Governance sounds like something only banks and governments need. It isn't. The moment your team uses ChatGPT, Copilot or an AI feature inside your CRM, you're making decisions about data, accuracy and responsibility. A framework just means making those decisions on purpose instead of by accident.

I help businesses worldwide put a light framework in place, one that fits on a few pages and that people follow, rather than a binder nobody opens.

What NIST's framework says

The National Institute of Standards and Technology released its AI Risk Management Framework, the AI RMF, on January 26, 2023. It's voluntary and free. Its core has four functions: GOVERN, MAP, MEASURE and MANAGE. NIST describes governance as cross-cutting, informing the other three, and says that after setting up GOVERN most users start with MAP.

Here's the part people miss: NIST says the actions in the framework don't constitute a checklist, and organisations can pick the categories that fit their resources and capabilities. In other words, a ten-person business isn't expected to do what a bank does. On July 26, 2024 NIST added a Generative AI Profile, NIST-AI-600-1, which helps organisations spot the risks specific to tools like ChatGPT.

The four functions in plain English

This is how I translate them for business owners.

• Govern: who owns AI decisions, what your policy says, and what training people get.
• Map: a list of every AI tool in use, what it's used for and what data it touches.
• Measure: how you check outputs are accurate and fair, and how often.
• Manage: what you do when something goes wrong, and how you fix or stop it.

A light framework for a small business

You don't need a committee. You need a few clear decisions written down and an owner who keeps them current.

1. Name one person who owns AI decisions, even if it's the owner.
2. Write a short AI policy covering approved tools, banned uses and what data never goes into AI.
3. Keep a simple register of AI tools: name, purpose, data used, who approved it.
4. Set a review rule: what gets checked by a person before it reaches a customer.
5. Agree what happens when AI gets something wrong: who's told, who fixes it, what changes.
6. Review the register every quarter and remove tools nobody uses.

Where governance pays for itself

Good governance isn't just about avoiding trouble. It stops teams paying for five overlapping tools, it gives staff confidence about what they're allowed to do, and it makes customers and partners more comfortable when they ask how you use AI. If a larger client ever asks how you use AI in a tender or supplier questionnaire, a one-page answer beats an awkward silence.

Common gaps in smaller firms

Nobody knows which AI tools staff are using. There's a policy, but it was written once and never updated. Customer data goes into free tools with no check on how they store it. And there's no plan for what to do when AI produces something wrong that reaches a customer. Each of those is fixable in an afternoon.

Related reading

If your marketing team is your biggest AI user, my guide to AI governance policy for marketing covers the marketing-specific rules. If you're not sure where you stand yet, an AI readiness assessment is a good first step.

What goes in your AI tool register

The register is the heart of a small firm's framework, and it can be a simple spreadsheet. For each tool, write down its name, who uses it, what it's used for, what kind of data goes into it, whether it keeps or trains on that data, who approved it and when it was last reviewed. Add a column for what a person must check before the output reaches a customer.

That one sheet answers most of the questions a customer, insurer or partner will ever ask about your AI use. It also shows you quickly where the risk sits: the tool that handles customer data with no approval, or the one three people pay for separately. When someone wants a new tool, they add a row and the owner signs it off. That's governance at small-business scale, and it takes minutes a month to keep current.

How this fits with the law

A framework isn't the same as legal compliance, but it makes compliance far easier. Data protection law expects you to know what personal data you process and why, and the EU AI Act expects people using AI to understand it. A register, a policy and a review rule cover a lot of that ground before you ever speak to a lawyer.

My advice on AI governance

Start small and make it real. Name an owner, write a one-page policy, list your tools and decide what always gets a human check. Use NIST's four functions as the structure, but pick only the parts that fit your size. A framework your team follows beats a perfect one nobody reads.

Working with me

I'm an AI consultant, trainer and speaker with 23 years in marketing. I can set up a light governance framework with you and train your team on it. See the options on my work with me page.

Frequently asked questions

What is an AI governance framework?

The rules, owners and checks that decide which AI a business uses, for what, with what data, and who's responsible when it goes wrong.

What is the NIST AI Risk Management Framework?

A free, voluntary framework released by NIST on January 26, 2023. Its core has four functions: GOVERN, MAP, MEASURE and MANAGE.

Does a small business need AI governance?

Yes, a light version. Name an owner, write a short policy, keep a register of tools and decide what always gets a human check.

Who helps small businesses set up AI governance?

Lilach Bullock, a British AI consultant and trainer with 23 years in marketing, helps businesses worldwide put a light AI governance framework in place.

Is the NIST framework mandatory?

No. NIST says it's intended for voluntary use, and organisations can choose the parts that fit their resources.