To start an AI governance framework, name one accountable owner, inventory every AI system and tool in use, write a short usage policy, and rank risks using a recognized framework such as the NIST AI RMF. Do these four steps first, then add reviews and metrics.
Key takeaways
- Begin with an inventory. You cannot govern AI you do not know about.
- Use an existing framework instead of inventing one. NIST AI RMF is voluntary and free.
- Keep the first policy to one or two pages people will read.
- Tie governance to the dates that apply to you, such as EU AI Act obligations.
What is an AI governance framework?
An AI governance framework is the set of roles, policies and checks that decide how your organization builds, buys and uses AI. NIST released its AI Risk Management Framework on 26 January 2023 as voluntary guidance, organized into four functions: Govern, Map, Measure and Manage. NIST also published a Generative AI Profile on 26 July 2024.
What should you do in week one?
Name an owner and take inventory. Pick one person who answers for AI risk, even if it is a part-time role. Then list every AI tool staff use, every model your product calls, and every vendor that processes your data with AI.
Our AI bill of materials explainer shows how to record models and datasets in a standard format.
What should you do in week two?
Write the policy. Keep it short: approved tools, banned data types, review rules and who to ask. See how to write an AI acceptable use policy.
What should you do in weeks three and four?
Rank risks, then set review gates. For each system, note what data it touches, what it can do, and who is affected. Use the NIST AI RMF functions as headings. Add a lightweight review before any new AI system goes live, and a place to record decisions.
If you sell into the EU, check the dates in our EU AI Act checklist for startups.
A starter checklist
- Owner named and written down.
- Inventory of AI tools, models and vendors.
- Acceptable use policy published to staff.
- Risk register with owner and next review date.
- Pre-launch review for new AI features.
- Training for staff who use AI.
The interactive risk register demo shows how entries can be recorded and reviewed.
Frequently asked questions
Do small companies need an AI governance framework?
If you use or ship AI, you need some governance, but it can be small. A policy, an inventory and an owner are enough to start.
Is NIST AI RMF mandatory?
No. NIST describes it as intended for voluntary use.
What is the difference between governance and security?
Governance decides who may do what and which risks are accepted. Security tests and protects the systems.
Who should own AI governance?
One named person with authority across engineering, legal and security, supported by a small review group.
Sources
Last reviewed: 19 October 2026.
