What is an AI governance framework?
An AI governance framework is the management system behind your AI policy: it says who can approve an AI tool or use, what has to be recorded, how risks are checked and when decisions are revisited. The acceptable use policy tells employees what to do; governance decides what goes into that policy and keeps it accurate.
Most published frameworks are written for large organisations that build AI systems. A company of 5 to 200 people that uses off-the-shelf assistants needs the same logic at a much smaller scale. The aim is that every approved use has an owner, a reason and a review date, and that nobody has to guess who decides.
This page is general information, not legal advice. If you build AI into products, automate decisions about people or work in a regulated sector, you need specialist review beyond what is described here.
How does the NIST AI Risk Management Framework apply to a small company?
The NIST AI Risk Management Framework is a voluntary framework, released on 26 January 2023, that organises AI risk work into four functions: Govern, Map, Measure and Manage. NIST says it is intended to be voluntary, non-sector-specific and use-case agnostic, giving flexibility to organisations of all sizes. It also says users may select from its categories according to their resources and capabilities, which is exactly what a small team should do.
Govern is cross-cutting: culture, policies, roles and accountability. Map establishes the context in which a system is used and the risks in that context. Measure analyses and monitors those risks with qualitative or quantitative methods. Manage allocates resources to the risks found and covers plans to respond to and recover from incidents. NIST's page notes the framework is being revised, so check the current version before quoting it.
The table below is our small-team adaptation. It is not an official NIST profile and using it does not make a company compliant with anything.
| NIST function | What it means for a 30-person company | Concrete artefact |
|---|---|---|
| Govern | Name an owner, write the policy, train staff, decide who approves new uses | Policy with owner names, training record |
| Map | For each AI use, write down the task, the information involved and who is affected by an error | One row per use in the register |
| Measure | Spot-check outputs, collect reported problems, check vendor terms on a schedule | Review notes and an issue log |
| Manage | Approve, restrict or retire uses based on what you found; respond to incidents | Updated register and incident notes |
Who should own AI governance in a small business?
One named person should own AI governance, with clear sign-off for the decisions they cannot make alone. In practice that is often the founder or chief operating officer in a company under 50 people, and an operations or IT lead reporting to leadership in a larger one. NIST's Govern guidance includes executive leadership taking responsibility for decisions about AI risks, and defined roles and lines of communication.
A workable split for a fictional 60-person software company, Kestrel Systems: the operations director owns the register and approves new tools; the person responsible for data protection signs off any use involving personal data; each department head approves workflows and reviews outputs in their area; the managing director signs off the annual review. Four names cover everything, and each person knows which question is theirs.
Owner
Keeps the register, runs reviews, is the first point of contact. One named person and a backup.
Data sign-off
Approves any use involving personal information and decides whether an impact assessment is needed.
Workflow approvers
Department heads who know the work, approve uses in their area and name the reviewer for outputs.
Leadership
Accepts the overall level of risk and signs off the annual review.
What should an AI register record?
An AI register should record each approved tool and use, with the plan, the permitted task, the information allowed, the owner, the reviewer and the review date. NIST's Govern guidance includes mechanisms to inventory AI systems, resourced according to risk priorities; for a small company a shared spreadsheet is enough.
Record third-party details too, because almost every AI system a small company uses belongs to a vendor. NIST's Govern material covers policies for third-party AI risks and contingency processes when third-party systems fail. In register terms: what the vendor's terms say about training, retention and deletion, when you last checked, and what you would do if the tool became unavailable or changed its terms.
Example row for Kestrel: "Tool: [assistant] business workspace. Use: drafting internal documents and summarising public research. Information: public and internal only. Owner: operations director. Reviewer: author's line manager for anything external. Vendor terms checked: [date]. Fallback: drafting without AI. Next review: [date]."
Want to see how this connects to a role?
Explore the planned team trial ↗How should a new AI use be approved?
A new AI use should be approved through a short written request that answers five questions, so the owner can decide quickly and the decision is recorded. Most requests in a small company are low-risk and should take a day, not a committee meeting. A slow route encourages people to skip it.
Kestrel's request form is five lines long. If any answer involves personal data or a decision about a person, it goes to the data sign-off before approval.
Tool and plan
Which exact product and account would be used?
Task
What work would it do, and who would use it?
Information
Which classes of information would go in?
Consequence of error
Who is affected if the output is wrong, and how badly?
Review
Who checks the output before it is used?
What principles should an AI governance policy rest on?
There is no single agreed list of AI governance principles; different frameworks use different ones, so choose a short set your team can apply. NIST lists characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. The UK government's AI Playbook, published in February 2025 for civil servants, sets out ten principles, starting with knowing what AI is and what its limitations are, and including meaningful human control at the right stages.
For a small business, three working principles usually cover the ground: every use has a named owner; information goes only where it is allowed; and a person checks and takes responsibility for any output that is used. If a proposed use cannot meet all three, it is not ready to approve.
People sometimes ask about the three pillars of AI governance. There is no standard set. A practical way to think about it is people (who decides and who is trained), process (how uses are approved and reviewed) and records (the register and the decisions in it).
How often should AI governance decisions be reviewed?
Review the whole register at least once a year, and individual entries whenever a vendor changes its terms, a plan changes, a client contract adds AI terms or a reported issue shows a workflow is not working. NIST's Govern guidance covers ongoing monitoring and periodic review of the risk management process.
A quarterly half-hour is often enough for a small company: the owner reads the issue log, checks two or three vendor terms, asks department heads whether any use has changed and retires anything nobody uses. Retiring unused tools is part of governance; NIST's Govern guidance includes processes for decommissioning AI systems safely.
Where does training fit in AI governance?
Training is the part of governance that makes the rules usable. NIST's Govern guidance includes personnel receiving AI risk management training. For the EU, the European Commission's AI literacy Q&A on Article 4 of the AI Act says there is no one-size-fits-all approach, certificates are not required, and an internal record of training is enough.
Record who has been trained on what, and make the training about the tasks people actually do. Tosheo.ai is being built to provide role-based practice with a manager view of skill progress and completion; it is not a governance platform and does not keep your register.
When does a small company need more than this?
You need more than a lightweight framework if you develop AI systems, put AI into a product, use AI to make or support significant decisions about people, process special-category data at scale or work in a regulated sector. Those cases may need formal risk or impact assessments, certifiable management systems and legal review.
Dedicated AI governance software exists, mostly aimed at larger organisations. For a team using a handful of assistants, a spreadsheet register, a short policy and a review date are usually enough, and they are easier to keep current.
Sources and scope
NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), January 2023 ↗
NIST, AI Risk Management Framework overview page, checked 16 October 2026 ↗
NIST AI RMF Playbook: Govern, checked 16 October 2026 ↗
GOV.UK, AI Playbook for the UK Government, 10 February 2025 ↗
European Commission, AI Literacy - Questions and Answers, last updated 27 July 2026 ↗