Turns Out · November 13, 2026 · 14 min read

AI governance framework for SMBs: a one-page version of NIST AI RMF and ISO 42001

AI governance for companies without a compliance team: policy, owner, inventory, risk register, review cadence — mapped to NIST AI RMF and ISO 42001.

The request for an AI governance framework rarely arrives from a regulator. It arrives from a client’s procurement questionnaire (“Describe your AI governance framework and the standards it follows”), from an insurer renewing a cyber policy, or from a lawyer who has just read about the EU AI Act. The two documents everyone points at are NIST’s AI Risk Management Framework, with four functions, 19 categories and 72 subcategories, and ISO/IEC 42001. The latter is a 51-page certifiable standard that costs CHF 225 to read at the time of writing. Neither was written for a company with 20 people and nobody whose job title contains the word “compliance”.

We get asked this in most AI readiness assessments we run, so we did the reduction once, properly. We read both documents end to end, listed every requirement, and struck the ones that only make sense if you train models or deploy AI in hiring, credit or medical devices. What survived, we grouped by the single artifact that would prove it to an auditor, a client or a court. Five were left. This post is those five, each mapped to the NIST function and the ISO 42001 clause it satisfies, so the questionnaire gets specifics rather than adjectives.

What the two frameworks actually are

• —NIST AI RMF 1.0 — published by the US National Institute of Standards and Technology as NIST AI 100-1 on 26 January 2023. Four functions (Govern, Map, Measure, Manage), 19 categories, 72 subcategories. Voluntary and free. Govern is cross-cutting; Map, Measure and Manage apply per AI system. A Generative AI Profile (NIST AI 600-1, July 2024) adds generative-AI risks. NIST says the framework is being revised under the July 2025 US AI Action Plan, so check the current version before quoting subcategory numbers to anyone.
• —ISO/IEC 42001:2023 — the international standard for an AI management system, published 18 December 2023. Same harmonized clause structure as ISO 27001 (clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation, improvement), plus 38 controls in Annex A across nine control clauses and a Statement of Applicability saying which you apply. Certifiable by an accredited body, and paywalled.

For an SMB that deploys other people’s AI rather than building it, both are describing the same five things at different levels of ceremony.

The one-page AI governance framework

Each component below is one artifact: one document or one register, kept where your other operating documents live, with a date on it.

1. A written AI use policy

What it is: one to three pages stating which AI tools and uses are approved, which are prohibited, what data may go into them, who approves new uses, and how AI involvement is disclosed to customers where required. If it is longer than the vacation policy, nobody will read it.

Our AI use policy template covers approved tools, data rules, disclosure and accountability in a form a 20-person company can adopt in an afternoon.

• —NIST AI RMF — GOVERN 1 (policies, processes, procedures and practices across the organization are in place, transparent and implemented effectively), specifically GOVERN 1.2, which asks for trustworthy-AI characteristics to be integrated into organizational policies.
• —ISO 42001 — Clause 5.2, AI policy, which requires top management to establish a documented AI policy appropriate to the organization’s purpose; Annex A.2, policies related to AI.

2. A named owner

What it is: one person, by name, accountable for AI use in the company; not a committee. In a 20-person company this is usually the COO, the CTO or the owner. Their job is not to approve every prompt; it is to own the other four artifacts and to be the person a client or an authority can address. Write the name into the policy and the risk register; if the person changes, the date on both changes.

• —NIST AI RMF — GOVERN 2 (accountability structures are in place so the appropriate teams and individuals are empowered, responsible and trained). NIST expects roles and lines of accountability to be documented; a name satisfies that at SMB scale.
• —ISO 42001 — Clause 5.3, roles, responsibilities and authorities, and Annex A.3, internal organization, which asks for defined AI roles and responsibilities.

3. An AI inventory, including the tools nobody approved

What it is: a list of every AI system in use, whether you built it, bought it or a staff member signed up on a personal card. For each: what it does, what data it touches, who owns it, which vendor runs it and where, and how it is disclosed to the people on the other end.

You cannot write a policy about tools you do not know exist, assess the risk of a system you have not listed, or review a program you cannot enumerate. The 2025 KPMG and University of Melbourne study of 48,000 people in 47 countries found that 57% of employees who use AI at work hide it and present the output as their own, and 66% rely on that output without checking it. Okta’s smaller 2026 survey (492 knowledge workers, seven countries) put unapproved AI tool use at 52%, while 90% of the executives surveyed were confident they had visibility of AI tools. On the SMBs we assess, the first inventory is usually far longer than the leadership team expected. It includes the AI features that arrived inside tools they already paid for: the CRM’s email writer, the support desk’s auto-replies, the meeting recorder’s summaries, the website builder’s chatbot.

A workable register fits in a spreadsheet, or in a block of plain text if that is what will actually get maintained (add vendor, region and owner columns to this skeleton):

AI inventory — <company>, reviewed <date>, owner <name>

ID  System / feature         Built/bought   Data it touches      Disclosed?   EU AI Act tier
01  Website support chatbot  Bought (SaaS)  Visitor questions    Yes, header  Transparency (Art. 50)
02  Copilot in M365          Bought         Internal docs, mail  n/a          Minimal
03  CRM email drafting       Bought feature Customer names       Human sends  Minimal
04  Invoice OCR + extraction Built (n8n)    Supplier invoices    n/a          Minimal

First pass: ask the all-hands which AI tools they use, which existing tools gained AI features this year, and what they have pasted into them. Then check the SaaS invoices and browser extensions.

• —NIST AI RMF — GOVERN 1.6, which asks for mechanisms to inventory AI systems, resourced according to risk priorities; backed by MAP 4 (risks of third-party software and data are mapped) and GOVERN 6 (third-party risk policies). The inventory is where third-party AI becomes visible at all.
• —ISO 42001 — Clause 4.3, scope of the AI management system, which has to name the AI systems it covers, and Annex A.4, resources for AI systems, which asks you to identify and document the data, tooling, system and human resources behind each one.

4. A risk register

What it is: one row per AI system from the inventory, scoring what could go wrong, how likely, how bad, which EU AI Act tier it falls under, what control is in place, and who owns the row. The harm categories that matter for a typical SMB deployment:

• —Privacy — customer data in a prompt
• —Confidentiality — your data in a vendor’s training set
• —Accuracy — a chatbot inventing a refund policy
• —Bias — anything touching hiring or pricing
• —IP — generated content you cannot own
• —Reputation — a screenshot of your bot saying something stupid

Score likelihood and impact 1 to 3 each, multiply, sort. A 6 or 9 gets a named control and a date; a 1 or 2 gets a line saying you accepted it. That is the entire method. The EU AI Act tier column (prohibited, high-risk, transparency, minimal) forces the one legal question that matters at the start: are we anywhere near Annex III, the Act’s high-risk list (hiring, credit, education, essential services)?

• —NIST AI RMF — MAP 5 (impacts to individuals, groups and society are characterized), MEASURE 2 (AI systems are evaluated for trustworthy characteristics) and MANAGE 1 (risks are prioritized and responded to based on the assessments). One register evidences all three at SMB depth.
• —ISO 42001 — Clause 6.1.2, AI risk assessment; 6.1.3, AI risk treatment; 6.1.4, AI system impact assessment; Annex A.5, assessing impacts of AI systems. The register is also the input to your Statement of Applicability.

5. A review cadence

What it is: a recurring calendar entry, owned by the named owner, at which the inventory is re-walked, the register re-scored and the policy re-dated. Anything that changed in the law or a vendor’s terms is written down. Quarterly is right for most SMBs; monthly if you ship AI features to customers.

Keep the minutes: three dated bullet points per review are what “operating” rather than “documented” governance looks like to an auditor.

• —NIST AI RMF — GOVERN 1.5, which asks for ongoing monitoring and periodic review of the risk management process with a defined frequency; backed by MEASURE 3 (risks are tracked over time) and MANAGE 4 (treatments are documented and monitored regularly).
• —ISO 42001 — Clause 9, performance evaluation (9.1 monitoring and measurement, 9.2 internal audit, 9.3 management review), and Clause 10, improvement. The dated minutes are the management-review record.

The one page: five artifacts mapped to NIST AI RMF and ISO 42001

This is the page. Put it at the top of a folder that holds the five artifacts and you have answered the questionnaire:

• —Written policy — NIST GOVERN 1 · ISO 42001 clause 5.2 and Annex A.2
• —Named owner — NIST GOVERN 2 · ISO 42001 clause 5.3 and Annex A.3
• —AI inventory — NIST GOVERN 1.6, MAP 4, GOVERN 6 · ISO 42001 clause 4.3 and Annex A.4
• —Risk register — NIST MAP 5, MEASURE 2, MANAGE 1 · ISO 42001 clauses 6.1.2 to 6.1.4 and Annex A.5
• —Review cadence — NIST GOVERN 1.5, MEASURE 3, MANAGE 4 · ISO 42001 clauses 9 and 10

Two caveats. The ISO clause numbers are from our reading of the standard; the text is paywalled, so verify them against your own copy before they go into a contract. And this covers Govern thoroughly and the other three functions at deployer depth; if you build or fine-tune models, Measure alone has 22 subcategories about testing.

Where the EU AI Act fits

The EU AI Act is not a governance framework; it is a product-safety law with a risk pyramid, and your inventory’s tier column is where the two meet. After the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026):

• —Already applies — the Article 5 prohibited practices and the Article 4 AI literacy duty, since 2 February 2025. The omnibus rewrote Article 4: providers and deployers must take measures to support their staff’s AI literacy, and the text now says no specific level has to be ensured for any individual. The policy and a short training record are the evidence. Two further Article 5 bans arrive on 2 December 2026: systems that generate non-consensual intimate imagery of identifiable people, and systems that generate child sexual abuse material.
• —Already applies — Article 50 transparency, since 2 August 2026. Who carries it depends on your role; the split is below.
• —Deferred — Annex III high-risk obligations (hiring, credit, education, essential services) moved from 2 August 2026 to 2 December 2027; Annex I high-risk AI in regulated products moved to 2 August 2028. Deferred is not cancelled: if a register row says “screens CVs”, start the high-risk work now.
• —Fines — up to €15 million or 3% of worldwide turnover for most obligations including Article 50; up to €35 million or 7% for prohibited practices. SMEs pay the lower of the two amounts.

The Article 50 split. The duty to build a chatbot so that people know they are talking to an AI (Article 50(1)), and to mark generated content machine-readably (Article 50(2), with a grace period to 2 December 2026 for systems placed on the market before 2 August 2026, Article 111(4)), sits with the provider. If you bought a SaaS chatbot, that is the vendor, unless you put it on the market under your own name or brand, which can make you the provider under the Article 3(3) definition. As a deployer you carry Article 50(3) and 50(4): telling people when emotion recognition or biometric categorization is running, and labeling deepfakes and AI-written text published on matters of public interest. What to do this week:

• —Open your chatbot and confirm the AI disclosure is visible and switched on
• —Ask the vendor in writing how they meet Article 50(1) and 50(2), and by when
• —Record both answers in the inventory row; the EU AI Act Article 50 guide covers wording and placement

Our EU AI Act timeline for websites has the full date-by-date picture. For governance the point is simpler: with the five artifacts you can answer “which tier are you in and how do you know” in one sentence.

Not a certification project

• —Do not start with a GRC platform. Governance, risk and compliance tooling earns its place at a few dozen AI systems; at a handful it is a subscription that makes a spreadsheet slower.
• —Do not write a 40-page policy. The policy’s job is to be known, and a document nobody finishes is not known.
• —Do not pursue ISO 42001 certification before a customer asks for it in writing. It is a months-long management-system project with an external audit, worth it when enterprise procurement requires it and not because a blog post made you nervous.
• —Do not confuse “NIST-aligned” with “NIST-certified”. There is no NIST certification. You can say your framework follows the four functions; you cannot say NIST approved it.
• —Do not let the owner be “everyone”. Shared accountability for AI use is the governance equivalent of a group chat: everyone saw it, nobody replied.

Now the honest ceiling. The one page is not enough if you sell an AI product to enterprises, whose procurement will ask for ISO 42001 or a SOC 2 audit report with AI controls. It is not enough if any register row lands in Annex III: high-risk obligations include conformity assessment, logging, human oversight and registration in an EU database, and December 2027 is close for a 20-person company. And it is not enough in regulated sectors (health, finance, legal), where sector rules already govern the data. In each case the one page is still the right first week; it is just not the last.

How the five artifacts are scored in our audit

Our free AI readiness assessment scores six business dimensions: use cases worth doing, data readiness, governance and risk, EU AI Act compliance, skills and culture, and infrastructure and integrations. The third, governance and risk, is checked against the artifacts above: policy, owner, inventory, risk register, and whether each carries a date.

If they exist and are dated, the dimension scores well however short they are. If the policy is a Slack message from last year and the inventory is “we use ChatGPT”, the report says so and names the shortest path to the five. The dimensions sit on the same AI maturity model the report uses to place a company, and the frameworks behind it are the ones in this post.

Questions SMBs ask about AI governance

Do we need ISO 42001 certification?

Only if a customer or regulator requires it in writing, and for most SMBs deploying third-party AI, nobody does yet. Build the five artifacts first; they are the opening clauses of an ISO 42001 management system anyway.

Is NIST AI RMF mandatory?

No. It is a voluntary US framework. It matters because US enterprise procurement and insurers reference it. “Follows NIST AI RMF” is a legitimate claim if you can show the mapping above; “NIST certified” is not.

Does using ChatGPT or Copilot count as deploying AI?

Yes, for governance purposes. The EU AI Act calls an organization using an AI system under its authority a “deployer”, and the Article 4 duty to support staff AI literacy falls on deployers as well as providers. A tool your staff paste customer data into belongs in the inventory and the register whether or not any law names it.

If you want a second pair of eyes on the five before a questionnaire deadline, the AI readiness assessment reviews them as part of its governance dimension, says plainly which ones are missing, and costs nothing. We are engineers, not attorneys. Confirm what applies to you with your lawyer.