AI Governance Frameworks: NIST, ISO 42001, and the EU AI Act — A Practical Guide

NIST AI RMF, ISO 42001, EU AI Act, OECD AI Principles — you don’t need all of them. You probably already do most of what governance requires, informally. This article is about making it formal without making it complicated. Here is how to find the right framework for your size, sector, and actual obligations, and what you can accomplish in a weekend.

§01

Why AI governance matters now, not later

A compliance officer Googles “AI governance framework” and gets 47 million results. NIST AI RMF. ISO 42001. EU AI Act. OECD AI Principles. IEEE Ethics Guidelines. Singapore FEAT. Gartner AI TRiSM. Every analyst firm, standards body, and regulatory agency has published something. They all have acronyms. Many overlap. Some contradict each other at the edges. And none of them were written for a 60-person healthcare practice or a mid-sized county government trying to figure out whether the AI scheduling tool they bought last quarter creates any compliance exposure. The alphabet soup is real, and it is genuinely confusing — not because you are missing something, but because the landscape actually is that fragmented.

This article maps the terrain that matters for you specifically — a business owner, CISO, compliance officer, or IT leader at an SMB or public-sector organization in 2026. By the end of this, you will know which frameworks apply to your organization, which ones you can set aside for now, and exactly where to start if you have nothing in place today. The good news: you almost certainly already do some of this informally. The goal is to make it formal without burying you in process.

The governance conversation usually gets deferred. There are always more pressing fires. But two data points from early 2026 make the deferral calculus harder to justify.

Censinet’s December 2025 benchmark found that only 12% of U.S. hospitals have a formal AI governance framework in place.[1] The American Medical Association’s March 2026 survey found that 81% of physicians are using AI professionally.[2] That is a 69-point gap between adoption and governance. If your organization is in that gap — using AI without documented policies, named accountability, or reviewed vendor terms — you are in good company. That also means the risk is largely preventable and the work to address it is more manageable than the acronym count suggests.

12%

Of U.S. hospitals with a formal AI governance framework (Censinet, Dec 2025)

81%

Of physicians using AI professionally (AMA, Mar 2026)

69 pts

Gap between AI adoption and governance in U.S. healthcare

80%+

Of unauthorized AI transactions will come from internal policy violations by 2026 (Gartner)

Gartner’s AI TRiSM research adds a different dimension: by 2026, more than 80% of unauthorized AI transactions will originate from internal policy violations — not external attacks.[3] The risk is not primarily adversarial. It is employees adopting AI tools without approval, vendors embedding AI into products without disclosure, and procurement teams buying AI-powered software without asking the right questions. None of this is malicious. It is just what happens without governance — and governance is simply the operational discipline that keeps it from becoming a problem you have to explain to a regulator or a board.

“The threat isn’t that someone hacks your AI. The threat is that your own organization is using AI in ways nobody has reviewed, documented, or approved — and something goes wrong.”

§02

The big three frameworks, side by side

Three frameworks dominate the serious governance conversation in the U.S. and globally. They are different tools designed for different situations. Understanding those differences — voluntary vs. binding, certifiable vs. advisory, domestic vs. extraterritorial — is the foundation of any prioritization decision. Most organizations only need to fully engage with one of them right now.

	NIST AI RMF 1.0	ISO 42001:2023	EU AI Act
Type	Voluntary framework	Certifiable standard	Binding regulation
Who it applies to	Anyone (designed for U.S. orgs)	Anyone seeking certification	EU market participants + extraterritorial reach
Mandatory?	No	No (but clients may require it)	Yes, within scope
Structure	4 functions: Govern, Map, Measure, Manage	PDCA management system (Plan-Do-Check-Act)	Risk tiers: prohibited, high-risk, limited, minimal
Cost to implement (small org)	$8K–$20K with consultant	$15K–$40K for certification	Depends entirely on risk tier
Timeline	Self-paced	6–12 months typical	Staggered: Feb 2025 → Aug 2027
Healthcare relevance	High — pairs well with HIPAA	Growing	Medical devices = high-risk category
U.S. SMB relevance	Highest	Medium — adds credibility, not urgency	Low unless you have EU customers or operations

For most U.S. SMBs and SLED organizations with no EU footprint and no immediate certification mandate from clients, NIST AI RMF is the right starting point. It is free — NIST is a federal agency, and this was a resource the government built specifically to help U.S. organizations navigate this problem. It is flexible, self-paced, and designed for the U.S. organizational context. ISO 42001 and the EU AI Act both have legitimate relevance, but to a narrower audience and for specific reasons that the sections below explain. Chances are, one of them does not apply to you right now at all.

§03

NIST AI RMF: a practical walkthrough for a 50-employee org

The NIST AI Risk Management Framework was published in January 2023 by the National Institute of Standards and Technology.[4] NIST is a federal agency — this is a free resource the U.S. government built specifically to help organizations figure out how to manage AI risk responsibly. It is not a compliance requirement. It is not another thing being imposed on you. It is a structured way of thinking about AI risk that you can apply at whatever pace your organization can sustain, and it does not require a consultant to start using it. Four core functions. Four questions every organization should be able to answer about every AI system it operates.

Govern

Governance establishes the policies, roles, and accountability structures that make AI risk management possible. Before you can manage AI risk, someone has to own it. Govern asks: Who in your organization is authorized to approve a new AI tool for use? What is the process for that approval? Who is accountable when an AI system produces a harmful outcome? Is there an AI use policy that employees have read and acknowledged?

For a 50-employee organization, this does not require a dedicated AI governance committee or a new hire. It requires one person with named responsibility, a two-page acceptable use policy, and a documented approval workflow for new tools. That is the minimum viable governance layer — and most organizations do not have even that. If you have an IT director or a compliance officer who already reviews vendor contracts and IT policy, they are the natural home for this function. You are probably not starting from zero, even if it feels that way.

Map

Map is where you inventory every AI system currently operating in your environment. This includes tools your IT team selected, tools individual departments adopted independently, AI features embedded in SaaS products you already pay for, and AI components in vendor-supplied software you did not know had them. For each system, Map asks: What data does it touch? What is its intended use? What are the potential harms if it fails, produces biased outputs, or is used in unintended ways? Who are the affected parties?

The inventory step consistently surprises organizations. A 50-person healthcare practice typically finds AI active in their EHR scheduling module, their revenue cycle management software, their customer support chatbot, and two or three tools employees downloaded independently and started using without IT involvement. You cannot govern what you have not inventoried. A spreadsheet with tool name, vendor, data it touches, and who owns the relationship is enough to start.

Measure

Measure establishes how you assess AI risk. For each system you identified in Map, what are the relevant risk dimensions — accuracy, bias, security vulnerabilities, privacy exposure, explainability? What would you track? How would you know if a model’s performance degrades over time? For most SMBs, this starts as a qualitative assessment, not a sophisticated monitoring exercise. Write down what you know, what you are uncertain about, and what you would need to find out. That document is your Measure artifact for now.

Manage

Manage is where risk treatment decisions are made. Based on what Measure surfaced, what mitigations are proportionate? A high-risk AI system making consequential clinical recommendations requires more rigorous oversight than a low-risk chatbot answering FAQ questions on your website. Manage also covers ongoing monitoring and the decommissioning process for AI systems that are no longer fit for purpose or that pose unacceptable risk. For most small organizations, this is not yet a sophisticated function — it is a quarterly conversation and a decision documented in writing.

For a 50-employee healthcare practice: Govern and Map alone get you approximately 70% of the way to a defensible AI governance posture. Start there. Knowing what AI you are running and who is accountable for it is the work most organizations skip entirely — and it is the work that matters most when something goes wrong and someone asks who approved it.

NIST also published the AI 600-1 Generative AI Profile in July 2024.[5] This is a free companion document to the AI RMF specifically addressing generative AI — large language models, image generators, and similar tools. If your organization is using ChatGPT, Microsoft Copilot, Google Gemini, or any SaaS product with an embedded GenAI feature (which is most of them now), the 600-1 profile provides the additional risk guidance the base framework does not cover in sufficient depth. Download it alongside the base framework. Both are free. Both are readable.

§04

ISO 42001: what certification actually requires

ISO 42001:2023 is the international standard for AI management systems.[6] Published by the International Organization for Standardization in December 2023, it follows the same Plan-Do-Check-Act (PDCA) management system structure used by ISO 27001 (information security) and ISO 9001 (quality management). If your organization already holds an ISO 27001 certification, ISO 42001 integration is considerably more straightforward than starting from scratch.

The key distinction between ISO 42001 and NIST AI RMF is that ISO 42001 is certifiable. An accredited third-party registrar audits your management system against the standard’s requirements and, if you pass, issues a certificate. That certificate can be presented to clients, regulators, and procurement officers as evidence of a structured, externally validated AI governance program.

What Certification Costs

For a small organization — under 100 employees — realistically expect $15,000 to $40,000 in combined costs: consultant fees for the gap assessment and management system build-out, internal staff time, and registrar fees for the certification audit itself. The timeline from decision to certificate is typically six to twelve months. Ongoing surveillance audits add cost in subsequent years.

The Gap That Matters

There is a meaningful distance between “we do AI governance” and “we are ISO 42001 certified.” Many organizations that have documented AI policies, assigned governance roles, and implemented risk management processes would not pass a certification audit without additional work — particularly around the documented evidence requirements that formal audits demand. The standard requires not just that you do the things, but that you demonstrate you do them, consistently, with records.

As of early 2026, the public registry of ISO 42001 certified organizations is sparse. The standard is new and certification pipelines are still developing. Early certification is a genuine differentiator in competitive procurement, but it means you are building toward a standard the market is still calibrating.

When ISO 42001 Makes Sense

Your clients or prospects in regulated industries are beginning to require documented AI governance as a vendor prerequisite
You already hold ISO 27001 and can leverage existing management system infrastructure
You are competing for federal or state contracts where AI governance documentation is a scoring factor
Your organization’s AI use is significant enough that certification provides meaningful internal discipline beyond what a self-assessed framework delivers

When It Doesn’t

You have no AI governance at all yet — build a foundation first
Your AI use is limited to standard SaaS tools with minimal risk exposure
No client or regulatory driver exists for third-party validation
The $15K–$40K investment would displace higher-priority security spending

§05

EU AI Act: what it means for U.S. organizations

The EU AI Act entered into force on August 1, 2024, after years of negotiation, and became the world’s first comprehensive binding AI regulation.[7] Its risk-tiered structure classifies AI systems by the potential harm they can cause, with regulatory requirements scaling accordingly.

Prohibited AI

AI systems banned outright, regardless of safeguards. Examples: social scoring systems, real-time remote biometric surveillance in public spaces (with narrow law enforcement exceptions), AI that exploits psychological vulnerabilities to manipulate behavior, and systems that infer sensitive characteristics from biometric data. For most SMBs, prohibited AI is not an operational concern.

High-Risk AI

This is where U.S. organizations need to pay attention, because the high-risk category is broader than most people expect. High-risk AI includes: medical devices incorporating AI, AI used in education and vocational training that makes consequential scoring or tracking decisions, AI used in employment and HR for screening or promotion decisions, AI used in critical infrastructure management, AI in law enforcement and border control, and AI in the administration of justice. High-risk systems face conformity assessments, technical documentation requirements, human oversight mandates, and post-market monitoring obligations.

Limited Risk

AI systems with specific transparency obligations but no conformity assessment requirements. Chatbots must disclose that users are interacting with an AI. Deepfake content must be labeled as AI-generated. The compliance burden is primarily disclosure.

Minimal Risk

The majority of AI applications — spam filters, recommendation engines, video game AI, basic automation tools — fall here and face no specific EU AI Act obligations beyond general EU law.

The Implementation Timeline

February 2, 2025: Prohibited AI systems must cease operation
August 2, 2025: General Purpose AI (GPAI) model obligations take effect
August 2, 2026: High-risk AI system requirements fully applicable
August 2, 2027: High-risk AI embedded in regulated products, including certain medical devices, must comply

The U.S.-Only SMB Reality

If your organization operates exclusively in the United States, has no EU customers, and does not deploy AI systems into EU markets, your direct EU AI Act obligations are minimal. The Act has extraterritorial reach — it applies when AI outputs are used in the EU, regardless of where the provider is located — but this is largely a concern for organizations with EU commercial presence or customers.

The indirect implication worth noting: major AI vendors (Microsoft, Google, AWS, Salesforce) are building EU AI Act compliance into their platforms and documentation. Buying from EU-AI-Act-compliant vendors gives you better documentation, more transparent data practices, and clearer contractual terms around AI use — regardless of whether the regulation itself applies to you.

§06

State-level AI governance: the patchwork

While the EU has one comprehensive regulation, the United States has an emerging patchwork of state-level AI laws — and the complexity is growing. For business owners and compliance officers at U.S. organizations, the state layer may be more immediately relevant than either ISO 42001 or the EU AI Act.

New York RAISE Act (Signed December 19, 2025)

New York’s Responsible AI Safety and Education Act targets frontier AI model developers — organizations building or training large-scale AI models — not deployers.[8] If your organization is using AI tools rather than building them, the RAISE Act does not impose direct compliance obligations on you. It does create safety requirements for the companies whose AI products you may be buying, which may surface in vendor contracts.

New York AI Act (S1169A)

A separate piece of legislation in the New York State Senate, S1169A would regulate algorithmic discrimination more broadly — covering automated decision systems used in employment, housing, credit, and public accommodation.[9] As of this writing, it remains in committee. Organizations using AI in HR, lending, or housing decisions in New York should track its progress.

Colorado AI Act (SB 24-205, Effective February 1, 2026)

Colorado’s law is one of the most operationally significant for U.S. organizations outside California and New York.[10] It applies to developers and deployers of “high-risk” AI systems — defined as systems that make or substantially facilitate consequential decisions in employment, education, financial services, healthcare, housing, and legal matters. Key requirements include: conducting impact assessments for high-risk systems, implementing risk management programs, disclosing AI use to affected consumers, and allowing consumers to appeal automated decisions. If you are a Colorado-based business or making consequential decisions affecting Colorado residents, this law is active and requires attention now.

Other Notable Developments

Illinois BIPA: The Biometric Information Privacy Act has been used in litigation against AI systems that collect or process biometric data. Facial recognition, voiceprint analysis, and similar tools used in Illinois carry BIPA exposure.
Texas: Texas has introduced AI-related legislation focused on government use of AI and algorithmic decision-making. State government contractors should monitor Texas legislative developments.
California: Multiple AI-related bills moved through the California legislature in 2024 and 2025, with some signed and some vetoed. California remains the most active state legislative environment for AI regulation.
HHS AI Strategic Plan (December 4, 2025): The Department of Health and Human Services published an internal AI strategic plan governing HHS’s own AI adoption.[11] It does not impose binding requirements on healthcare providers or HIPAA-covered entities, but it is directionally useful for understanding where federal health IT policy is heading.

The state compliance trap: Because state AI laws vary significantly in scope, definitions, and effective dates, a policy written for one state may not satisfy another. If your organization operates in multiple states or makes decisions affecting residents of multiple states, your AI acceptable use policy and impact assessment process need to account for the union of applicable state requirements — not just the most familiar one.

§07

Five first steps if you have zero AI governance today

Most organizations reading this have not started. That is not a criticism — it is where most of the market is right now. Meaningful AI governance does not require a large budget, a dedicated team, or a six-month initiative. It requires approximately 20 hours and the willingness to put things in writing. Think of it as a focused weekend project that produces real organizational protection, not a compliance program you will still be building a year from now.

Build your AI Entity Inventory Walk through every department and ask one question: what AI tools are you using? Include SaaS products with embedded AI features — your CRM probably has them, your email platform might, your EHR almost certainly does. Include individual tools employees downloaded and started using on their own. Include anything your vendors provide that uses machine learning to make or influence decisions. Put it in a spreadsheet: tool name, vendor, data it touches, and who in your organization owns the relationship. Four hours of focused work produces this. It is your baseline, and it is the thing most organizations do not have. You cannot govern what you have not inventoried.
Write a two-page AI Acceptable Use Policy You probably already have informal norms about what employees should and should not do with AI tools. Write them down. The policy needs to cover four things: what AI tools are approved for use, what data may be entered into AI systems (and what may not — patient records, financial data, client PII, confidential business information), how employees should disclose AI-generated content in client deliverables, and the approval process for adopting a new AI tool. Two pages is enough. A policy employees can read and understand in five minutes is more protective than a 40-page document that lives in SharePoint untouched. This takes four to six hours.
Assign one person as AI governance lead This is not a new hire. It is not a new title. It is a named function: one person whose job includes reviewing new AI tool requests, maintaining the inventory, and ensuring the acceptable use policy stays current. In a 50-person organization, this is typically the IT director, compliance officer, CISO, or operations lead — whoever already touches policy and vendor risk. In a smaller organization, it may be the owner. The function matters far more than what you call it. Name it, put it in writing, and move on.
Review every AI vendor’s data handling terms Pull the terms of service and data processing agreements for every tool in your inventory. For each one, find answers to three questions: Is your data used to train the vendor’s models? Where is your data stored and processed? What happens to your data if you terminate the contract? Vendors that cannot answer these questions clearly, in writing, represent elevated risk. This review consistently surfaces surprises — tools that appeared harmless turn out to have data handling terms that create HIPAA or FERPA exposure. Budget four to six hours for this, more if your inventory is long.
Schedule a quarterly 30-minute AI review meeting Governance is not a project you finish. It is a practice you maintain. A quarterly 30-minute standing meeting with the AI governance lead and relevant department heads does three things: it surfaces AI tools employees have adopted since the last meeting, it creates a rhythm for reviewing whether existing tools are performing as expected and still meet your compliance requirements, and it signals to the organization that AI governance is something leadership takes seriously. Put it on the calendar before you close this tab.

Minimum viable governance: These five steps require approximately 20 hours of total effort and zero budget beyond existing staff time. That is the anchor point for this entire article. They will not make you ISO 42001 certified. They will not satisfy every EU AI Act requirement. But they will close the most dangerous governance gap — the gap where nobody in your organization knows what AI you are running, who approved it, or what data it processes. That gap is where incidents start. Close it here.

§08

Where to go from here

Once the five-step foundation is in place — the inventory, the policy, the named owner, the vendor review, the quarterly cadence — the next decision is shaped by your regulatory context and where you want to go.

If you are in healthcare, NIST AI RMF is the natural next layer. Its Govern and Map functions map cleanly onto HIPAA’s requirements for covered entities and business associates, so you are not building something separate. You are formalizing AI governance inside a structure your compliance program already recognizes. The AI 600-1 Generative AI Profile is the specific reference document for any GenAI tools touching clinical data — download it, it is free.

If you are a government contractor or competing for SLED contracts, watch the federal acquisition landscape. Procurement requirements for AI governance documentation are emerging at the agency level, and state procurement offices are beginning to include AI governance questions in vendor assessments and RFPs. Building toward NIST AI RMF now means you will have a credible, documented answer when those questions appear in a solicitation. That answer is increasingly a differentiator.

If you have international clients or EU operations, the EU AI Act’s risk tier analysis is the priority next step. Map your AI systems against the high-risk categories defined in the Act. If anything you operate falls into that tier, you need legal and compliance review before the August 2026 high-risk deadline. The analysis itself is not complicated — the Act’s category definitions are readable. The compliance work that follows may not be simple, but you need to know whether it applies before you can plan for it.

If you are facing direct client or partner pressure for documented AI governance, ISO 42001 is the credential to pursue — but only after the NIST AI RMF foundation is solid. Certification built on an immature governance program is expensive and fragile. Build the foundation first. The certification will hold.

The acronym count is real, and the landscape will keep evolving. What does not change is the foundational question: do you know what AI your organization is running, who is accountable for it, and what your policies say about it? Answer that, in writing, and you are ahead of most organizations your size. Everything else builds on that foundation.

Not sure which framework applies to your organization?

That is a common and reasonable question. Security Medic Consulting helps business owners and public-sector leaders figure out which governance approach fits their size, sector, and obligations — and build a practical program that starts where they are today, not where a consultant wishes they were.

Start the Conversation

References

Censinet. (2025, December). 2025 Healthcare Cybersecurity Benchmark: AI Governance in U.S. Hospitals. Censinet Inc. https://censinet.com/resources/
American Medical Association. (2026, March). AMA Digital Medicine Survey: Physician AI Adoption 2026. American Medical Association. https://www.ama-assn.org/practice-management/digital/ama-digital-medicine-health-care-executives-survey
Gartner. (2025). Gartner AI TRiSM: Managing AI Trust, Risk, and Security Management. Gartner Inc. https://www.gartner.com/en/information-technology/topics/ai-trust-risk-security-management
National Institute of Standards and Technology. (2023, January). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1
National Institute of Standards and Technology. (2024, July). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.600-1
International Organization for Standardization. (2023, December). ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. ISO. https://www.iso.org/standard/81230.html
European Parliament and Council of the European Union. (2024, August). Regulation (EU) 2024/1689 — Artificial Intelligence Act. Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
New York State Legislature. (2025, December 19). S5687-D — New York Responsible AI Safety and Education (RAISE) Act. New York State Senate. https://www.nysenate.gov/legislation/bills/2025/S5687
New York State Legislature. (2025). S1169A — New York State Artificial Intelligence Act. New York State Senate. https://www.nysenate.gov/legislation/bills/2025/S1169
Colorado General Assembly. (2024). SB 24-205 — Colorado AI Act: Consumer Protections for Artificial Intelligence. State of Colorado. https://leg.colorado.gov/bills/sb24-205
U.S. Department of Health and Human Services. (2025, December 4). HHS Artificial Intelligence Strategic Plan 2025–2030. HHS Office of the Chief Artificial Intelligence Officer. https://www.hhs.gov/ai/index.html