Most AI governance frameworks you'll find online were written for banks, governments or the companies that build AI models. A company of 200 people that pays for ChatGPT, Copilot and a few AI features inside its HR software needs something smaller. It needs to know which published framework to borrow from, which duties are actually law, and what to write down first. The answer is shorter than the search results suggest.
What is an AI governance framework?
An AI governance framework is the set of rules, roles and checks that decides which AI your organization uses, for what, and who answers for it when something goes wrong. In practice it's a short list of things you can point to: an inventory of the AI in use, the laws that apply to it, an owner for each tool, a way to approve new uses, a way to check they work, and a way to switch them off.
This guide is for the people who end up owning that: COOs, IT and security leads, and HR and operations leads at companies of 20 to 1,000 people that use AI rather than build it. It compares the frameworks you're most likely to be asked about, says which ones you need, and gives you a one-page version to start with. It isn't legal advice.
A framework isn't the same as a policy. Your AI usage policy is the page of rules staff follow. The framework is the system around it: who wrote the rules, who approves exceptions, and who checks they're working.
Which AI governance frameworks should a mid-size company know?
Three matter for most US companies of this size: the NIST AI Risk Management Framework as the structure, ISO/IEC 42001 if customers ask for a certificate, and the EU AI Act if you operate in Europe or your AI's output is used there. Everything else you'll see in "top 10 AI frameworks" lists is either a set of principles or written for governments.
| Framework | What it is | Binding? | When it matters to you |
|---|---|---|---|
| NIST AI RMF 1.0 (January 2023) | US guidance with four functions: GOVERN, MAP, MEASURE, MANAGE | No, voluntary | As the structure for your own framework, at any size |
| NIST Generative AI Profile (July 2024) | A companion to the RMF covering 12 risks that generative AI creates or makes worse | No, voluntary | If you use ChatGPT, Copilot or similar. Texas names it in a legal defense |
| ISO/IEC 42001:2023 | An international standard for an AI management system, certified by accredited bodies | Only if you choose certification | When a customer asks for the certificate |
| EU AI Act | EU law, with duties sorted by four risk levels | Yes, where it applies | If you have staff, customers or applicants in the EU |
| OECD AI Principles (2019, updated May 2024) | Five values-based principles | No | As the "why" behind your rules, not the "how" |
They aren't rivals. NIST tells you what good looks like, ISO lets an auditor certify that you do it, and the EU AI Act makes some of it compulsory for some uses. A company that sets itself up on NIST's structure has done most of the groundwork for the other two.
What does the NIST AI governance framework ask you to do?
NIST's AI Risk Management Framework sorts the work into four functions: GOVERN sets the rules and owners, MAP works out what each AI use is for and what could go wrong, MEASURE checks it, and MANAGE acts on what the checks find. NIST released it on January 26, 2023, and calls it "intended for voluntary use".
The framework says governance "is designed to be a cross-cutting function to inform and be infused throughout the other three functions." In plain terms: you set up GOVERN once for the company, then run MAP, MEASURE and MANAGE for each AI use. NIST's own advice on order is that "most users of the AI RMF would start with the MAP function and continue to MEASURE or MANAGE" once GOVERN is in place.
Each function breaks into categories and subcategories. By our count there are 19 categories and 72 subcategories in total. That looks heavy, but NIST is explicit that you don't have to do all of it. It describes itself as giving "flexibility to organizations of all sizes", warns that its actions "do not constitute a checklist", and says "some organizations may choose to select from among the categories and subcategories".
For a company that uses AI rather than builds it, a handful of subcategories do most of the work:
| NIST subcategory | What it says | What it means at 200 people |
|---|---|---|
| GOVERN 1.1 | "Legal and regulatory requirements involving AI are understood, managed, and documented." | A list of the AI laws that reach you, by state and use |
| GOVERN 1.6 | "Mechanisms are in place to inventory AI systems" | Your AI list, kept current |
| GOVERN 2.1 | "Roles and responsibilities and lines of communication ... are documented" | One named owner per tool, and who they tell |
| GOVERN 6.1 | "Policies and procedures are in place that address AI risks associated with third-party entities" | Reading vendors' data terms before you sign |
| MAP 1.1 | "Intended purposes ... context-specific laws, norms and expectations ... are understood and documented" | A few lines on what each use is for and who it affects |
| MANAGE 2.4 | Mechanisms "to supersede, disengage, or deactivate AI systems" that behave outside their intended use | A tested off switch |
| MANAGE 4.1 | "Post-deployment AI system monitoring plans are implemented", including "incident response, recovery, and change management" | A way to report problems and a date to look again |
MAP has one more output worth knowing. After it, NIST says, you should know enough "to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system." That's the question your approval process has to answer for every new use.
The Generative AI Profile
In July 2024 NIST added a companion document for generative AI, NIST AI 600-1. It calls itself "a cross-sectoral profile of and companion resource for" the framework, and lists 12 risks that are "unique to or exacerbated by" generative AI. The ones a mid-size company meets first are confabulation (confident, wrong answers), data privacy, information security, intellectual property and harmful bias. If your AI use is mostly chat assistants, this profile is the more practical half of NIST's work.
When do you need ISO/IEC 42001?
You need ISO/IEC 42001 when a customer asks for the certificate; until then, it's optional. UKAS, the UK's accreditation body, calls it "the world's first management system standard for artificial intelligence" and says it "provides a structured framework for organisations to govern the development and use of AI responsibly."
The difference from NIST is the audit. ISO/IEC 42001 is a standard you can be certified against, and certification is done by accredited certification bodies. The first UK accreditation for that work came on January 15, 2026, when UKAS accredited BSI. A certificate tells a customer that an outside auditor has checked your AI management system. NIST gives you no certificate at all.
That makes the decision commercial, not legal. If you sell to large companies or the public sector and their security questionnaires start asking about ISO/IEC 42001, plan for it. If they don't, build your framework on NIST's structure and keep the records you'd need later. Our guide to running an AI audit covers what an internal review checks, which is most of what a certification audit would look at too.
Does the EU AI Act apply to a US company?
It does if you have a place of business in the EU, or if the output of your AI is used in the EU, so check before assuming it doesn't. The act covers "deployers of AI systems that have their place of establishment or are located within the Union", and providers and deployers elsewhere where "the output produced by the AI system ... is used in the Union". A US company that uses AI to screen applicants for a role in Dublin is in scope for that use.
The act sorts AI into four risk levels. For the lowest, minimal or no risk, the European Commission says "the AI Act does not introduce rules", and it says most AI systems in use in the EU fall there. Much of what a mid-size company does with AI for internal drafting and summarizing carries few duties. The ones that bite are elsewhere.
AI literacy. The act's AI literacy duty has applied since February 2, 2025. Providers and deployers of AI systems must take measures to support the AI literacy of the staff who use AI on their behalf. It covers any AI system, not just high-risk ones.
High-risk uses. Employment is one of the high-risk areas. An amendment known as the AI Omnibus, in force since July 27, 2026, moved the start of the rules for these uses to December 2, 2027. From then, a company using a high-risk AI system as a deployer must, among other things:
- use it "in accordance with the instructions for use";
- assign human oversight to people "who have the necessary competence, training and authority";
- monitor how it runs;
- keep the logs it generates, where they're under your control, for "at least six months"; and
- tell workers' representatives and the affected workers before using it at the workplace.
Every one of those duties is easier with a framework already in place. Human oversight needs a named, trained owner (GOVERN 2.1). Monitoring and logs need a monitoring plan (MANAGE 4.1). Telling workers needs someone who knows which tools touch hiring and performance, which needs an inventory (GOVERN 1.6).
Do US laws reward having a framework?
Texas does, explicitly, and other state AI laws assume you know what AI you use and who owns it. The Texas Responsible AI Governance Act, in effect since January 1, 2026, says a defendant may not be found liable if it found the violation through "an internal review process" while it "substantially complies with the most recent version of the 'Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile' published by the National Institute of Standards and Technology or another nationally or internationally recognized risk management framework". Our guide to the Texas AI law covers the rest of the act.
No US law requires a private company to adopt NIST's framework. But the state laws on AI in hiring, such as New York City's Local Law 144, Illinois' HB 3773 and Colorado's SB 26-189, all start from the same question: which of your tools help decide who gets a job? A company with a current AI inventory can answer it in an afternoon.
A one-page AI governance framework template
Your first framework can fit on one page: eight sections, each mapped to a NIST subcategory above. Copy this, fill in the brackets, and have the leadership team sign it off. Keep it with your AI usage policy.
| Section | What to write | NIST reference |
|---|---|---|
| 1. Purpose and scope | "This framework covers every AI tool and AI feature used by [Company] staff, contractors and systems, including AI built into software we already buy." | GOVERN 1.4 |
| 2. Who decides | "[Role] approves new AI tools and uses. [Role] owns this framework and reviews it every [six] months. Decisions over [$ amount] or touching hiring, pay or customer data go to [the leadership team / AI council]." | GOVERN 2.1 |
| 3. Laws that apply | A list of the AI laws and contract terms that reach you, by state, country and use (hiring, health data, client data). | GOVERN 1.1 |
| 4. The AI list | "[Role] keeps a list of every AI tool and feature in use: what it does, who owns it, what data goes in, and its review date." | GOVERN 1.6 |
| 5. Approving a new use | "Before a new AI use goes live, its owner writes down what it's for, who it affects, what data it uses and what could go wrong. [Role] says go or no-go." | MAP 1.1 |
| 6. Vendors | "We read each vendor's data, retention and training terms before purchase, and recheck them at renewal." | GOVERN 6.1 |
| 7. Checking it works | "Each owner checks a sample of the tool's output against our output standard every [month / quarter] and records what they found." | MEASURE 1.1 |
| 8. Problems and the off switch | "Anyone can report an AI problem to [channel]. Each owner knows how to switch their tool off, and we test that once a year." | MANAGE 2.4, 4.1 |
Two things make the template work, and neither is on the page. Every bracket needs a real name or number, not "TBD". And section 4 needs to be true: a framework that governs the five tools IT approved, while staff use twenty, governs nothing.
A framework is only as good as its owner
Most frameworks fail in the same place. They're written once, approved, and filed, and the AI in use keeps changing underneath them. NIST asks for "the frequency of periodic review" to be decided as part of GOVERN (GOVERN 1.5). That one line does more than the rest of the document.
That's the gap our framework is built around. Its guardrails give staff the rules they need on day one: approved tools, a data map and a way to stop, tell, fix and learn when something goes wrong. Its "own" step puts an owner and a backup on every tool and review dates in the calendar. Those lessons produce sections 2, 4, 7 and 8 of the template above. If you're deploying AI across the company at the same time, build the governance as you go, not after.
How do you set up an AI governance framework?
01 · Make the AI list
Find every AI tool and AI feature in use, including the ones vendors switched on inside software you already pay for. The Shadow AI Audit does a first pass in about five minutes. The list tells you what the framework has to cover.
02 · List the laws that reach each use
For each item on the list, note the laws and contracts that apply: state hiring laws for anything that screens people, HIPAA for health data, client confidentiality for professional firms, and the EU AI Act if the output is used in Europe. This becomes section 3 of the template, and it tells you which uses need the strictest checks.
03 · Name who decides
Pick one person to approve new tools and uses, and decide what goes to the leadership team. At 200 people that's often a small AI council meeting monthly at first. Put an owner and a backup against every item on the list.
04 · Write the one page and the policy
Fill in the template above. Then write or update the staff-facing AI usage policy so it matches: same approved tools, same data rules, same place to report problems.
05 · Check, then review
Set the first review date before you publish. At each review, update the list, check a sample of each tool's output, test one off switch, and record what changed. If you need help running the first round, our AI governance work starts there.
What's still open
- NIST's revision. NIST says "the AI RMF 1.0 is being revised as part of the White House AI Action Plan." It hasn't said when the new version will be out or what will change. In April 2026 it also released a concept note for a profile on AI in critical infrastructure.
- The EU's high-risk start. The high-risk rules for uses such as hiring start on December 2, 2027, after one postponement already. A further prohibition, on non-consensual sexually explicit content, takes effect in December 2026.
- Customer demand for ISO/IEC 42001. Certification is new, and it isn't yet clear how often mid-size companies' customers will ask for it.
We'll update this article when NIST publishes its revised framework or the EU's high-risk guidance changes what deployers must do. The date at the top of the page shows when we last checked.
Sources
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, January 2023: the four functions, the role of GOVERN, the order of use, the note that actions aren't a checklist, the categories and subcategories (counted by us) and the subcategories quoted, including GOVERN 1.1, 1.4, 1.5, 1.6, 2.1 and 6.1, MAP 1.1, MEASURE 1.1 and MANAGE 2.4 and 4.1.
- AI Risk Management Framework, NIST, checked November 2026: the release date, voluntary status, the Generative AI Profile's release date, the April 2026 critical infrastructure concept note, and the statement that AI RMF 1.0 is being revised.
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, NIST, July 2024: the 12 risks unique to or exacerbated by generative AI.
- AI Act: regulatory framework for AI, European Commission, updated October 2026: the four risk levels, the statement that most AI systems in use are minimal or no risk, the application dates, the AI Omnibus and the December 2, 2027, start for Annex III high-risk uses including employment.
- House Bill 149, enrolled version, Texas Legislature, 2025: the defense that names NIST's Generative AI Profile, and the January 1, 2026, effective date.
- UKAS grants first AIMS accreditation, UKAS, January 2026: the description of ISO/IEC 42001 and the first UK accreditation of a certification body for it. iso.org refused automated access, so we relied on this page.
- Article 2: Scope, Article 4: AI literacy and Article 26: Obligations of deployers of high-risk AI systems, EU AI Act Explorer (secondary, a reproduction of the act's text), checked November 2026: who the act covers outside the EU, the AI literacy duty as amended, and the deployer duties quoted.
- OECD AI Principles, OECD, checked November 2026: the five values-based principles, adopted in 2019 and updated in May 2024.