Recommended Free Tools
Mid-market companies can start AI governance without building a large risk department: name an executive sponsor and an operational owner, inventory AI already in use, and require a proportionate review before new or materially changed uses go live. NIST’s voluntary AI Risk Management Framework (AI RMF) offers a practical lifecycle structure—Govern, Map, Measure, and Manage—but it is not a law or a certification. Legal duties depend on the company’s jurisdiction, role, sector, and specific AI use.
What AI governance should do for a mid-market company
AI governance is the set of responsibilities and operating practices a company uses to decide where AI may be used, understand its risks, apply suitable controls, and respond when systems or circumstances change. It applies to more than models built in-house: AI features embedded in purchased software, externally hosted services, and employee use of generative AI can all affect company data, decisions, and customers.
The goal is not to eliminate every risk or to create a heavyweight approval process for every tool. It is to make decisions visible and accountable, with review effort proportionate to context and possible consequences. NIST’s AI RMF 1.0 organizes this work into four functions: Govern establishes responsibilities and policies; Map clarifies context and potential impacts; Measure evaluates risks; and Manage selects and follows through on responses. Governance runs continuously across the other functions, rather than being a one-time sign-off. NIST describes the framework as voluntary and says it is being revised: NIST AI Risk Management Framework.
Who should own AI governance?
Assign two accountable roles even if they are added to existing jobs. The executive sponsor sets the organization’s risk tolerance, makes or escalates consequential decisions, and ensures the work has authority and resources. The operational owner coordinates intake, inventory, reviews, decisions, and reporting. Make their decision rights and escalation route explicit so a request does not stall between departments.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBring other specialists in when the use case warrants it: privacy, security, legal or compliance, HR, procurement, business owners, and technical staff. A hiring tool, for example, may need HR and legal input; a system handling sensitive customer data may require privacy and security review. NIST’s governance outcomes include documented roles, executive responsibility, training, inventory mechanisms, review, and safe decommissioning. Its Core is guidance for implementing risk management, not a mandatory template: NIST AI RMF Core.
How to create an AI inventory
Start by asking business teams and procurement what AI is already being used, not just what the IT team has formally approved. Include internally developed systems, AI features inside purchased products, external services, and employee use of generative AI. The inventory makes it possible to assign owners and decide which uses deserve closer review.
For each entry, record enough to understand its role and possible impact:
Rank #2
- Ownership and supplier: internal business owner, vendor or model, and the team responsible for the relationship.
- Purpose and process: intended use, the business process it supports, and whether it is experimental or in production.
- People and decisions: who uses it, who may be affected, how much it automates, and whether a person reviews its output.
- Data and limitations: data types involved, known limitations or uncertainty, and what the company can and cannot inspect.
- Lifecycle: approval status, review date, and relevant changes to the system, vendor, data, purpose, or user population.
This is a practical starter inventory, not a NIST-prescribed form. Keep it in a place the operational owner can maintain and relevant decision-makers can access.
How to triage new or changed AI uses
Require a short intake before a new AI use is piloted or a material change is deployed. The aim is to establish context before deciding whether the use can proceed, needs additional controls, or should be escalated. NIST’s Map function similarly focuses on context and potential impacts before decisions are made.
Consider the following questions together rather than treating any one answer as a definitive risk score:
Rank #3
- What is the purpose, and what happens if the output is wrong or unavailable?
- Who could be affected, and could the use materially influence rights, access to opportunities or services, safety, finances, or employment?
- Does it use sensitive information, operate at significant scale, or make decisions that are difficult to reverse?
- Can a human meaningfully check the output, with enough information, time, and authority to correct it?
- How transparent is the supplier about the system’s intended use, limitations, updates, and evaluation evidence?
Escalate uses with potentially serious consequences, sensitive data, limited human oversight, or substantial uncertainty to accountable leadership and relevant specialists. This is general operational triage, not a legal classification. Determine legal categories and obligations separately under laws that apply to the company and the use case.
Match review and controls to the use
Controls should reflect the context, potential harms, uncertainty, and the organization’s risk tolerance. A low-impact internal drafting aid may need a named owner, an approved tool, clear data-handling rules, output checks, and basic staff training. A less transparent system that influences employment or access to services may warrant a documented assessment, testing with representative cases, privacy and security review, meaningful human oversight, vendor diligence, leadership approval, and closer monitoring.
These are suggested practices, not universal legal requirements or a fixed NIST checklist. For higher-impact uses, document the intended purpose, affected people, data, assumptions and limitations, possible harms, evidence reviewed, chosen controls, approval decision, and conditions that would trigger reassessment. Testing should be relevant to the actual context; a favorable test in one setting does not establish suitability in another. NIST calls for risk-based activity, testing, incident identification, and third-party risk processes in its AI RMF Core.
What an AI policy should tell employees
A useful policy turns principles into actions employees can follow. State which tools are approved, what information must not be entered, how outputs must be checked, when use must be disclosed, how to report a harmful or incorrect result, and who can approve exceptions. Include examples that fit real work—for instance, whether a team may use an approved assistant to summarize public material, and what extra review is required before AI-generated content is sent to a customer.
Train employees and relevant partners for their actual responsibilities, including when human review is required and what to do when an output appears unsafe or unreliable. Give staff a clear contact route for questions and incident reports. NIST emphasizes training and clear human-AI oversight roles in its AI RMF Core.
What to ask AI suppliers
Before adopting a vendor’s system or AI-enabled feature, ask questions that connect to the company’s intended use and risk review:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- What uses is the system intended for, and what limitations or unsuitable uses are known?
- How is company data handled, including access, retention, and use in model improvement?
- What security information and incident support can the supplier provide?
- How will the vendor communicate changes to the model, service, or relevant data?
- What evaluation evidence is available, and what can the company independently inspect or test?
Record unanswered questions and what the company cannot verify; lack of transparency may affect whether the use is acceptable or what safeguards are needed. NIST’s governance guidance treats third-party software, hardware, and data as risk considerations and calls for contingency processes for high-risk failures: NIST AI RMF Core.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor, reassess, and retire systems
Approval is the beginning of deployment oversight, not the end. Set a review interval appropriate to the potential impact and how quickly the system or its context can change. Monitor for unexpected outputs, complaints, performance changes, security events, and relevant vendor updates. Keep a route to pause use while an incident is investigated, and record findings and corrective actions.
Reassess when the model or vendor changes, new data is used, the purpose or user population shifts, or the system takes on more automation. Define in advance who can modify, suspend, or retire a use. When decommissioning, plan for safe phase-out and preservation of records the business needs. NIST identifies ongoing monitoring, periodic review, incident processes, and safe decommissioning as governance outcomes in its AI RMF Core.
How voluntary guidance differs from legal compliance
NIST AI RMF 1.0 was released on January 26, 2023, and is intended for voluntary use. Its four functions help structure risk-management work; they are not a certification or a statutory compliance checklist. NIST’s current framework page says it is being revised: NIST AI Risk Management Framework.
Legal obligations are a separate question. They depend on factors such as where the company operates, whether it develops or deploys a system, the use case, and applicable sector rules. The EU AI Act is one jurisdiction-specific regulation with scope-dependent obligations; do not assume it applies—or does not apply—without checking the current text and official implementation guidance against the company’s role, use, geography, and timing. This guide does not determine applicability. Consult qualified legal counsel for consequential decisions: EU AI Act, EUR-Lex.
For companies seeking a broader responsible-business-conduct lens, OECD’s 2026 guidance adapts due diligence to enterprises developing and using AI. Its six steps are to embed responsible business conduct in policies and management systems; identify and assess actual and potential adverse impacts; cease, prevent, and mitigate them; track implementation and results; communicate actions; and provide for or cooperate in remediation where appropriate. OECD describes the examples as adaptable, not an exhaustive checklist: OECD Due Diligence Guidance for Responsible AI.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
