AI governance framework
Four controls a company can actually run, mapped to NIST AI RMF functions and ISO/IEC 42001 at a high level. Short on purpose.
Direct answer
A practical AI governance framework
Run four controls: a usage policy, access controls, oversight, and vendor review. In NIST AI RMF language those sit mainly in GOVERN, MAP, MEASURE, and MANAGE. In ISO/IEC 42001 they sit in policy and leadership, risk and impact assessment, operations, performance evaluation, and supplier controls. The output should be a short policy, a tool-and-data table, named reviewers, and one approved workflow.
Written by Zack Shields. Last updated .
Key facts
- NIST AI RMF functions: GOVERN, MAP, MEASURE, MANAGE
- ISO/IEC 42001 is an AI management system standard, not a product you buy
- Usage policy, access, oversight, and vendor review cover most first programs
- I do not invent maturity scores or claim a certification
- The matching service page is AI governance consulting
What I mean by governance here
Governance is the written answer to four questions: what staff may paste into a model, which tools are approved, who may use them, and how the first workflow is allowed to go live.
I am Zack Shields. I write this as an implementer. The policy has to survive a Tuesday afternoon and a security review. This is not a Big Four program and not a 90-page register.
Comparison
Map to NIST AI RMF and ISO/IEC 42001
High-level only. I am not quoting control IDs you would paste into an audit binder.
| Control | What you actually write | NIST AI RMF | ISO/IEC 42001 (high level) |
|---|---|---|---|
| Usage policy | Data classes, allowed tools, and a default for each class. Public copy, internal ops, customer records, regulated data, secrets. | GOVERN (policy, culture, accountability). Touches MAP (intended use). | AI policy, leadership, and roles. Intended use and impact thinking before a tool is blessed. |
| Access controls | Who may use a consumer chat app, who may use an API, who may connect a plugin. Credentials in your identity provider or secret store. A log of exports. | GOVERN (roles) and MANAGE (limit use, revoke, respond). | Resources, competence, and operational controls over who can run which system. |
| Oversight | A named reviewer for the first workflow, a retention rule, a way to turn it off, and a 30-day check on whether people followed the policy. | MEASURE (evaluation) and GOVERN (accountability). MANAGE for incidents. | Performance evaluation, monitoring, and improvement. Internal review of the AI management system. |
| Vendor review | Where data goes, whether training use is off, subprocessors, retention, and who signs the business agreement. A one-page review before the first seat. | MAP (context and third parties) and MANAGE (risk response). | Supplier and third-party controls, plus risk and impact assessment before you depend on the vendor. |
NIST AI RMF 1.0 organizes work into GOVERN, MAP, MEASURE, and MANAGE (nist.gov). ISO/IEC 42001 specifies requirements for an AI management system (iso.org). This table is a mapping aid, not a certification claim.
Workflow review
A framework nobody follows is a poster.
I write the policy, the access list, and the first approved workflow. Book a consult and name the unofficial tool use.
A first-week order of operations
- Inventory unofficial useWhich tools, which data, which teams. You already have a program. It is just unofficial.
- Write the class tableFive rows is enough. Staff can follow a table. They cannot follow "be careful."
- Approve one pathOne workflow, one reviewer, one kill switch. Not a company-wide blast.
- Review the first vendorThe tool already in use, or the one about to get keys. Then stop adding seats.
What I leave out
- Maturity scores, residual-risk heat maps, and invented statistics.
- A claim that following this page makes you "NIST compliant" or "ISO certified." Those are programs and audits, not a web page.
- Colorado or EU Act legal advice. I will say when counsel needs to own a question.
If you want the policy written and the first workflow approved, that is AI governance consulting. A longer operator note also lives on the AI governance guide.
FAQ
Frequently asked questions
Short, direct answers. Ask me anything else on the call.
What is an AI governance framework in practice?
A short policy, an access list, named oversight, and a vendor review, mapped to a public standard so security and legal can see the shape. I use NIST AI RMF functions and ISO/IEC 42001 at a high level.Do I need ISO/IEC 42001 certification?
Most owner-operated companies do not start there. They need rules staff will follow and one approved workflow. Certification is a later, formal program. I do not sell a certificate.How does this relate to NIST AI RMF?
NIST groups work into GOVERN, MAP, MEASURE, and MANAGE. A usage policy is mostly GOVERN. Vendor and context work is MAP. Testing and review is MEASURE. Access limits and incidents are MANAGE. You do not need all four functions finished before the first approved path.Can you implement the framework, not only describe it?
Yes. The service page is AI governance consulting. I write the policy, the access model, and the first rollout. I come from implementation, not from a compliance product.
Book a consult
Book a consult
Tell me who already pastes work into a consumer chat tool. I reply within one business day.
- Quote
- Written
- Length
- 30 min
- Pressure
- None