AI governance frameworks explained for small organizations

An AI governance framework is a published model for deciding who is responsible for AI use, which tools are allowed and how you check that they behave. A small organization does not need to adopt one in full. Borrow the structure of the free NIST AI RMF, add a short policy and an approved tools list, and pursue ISO/IEC 42001 certification or EU AI Act work only if your situation calls for it.

What an AI governance framework is

AI governance means the rules, roles and habits an organization uses to keep its AI use safe, lawful and useful. An AI governance framework gives that work a shape. It tells you which questions to ask and in what order, so you do not have to invent the process from scratch.

Frameworks come in different forms:

Guidance you can follow as closely as you like.
Standards that an outside auditor can check you against.
Laws you must follow if they apply to you.

For a small team, most of the work is knowing which kind you are looking at, because that tells you what is optional and what is not. For a short definition you can share with colleagues, see the glossary entry on AI governance.

Why it matters for a small organization

You probably already use AI, even if nobody decided to. Staff paste text into chat assistants. A fundraising platform adds an AI writing feature. A volunteer tries a transcription tool on a board meeting. Each of these is a decision about data and quality that nobody made on purpose.

A light governance setup helps you:

know which AI tools are in use and what data goes into them
give staff a clear answer when they ask “can I use this?”
show funders, partners and auditors that you have thought about risk
catch problems, such as a wrong figure in a grant report, before they spread

You do not need a committee or a consultant. You need a named owner, a few short documents and a habit of reviewing them.

The three frameworks you will hear about

Three names come up again and again. They cover similar ground, but they are very different kinds of thing.

Framework	What kind of thing it is	Who publishes it	Do you have to follow it?
NIST AI RMF	Voluntary guide	US National Institute of Standards and Technology	No. It is free and voluntary.
ISO/IEC 42001	Certifiable standard	ISO and IEC	No, unless a funder, partner or contract asks for certification
EU AI Act	Law	European Union	Yes, if it applies to you

NIST AI RMF: a voluntary guide

The AI Risk Management Framework comes from NIST, a US government agency. Version 1.0 was released on January 26, 2023, after a public process that began with a request for information in July 2021 and included drafts in March and August 2022. It is free and meant for voluntary use.

Its purpose is to help organizations build trustworthiness into how they design, develop, use and evaluate AI, with attention to risks for individuals, organizations and society.

The framework is organized around 4 core functions: Govern, Map, Measure and Manage. Those 4 words make a useful backbone even for a team of 5 people, as the steps below show.

NIST also publishes companion material: a Playbook, a Roadmap, a Crosswalk, Perspectives, and the Trustworthy and Responsible AI Resource Center, which launched on March 30, 2023. A Generative AI Profile (NIST-AI-600-1) followed on July 26, 2024. It is worth a look if most of your AI use is chat assistants and writing tools. NIST says version 1.0 is being revised, so check for changes when you review your setup. More in our glossary entry on the NIST AI RMF.

ISO/IEC 42001: a certifiable standard

ISO/IEC 42001:2023, titled “AI management systems”, is an international standard from ISO and IEC. In everyday terms, a management system is the written rules, roles and routines an organization uses to run one area of its work in an orderly, checkable way.

What sets ISO/IEC 42001 apart is that organizations can be certified against it. Certification means an outside audit, which takes time and money. You may first meet the name on a vendor’s website: several AI vendors list ISO/IEC 42001 certification on their trust or compliance pages. See the glossary entry on ISO 42001.

The EU AI Act: a law

The EU AI Act, Regulation (EU) 2024/1689, is binding law in the European Union. It sorts AI systems by risk:

Unacceptable risk: banned practices.
High risk: strict obligations for uses in areas such as critical infrastructure, education, employment, essential services, biometrics, law enforcement, migration and justice.
Transparency risk: disclosure duties, such as telling users they are talking to a chatbot and labeling deepfakes.
Minimal or no risk: no rules. Most systems, such as spam filters, fall here.

The law is phasing in. It entered into force on August 1, 2024. Prohibitions and AI literacy obligations have applied since February 2, 2025. Governance rules and obligations for general-purpose AI followed on August 2, 2025. General application and transparency rules start on August 2, 2026.

The European Commission names 3 kinds of support for smaller organizations: the voluntary AI Pact, the AI Act Service Desk, and simplifications for SMEs, such as simplified technical documentation. For the dates in one place, see the EU AI Act timeline for small organizations and the glossary entry on the EU AI Act.

How to build a light governance setup

Use the 4 NIST functions as your outline. You do not have to follow the full framework. Each step below takes one idea from it and turns it into a task a small team can finish.

Name an owner (Govern). Pick one person who is responsible for AI use, and a backup. This is often the operations lead or whoever already handles data protection. Ask your director or board to confirm the role in writing so staff know who decides.
List your AI uses (Map). Make a simple inventory. For each tool, record who uses it, what for and what data goes into it. Ask every team, and include AI features inside software you already pay for.
Keep an approved tools list (Map). Turn the inventory into a short list with 3 statuses: approved, approved with limits (for example, “no client names”) and not approved. Give staff one place to find it and one way to ask for a new tool to be added.
Write a short policy (Govern). A page or 2 is enough. It should say what data must never go into an AI tool, who checks AI output before it is published or sent, and how to report a problem. Our AI acceptable-use policy template walks through the decisions.
Assess the risk of each use (Map). For each approved use, ask: what data does it touch, who is harmed if the output is wrong, and does it help make decisions about people? A tool that drafts newsletters is very different from one that screens job applicants. The AI risk assessment template gives you a format.
Check quality and incidents (Measure). Spot-check AI output regularly, especially anything that goes to funders, clients or the public. Keep a simple log of mistakes, near misses and data slips, even small ones.
Act and review (Manage). Fix what the checks turn up, retire tools that cause trouble and update the list. Set a review date, for example every 6 months, and also review whenever a vendor adds a new AI feature or you start a new kind of work.

Where ISO/IEC 42001 and the EU AI Act fit

ISO/IEC 42001: consider certification only if funders, partners or contracts ask for it. The steps above give you a sound base either way.
EU AI Act: check how it applies if you operate in the EU or serve people there. Pay particular attention to any use in a high-risk area such as employment or education, and to transparency duties if you run a chatbot.

This guide is not legal advice. If you think the EU AI Act applies to you, get qualified advice. Our course module on frameworks explained covers the same ground step by step.

What to watch for

Paper governance. A policy nobody reads protects no one. Keep documents short, tell staff where they are and mention them in onboarding.
Treating a vendor’s certificate as your own. A vendor’s ISO/IEC 42001 certification tells you something about the vendor. It does not tell you whether your staff are using the tool in a sensible way. You still need your own list, policy and checks.
Mixing up voluntary and required. The NIST AI RMF is voluntary and ISO/IEC 42001 certification is a choice. The EU AI Act is law where it applies. Do not spend your limited time on the optional items while missing the required ones.
AI that arrives without asking. Software you already use may add AI features in an update. Ask the owner to watch release notes and add new features to the inventory.
Moving targets. NIST is revising its framework, and the EU AI Act phases in through 2026. Put both on your review checklist.

Frequently asked questions

Do we need to be certified to ISO/IEC 42001?

Usually not. Certification is optional and means an outside audit, which takes time and money. Consider it only if a funder, partner or contract asks for it, and build the basic setup above first in any case.

Is the NIST AI RMF only for US organizations?

No. It is published by a US agency, but it is free and meant for voluntary use, so any organization can use it as a guide. Its 4 functions (Govern, Map, Measure, Manage) give a small team anywhere a clear way to organize its work.

Does the EU AI Act apply to a small non-profit?

It can, if you operate in the EU or serve people there. Most everyday uses, such as drafting text, are likely to sit in the lower risk levels, but chatbots bring transparency duties and uses in areas such as employment or education can be high risk. Check your own uses against the risk levels and get qualified advice if you are unsure.

How much time does a light governance setup take?

For most small organizations, the first pass is a few working sessions: naming an owner, building the inventory, writing the policy and assessing the main uses. After that, the ongoing work is spot checks, a log and a review a couple of times a year. The time grows if you pursue certification or have high-risk uses under the EU AI Act.