because every item above is a decision about what may happen without a person present. That is the same question agents will pose all through 2025, just in a smaller and more familiar form.
A company that can answer these four questions in December already has the habit it will need when the first agent is switched on. A company that cannot will be asked the same questions later, under worse conditions.
The smallest useful version
If half an hour is not available, do item three. Payment verification over a quiet week is the one that turns into a real loss rather than an inconvenience.