On a normal Tuesday, someone in your company pastes a customer contract into a free AI tool to get a summary. Nobody told them not to. Nobody told them which tool to use either. An AI governance framework is the answer to that moment: the rules that say which AI tools your people may use, with which data, and who approves what.
Most guides on this topic are written for companies with a risk department. This one is for a company of 200 to 2,000 people. At that size you do not need a committee. You need five decisions, written on one page, made once.
Key takeaways
- For a mid-sized company, the rules for AI fit on one page: five decisions, made once by Legal, IT and the person who owns your brand.
- The big standards (NIST AI RMF, ISO/IEC 42001, the EU AI Act) say what good looks like. They do not tell a company of your size where to start.
- The EU AI Act changed in July 2026. The AI literacy duty stayed, in softer wording, and the dates for high-risk systems moved to December 2027 and August 2028.[6]
- Rules come before the rollout. We set them once, so that later use cases do not start the security discussion again.
What is an AI governance framework?
It is a set of rules and roles for how an organisation uses AI. It answers three plain questions. What may our people do with AI? Who decides? How do we know the rules are followed?
Three reference points come up in every discussion. They are different kinds of document:
- The NIST AI Risk Management Framework is a voluntary guide from the US standards institute, released on 26 January 2023.[1] It is organised in four functions: Govern, Map, Measure and Manage.[2]
- ISO/IEC 42001 is an international standard, published in December 2023. It sets out the requirements for an “AI management system” inside an organisation.[3]
- The EU AI Act is law. It sorts AI systems into four levels of risk and sets duties according to the level.[4]
Why does this matter now? Because the tools arrived before the rules. In a 2025 study of more than 48,000 people in 47 countries, KPMG and the University of Melbourne found that only 40% say their workplace has a policy or guidance on generative AI. Almost half admit to using AI in ways that go against company policy.[8]
Why the enterprise version does not fit a mid-sized company
The published frameworks assume an organisation that most mid-sized companies do not have: a risk office, a model inventory, a review board that meets every month. Copy that, and one of two things happens. Either the rules stay in a document that nobody reads, or every new idea waits weeks for approval and people go back to their private accounts.
A company of your size has something better: short decision paths. Legal is one or two people. IT knows every system. One person owns the brand. Put those three in one room for a working session, and you can decide what takes a large company much longer.
The aim is the same as in the big frameworks. Only the form is different: the rules, set once, on one page.
The five decisions, on one page
| Decision | What you write down | Who decides |
|---|---|---|
| 1. Tools | Which AI tools are approved, and that people use company accounts | IT |
| 2. Data | Which data may go into AI, in three classes: public, internal, restricted | Legal and IT |
| 3. Actions | What AI may do: read, draft, or act. And which steps a person must approve | IT and the team lead |
| 4. Owners | Who owns each use case, and where a new idea goes for approval | Management |
| 5. Review | What is logged, how often you look at it, and how people are trained | IT and HR |
1. Which tools are approved?
Name them. For example: “Claude and ChatGPT, on company accounts, with the company login. Nothing else for company work.” A short list that people can remember beats a long policy. The company account matters because business plans come with admin controls and contract terms that a private account does not have, and because IT can switch an account off when someone leaves.
2. Which data may go in?
Three classes are enough to start. Public: anything already on your website. Internal: plans, notes, most documents. Restricted: personal data of customers and staff, contracts, anything under a confidentiality agreement. Then one line per class that says where it may go.
3. What may AI do?
There is a large difference between an AI that reads, an AI that drafts and an AI that acts. Start with read-only access. Let it draft. Before it sends, books, changes or deletes anything, a person approves. A hacked website shows you spam. A hijacked agent shows your mailbox and your CRM. That is why this decision is on the page.
4. Who owns it?
Every use case has one named owner in the business, not in IT. And there is one place for new ideas: a channel in Teams or Slack where a request comes in, gets a first answer within an agreed time, and is logged.
5. How do you check and learn?
Decide what is logged and who looks at it, and how often. Once a month is a good start. Then decide how people learn the rules. A page nobody has read is not a rule.
How the five decisions map to the standards
The one-page sheet is not a replacement for the standards. It is a small version of the same ideas. The table shows where each decision sits. This mapping is our own reading, not an official one.
| Decision | NIST AI RMF function | EU AI Act, where it applies |
|---|---|---|
| 1. Tools | Govern | The risk level depends on the use, so list the uses for each tool |
| 2. Data | Map | Not specific to the AI Act. Your existing data protection duties continue |
| 3. Actions | Manage | Article 26: human oversight for high-risk systems |
| 4. Owners | Govern | Article 26, for high-risk systems: oversight by people with competence, training and authority |
| 5. Review | Measure and Manage | Article 4: AI literacy. Article 26: keeping logs for high-risk systems |
NIST describes the Govern function as one that “cultivates and implements a culture of risk management” and the Map function as one that “establishes the context to frame risks related to an AI system”.[2] On one page, that is decisions 1, 2 and 4.
What the EU AI Act asks of a company that uses AI
A short orientation, because the law changed recently. This is a summary of public sources and not legal advice. Ask your lawyer how it applies to you.
- Four levels of risk. Unacceptable, high, limited, and minimal or no risk. The Commission says the vast majority of AI systems used in the EU fall into the last group.[4]
- What counts as high-risk. The Commission’s examples include AI tools for employment and the management of workers, such as software that sorts CVs for recruitment, and credit scoring.[4] Drafting an email is not among those examples. Software that sorts CVs is.
- The July 2026 changes. A new regulation, often called the AI Omnibus, entered into force on 27 July 2026.[7] It moved the dates for high-risk systems to 2 December 2027 and 2 August 2028.[6]
- AI literacy. This duty has applied since 2 February 2025.[6] In its current wording, companies “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”, and the duty “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.[5]
- If you do run a high-risk system. Article 26 asks you to assign human oversight to people “who have the necessary competence, training and authority”, and to inform workers’ representatives when the system is used at work.[9]
- Companies outside the EU. The Act also covers providers and deployers (companies that use an AI system) in a country outside the EU “where the output produced by the AI system is used in the Union”.[10] A Swiss or British company whose AI output is used in the EU should not assume it is outside.
In our reading, three things follow for a mid-sized company. Know which of your uses could be high-risk. Support your people in learning to use AI. Keep a record of what you did. Decisions 1, 3 and 5 on the one-page sheet are where that work sits. They do not make you compliant on their own, and other duties can apply, for example to label AI-generated content.
What it looks like in practice
In PromptPartner’s method, the rules are the second step, after the audit and before anything goes live. Legal, IT and the brand owner sit together once. They decide the tools, the data classes and the approval steps. Agents start with read-only access to the core systems.
When the third or the tenth use case comes up, nobody has to argue about security again, because the boundary was approved once. That is how we build it. See the method, from audit to rollout.
A typical example is approvals. A request comes in through Teams or Slack. An agent sorts it, drafts an answer and sends it to the right person. That person decides, within an agreed time, and the decision is logged. See how agents work inside the tools you already use.
If you do not yet know which uses of AI are worth governing, start one step earlier. An AI audit shows which use cases pay off, so the rules cover real work and not a theory.
Frequently asked questions
What are the three pillars of AI governance?
There is no official list of three pillars. No standard and no law defines one. In practice, most rule sets cover the same three things: what people may do with AI, who decides, and how you check that the rules are followed.
What are the five principles of AI governance?
The best-known five are the OECD AI Principles, adopted in 2019 and updated in May 2024: inclusive growth, sustainable development and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability.[11]
What is the NIST framework for AI governance?
The NIST AI Risk Management Framework, released on 26 January 2023. It is voluntary and is organised in four functions: Govern, Map, Measure and Manage. NIST added a profile for generative AI in July 2024.
Does a mid-sized company need ISO/IEC 42001 certification?
ISO/IEC 42001 is a voluntary standard. Some customers may ask for it, especially in regulated industries. For most mid-sized companies, clear rules that people follow come first. Certification can follow when a customer or a tender requires it.
Who should own the AI rules in a mid-sized company?
One named person in management, with Legal and IT involved. Each use case then has its own owner in the business team that uses it. Rules owned by a committee tend to be owned by nobody.
Does the EU AI Act apply to companies outside the EU?
It can. The Act covers providers and users of AI systems in a country outside the EU where the output produced by the AI system is used in the Union. A Swiss or British company whose AI output is used in the EU should check with a lawyer.
Next step
If your people already use AI and the rules are not written down yet, book a 30-minute call.
No pitch. You’ll leave with at least one recommendation you can use — whether or not we ever work together.
Sources
- [1]NIST, AI Risk Management Framework— released 26 January 2023
[2] NIST, AI RMF Core — the four functions
[3] ISO/IEC 42001:2023, AI management system — published December 2023
[4] European Commission, AI Act overview — retrieved 5 October 2026
[5] EU AI Act, Article 4 (AI literacy) — consolidated version of 27 July 2026
[6] EU AI Act, Article 113 (entry into force and application) — consolidated version of 27 July 2026
[7] European Commission, “AI Omnibus enters into force,” 27 July 2026 — Regulation (EU) 2026/1744
[8] KPMG and the University of Melbourne, global study on trust in AI, April 2025 — more than 48,000 people in 47 countries
[9] EU AI Act, Article 26 (obligations of deployers of high-risk AI systems) — consolidated version of 27 July 2026
[10] EU AI Act, Article 2 (scope) — consolidated version of 27 July 2026
[11] OECD, AI Principles — adopted 2019, updated May 2024
