An AI governance framework is the set of rules, roles and checks that decide which AI tools your organisation uses, for what, and with which data. You don't need a large compliance team to start. This framework is built for small and mid-sized firms and maps to the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act, so it grows with you.
The six building blocks
- Ownership. Name one accountable person (often the COO, head of IT or a partner) and a small group that meets monthly: IT or security, legal or compliance, and one person from the business who uses AI every day.
- Policy. A short acceptable use policy that says what staff may and may not do with AI, which data is off-limits, and who approves new tools.
- Inventory. A list of every AI tool in use, who uses it, for what and with what data. Our AI risk register template doubles as this inventory.
- Risk assessment. Before a tool is approved, assess the vendor and the use case. Use the AI vendor questionnaire and the AI risk assessment template.
- Controls. Business plans with training switched off, single sign-on, human review of important outputs, and clear labels when AI content reaches clients.
- Monitoring and review. Re-check approved tools every quarter or when their terms change, keep a simple incident log, and refresh training once a year.
How the blocks map to the big frameworks
| Building block | NIST AI RMF | ISO/IEC 42001 | EU AI Act (deployers) |
|---|---|---|---|
| Ownership | Govern | Clause 5 Leadership | AI literacy (Art. 4) |
| Policy | Govern | Clause 5.2 AI policy, Annex A.2 | Use according to instructions (Art. 26) |
| Inventory | Map | Clause 4 Context, Annex A.4 | Know which systems are high-risk (Art. 6) |
| Risk assessment | Map, Measure | Clauses 6.1.2 to 6.1.4 | Fundamental rights impact assessment where required (Art. 27) |
| Controls | Manage | Clause 8, Annex A.6 to A.10 | Human oversight, transparency (Art. 26, 50) |
| Monitoring | Manage, Govern | Clauses 9 and 10 | Monitor and report incidents (Art. 26) |
A 30-day rollout plan
- Week 1: appoint the owner, list the AI tools people already use (ask every team, including free tools and browser extensions).
- Week 2: publish the acceptable use policy and a list of approved tools. Block or replace anything that trains on company data.
- Week 3: assess your top five tools with the vendor questionnaire and record them in the risk register. Check each tool's SafeScore as a first screen.
- Week 4: run a 30-minute training session, set up the tool approval process and book the first quarterly review.
Frequently asked questions
Do small businesses need an AI governance framework?
Yes, but a light one. If staff paste client or customer data into AI tools, you already carry the risk. A one-page policy, an approved tools list and a register cover most of it.
Which framework should we follow?
Start with NIST AI RMF for structure (it is free and flexible). Move toward ISO/IEC 42001 if clients ask for certification, and check the EU AI Act if you serve customers in the EU.
How often should we review AI tools?
Every quarter, and whenever a vendor changes its terms, adds a major feature such as agents, or has a security incident.