One page. Six parts. Aligned to NIST AI RMF & ISO/IEC 42001.
- Six parts
- One-page template
- Aligned to NIST AI RMF & ISO/IEC 42001
An AI governance framework is a short set of roles, rules, and reviews that decides which AI tools your business uses, what data they can touch, and who checks the results. For a small business, it can fit on one page: an owner, an AI inventory, data rules, a risk check, human oversight, and a regular review.
Key takeaways
- A small-business AI governance framework can fit on one page with six parts.
- The NIST AI RMF is free, voluntary guidance built on four functions: Govern, Map, Measure, Manage.
- ISO/IEC 42001 is the international AI management system standard and applies to organizations of any size.
- Start with an owner and an AI inventory, then add data rules, risk checks, human review, and a quarterly review.
You do not need a compliance department to do this. You need clear answers to a few questions, written down, and revisited when something changes.
This guide gives you a six-part framework you can adopt this month. It is aligned to the two frameworks most people ask about: the NIST AI Risk Management Framework and ISO/IEC 42001.
Want help turning this one-page framework into practice?
Talk with JR Secure Design.
What is an AI governance framework?
An AI governance framework is the structure an organization uses to make sure AI is used safely, legally, and in line with its goals.
It covers decisions (who approves a new AI tool), rules (what data can go into it), and checks (how you know it is working as intended).
Two public frameworks shape most of the conversation:
- NIST AI Risk Management Framework (AI RMF 1.0). Released by NIST on January 26, 2023, it is “intended for voluntary use” and organizes AI risk work into four functions: Govern, Map, Measure, and Manage (NIST). NIST also publishes a free AI RMF Playbook with suggested actions, and a Generative AI Profile (NIST AI 600-1) for tools like ChatGPT and Copilot.
- ISO/IEC 42001:2023. The international standard for an AI management system. ISO says it specifies requirements for “establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System,” for organizations “of any size” that develop, provide, or use AI (ISO). It uses the familiar Plan-Do-Check-Act cycle.
WARNING: “Aligned to” is not “certified.” The framework below borrows the structure of both. It is aligned to them, not a substitute for formal audit work. NIST AI RMF is voluntary and has no certification, and NIST notes AI RMF 1.0 is being revised, so check the NIST page for updates.
It is sized for a business with a handful of AI tools rather than a data science team.
Why small businesses need one (even a simple one)
Most small businesses already use AI, whether they planned to or not. Think ChatGPT for drafting, Copilot inside Microsoft 365, AI note-takers in meetings, and AI features inside the accounting, CRM, and HR tools they already pay for.
Without a framework, three things tend to happen:
- Nobody knows the full list of AI tools in use. That is the classic “shadow AI” problem; see 5 signs shadow AI is already in your company.
- Sensitive data goes where it should not. Client files and financials end up in personal AI accounts.
- Nobody owns the outcome. When an AI tool gets something wrong, there is no process to catch it or fix it.
Clients, insurers, and larger partners are also starting to ask how you manage AI. A one-page framework gives you a clear, honest answer.
QUICK CHECK: Can you name every AI tool your team used this week, and who approved each one? If not, start with Step 2 (the AI inventory) today.
The 6-part AI governance framework for small businesses
Each part lists what to do and which NIST AI RMF function it supports. Govern is the cross-cutting function; NIST describes it as “infused throughout” the other three (NIST AI RMF 1.0).
Step 1: Name an owner and decision rights (Govern)
- Pick one accountable AI owner. In a small business, that is often the owner, COO, or office manager, with your IT provider as advisor.
- Decide who can approve a new AI tool, and who must be consulted (finance for payment tools, HR for hiring tools).
- Write down how staff ask for a new tool and how quickly they will get an answer. A fast “yes, with conditions” beats a slow “no” that drives people to shadow AI.
Step 2: Keep an AI inventory (Map)
List every AI tool and AI feature in use, including ones built into software you already have. For each, record:
- Tool and plan (business or personal account)
- Who uses it and for what
- What data it can see or receive
- Whether it connects to other systems or can take actions (send email, move files)
- Owner and review date
Step 3: Set data rules and an approved tools list (Govern / Manage)
- Classify data simply: Public, Internal, Sensitive (client records, financials, HR, health, legal, passwords).
- State which tools may receive which class. Public AI tools get Public data only. Approved business AI tools may get Internal.
- Sensitive data only goes into tools with contracts and controls you have reviewed, or a private AI deployment.
- Put this in a short AI Acceptable Use Policy that every employee signs.
Step 4: Check risk before and after you adopt a tool (Map / Measure)
For each tool or new use case, ask a few questions and score the answers simply (low, medium, high):
- What happens if it is wrong? (A typo in a social post is low; a wrong number in a client invoice is high.)
- What happens if its data leaks?
- Could it be manipulated, for example through prompt injection in emails or documents it reads?
- Does it make or influence decisions about people (hiring, lending, pricing)?
NIST’s Generative AI Profile lists risks to consider, including confabulation (confidently wrong answers), data privacy, information security, and intellectual property (NIST AI 600-1).
Step 5: Keep a human in the loop where it matters (Manage)
- Require human review before AI output goes to a client, moves money, or affects a person’s job or account.
- Do not let AI agents send email, share files, or make payments without an approval step.
- Turn on sign-in controls (SSO, MFA) and logging for every approved AI tool.
Step 6: Monitor, handle incidents, and review quarterly (Measure / Manage)
- Decide what counts as an AI incident (data pasted into the wrong tool, a harmful or wrong output sent to a client) and who to tell.
- Review the inventory, policy, and risk scores every quarter, and whenever you add a major tool.
- Keep short notes of each review. This is the “Check” and “Act” in ISO/IEC 42001’s Plan-Do-Check-Act cycle, and it is the evidence clients and insurers ask for.
Need help putting the six parts in place?
We can walk through it with you.
One-page AI governance framework template
Copy this into a document and fill it in:
Your one-page AI governance framework
| Section | What to write | Example |
|---|---|---|
| AI owner | Name, role, backup | Office manager; owner as backup |
| Approval process | Who approves, how to request, response time | Request by email; answer within 5 business days |
| AI inventory | Tool, plan, users, data, connections, review date | ChatGPT Business; sales team; Internal data; no connectors |
| Data rules | Which data classes go into which tools | Sensitive data: private AI only |
| Risk check | Low / medium / high per use case, and why | Client proposals: medium (human review required) |
| Human oversight | Which outputs need review; which actions need approval | All client-facing output reviewed |
| Incidents | What counts, who to tell, first steps | Tell AI owner same day; revoke access; document |
| Review cadence | Quarterly date, plus triggers | First week of each quarter; any new AI tool |
How this maps to NIST AI RMF and ISO/IEC 42001
Our framework → NIST AI RMF → ISO/IEC 42001
| Framework part | NIST AI RMF function | ISO/IEC 42001 idea |
|---|---|---|
| Owner and decision rights | Govern | Leadership, roles, AI policy |
| AI inventory | Map | Context of the organization, scope |
| Data rules and approved tools | Govern / Manage | AI policy, controls |
| Risk check | Map / Measure | AI risk and impact assessment |
| Human oversight | Manage | Operational controls |
| Monitor and review | Measure / Manage | Performance evaluation, improvement |
Aligned to, not certified. Detailed mapping: NIST AI RMF to ISO/IEC 42001 crosswalk
For a detailed mapping, NIST publishes an official AI RMF to ISO/IEC 42001 crosswalk.
If you later pursue a formal ISO/IEC 42001 audit, this simple framework is a practical starting point, but it is not the same as completing one.
For the security side of AI (access controls, deepfake fraud, and assessments), see our guide to AI security for small business.
Frequently asked questions
What is an AI governance framework?
An AI governance framework is the set of roles, rules, and reviews an organization uses to manage AI safely. It defines who approves AI tools, what data they can use, how risks are checked, where humans must review output, and how often the whole setup is reviewed.
What does an AI governance framework look like?
For a small business, it can be one page: a named AI owner, an inventory of AI tools, data rules and an approved tools list, a simple risk check, human-review rules, and a quarterly review. Larger organizations add committees, formal audits, and detailed procedures.
How do you build an AI governance framework?
Start by naming an owner and listing every AI tool in use. Then set data rules, write a short AI acceptable use policy, score each use case’s risk, decide where human review is required, and schedule a quarterly review. Align it to the NIST AI RMF functions.
Is NIST AI RMF or ISO/IEC 42001 better for a small business?
They work together. The NIST AI RMF is free, voluntary guidance organized into Govern, Map, Measure, and Manage. ISO/IEC 42001 is a formal management system standard. A practical path is to start with NIST’s structure and treat ISO/IEC 42001 as a later goal.
Is there an AI governance framework for nonprofits?
Yes. The same six parts work for nonprofits, with the board usually approving the AI policy and reviewing it yearly. ISO notes that ISO/IEC 42001 applies to companies, non-profits, and public sector agencies of any size.
Do small businesses need an AI governance framework?
If your team uses any AI tools, a simple framework is worth having. It reduces data leaks and costly mistakes, and it gives clients, partners, and insurers a clear answer when they ask how you manage AI.
Talk to JR Secure Design
Want help turning this one-page framework into practice?
JR Secure Design Inc. helps small businesses and nonprofits put practical AI governance in place, aligned to the NIST AI RMF and ISO/IEC 42001. James DeCrescenzo brings 25+ years of experience, based in Fort Lauderdale, FL, and working with clients nationwide (remote).
Or email sales@jrsdi.com.
Related reading: AI Governance & Compliance for SMBs · AI Governance for Small Business · What Is Prompt Injection? · AI Security for Small Business · 5 Signs Shadow AI Is in Your Company · Private AI Infrastructure for Business · Is ChatGPT Safe for Business? · JR Secure Design home