An AI governance framework that actually works.

What is an AI governance framework?

Strip the vocabulary away and it answers three questions. What are our people allowed to do with AI, at what level of risk? What must be true before something moves from experiment to production, and how do we check it stays true? And when something goes wrong, who owns it?

Any framework that answers those three, and is actually used, is working. Any framework that does not, however handsome the policy document, is theatre.

What does the NIST AI RMF actually ask of you?

The NIST AI Risk Management Framework has become the reference point enterprises and regulators recognise, and it is more practical than its name suggests. Four functions, in plain English:

• Govern: decide who is accountable, and make risk a standing habit rather than a launch-day event.
• Map: understand each use case in context: who is affected, what could go wrong, what “wrong” costs.
• Measure: test and monitor the things you decided matter, before and after deployment.
• Manage: act on what you measured: fix, restrict, or stop.

It is voluntary. Its value is legibility: when your practice maps to a vocabulary that auditors, customers and regulators already speak, trust gets cheaper to establish. That is the argument we make about regulation generally: the discipline is the asset.

It is worth knowing how this sits next to ISO 42001, because the two get posed as a choice and they are not one. ISO 42001 is a management system standard you can be certified against, so it answers the question a customer or a regulator asks: can you show me. The NIST framework is a risk method, so it answers the question your own team asks: what should we actually do on Tuesday. Organisations serious about this increasingly run both, the standard for the structure and the framework for the practice. If you are being asked to evidence AI governance to somebody outside your organisation, the certifiable one is the one they will name.

How do you apply it without slowing down?

Keep the machinery small and the cadence real. In our work the framework compresses to three moving parts: a tiered usage model, so low-risk work never queues behind high-risk questions; a short set of questions every initiative answers before deployment, in business language; and a quarterly review with the authority to stop things.

Healthcare solved this problem decades ago under a different name. Clinical governance is what lets a hospital adopt new treatments quickly and safely: named accountability, graduated scrutiny by risk, and the standing assumption that practice will be reviewed. AI governance is the same muscle pointed at a new subject, and organisations that already have assurance functions are closer to ready than they think.

What are the signs a framework is failing?

Policies nobody can summarise. A review board that meets monthly and has never stopped anything. Approval queues that push teams into shadow usage. Metrics that count activity, workshops run and tools approved, rather than outcomes. And the surest sign: the people doing the work describe governance as something done to them, not something that protects their pace.

A working framework feels different. Low-risk work moves immediately. High-risk work knows exactly what it must prove. And when something is stopped, the reasons are stated and nobody is surprised.

Common questions

What is an AI governance framework?

The working decisions about what you allow, what you check and who owns what. If it lives only in a PDF, it is paperwork, not a framework.

Is ISO 42001 or the NIST AI RMF the right one to adopt?

They answer different questions, so the answer is usually both. ISO 42001 is a management system standard you can be certified against, which is what somebody outside your organisation asks for when they want evidence. The NIST framework is a risk method, which is what your own people need in order to know what to do. Use the standard for the structure and the framework for the practice.

Is the NIST AI RMF mandatory?

No. It is a voluntary reference whose value is legibility: a shared vocabulary that regulators, auditors and customers already recognise.

How do we start without a big programme?

A tiered usage model, a short pre-deployment question set, and a quarterly review that is allowed to stop things.