AI Governance Framework (2026): What NIST and the EU AI Act Actually Ask of a Business Your Size

The short answer

An AI governance framework is the set of rules for how your company picks, uses and checks AI: who owns it, which tools are approved, what data can go in, who reviews what comes out, and how often you look again. As of September 2026 the reference framework in the US is NIST's AI Risk Management Framework, which is voluntary, organized around four functions (Govern, Map, Measure, Manage) and currently being revised. The EU AI Act, the one with legal teeth, has applied since August 2, 2026.

Most of what ranks for this phrase is written for a bank with a risk department. If you run a company of 10 to 200 people, you do not need that. You need the same four ideas on two pages, with a name next to each one. That is what this is.

The reference framework: NIST's AI RMF in one paragraph each

NIST released the AI Risk Management Framework (AI RMF 1.0) on January 26, 2023 and describes it as "intended for voluntary use." Its core is four functions. From NIST's own document:

• Govern. "A culture of risk management is cultivated and present." Policies, roles, accountability. NIST calls it "a cross-cutting function" that runs through the other three, which is why it sits in the middle of their diagram.
• Map. "Context is recognized and risks related to context are identified." For each AI use: what is it for, who does it affect, what goes wrong if it is wrong.
• Measure. "Identified risks are assessed, analyzed, or tracked." Testing, spot checks, error rates.
• Manage. "Risks are prioritized and acted upon based on a projected impact." Fix, limit, or stop.

Two lines in the document matter more than the diagram. NIST says the actions "do not constitute a checklist," and that after putting Govern in place, "most users of the AI RMF would start with the MAP function." Translation: decide who is in charge first, then list what you are actually using. Everything else follows from that list.

What changed in 2026, and why the date on your template matters

If you downloaded an AI governance template last year, three things on it are probably stale:

• NIST is rewriting the framework. NIST's AI RMF page now says "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." It also added a Generative AI Profile (NIST-AI-600-1, July 26, 2024) and, on April 7, 2026, a concept note for a critical-infrastructure profile. Anything built on 1.0 still works, but expect the wording to move.
• The EU AI Act is live. It entered into force on August 1, 2024 and became applicable on August 2, 2026, which is also when the EU's AI Office and national authorities started enforcing it.
• The high-risk deadlines moved. The "AI Omnibus," which entered into force on July 27, 2026, pushed the rules for high-risk uses in sensitive areas (the list includes employment, education and critical infrastructure) to December 2, 2027, and for AI built into regulated products to August 2, 2028. A lot of 2025 content still tells you August 2026 for all of it.

Two EU obligations did not move and have applied since February 2, 2025: the ban on the nine prohibited practices, and the AI literacy obligation. If you sell into the EU, "our people have been trained on the AI they use" is already a requirement, not a best practice.

The version a 10 to 200 person company can run

Here are NIST's four functions turned into five things you can finish this quarter. The shape maps cleanly onto the reference framework if a bigger customer ever asks, and it does not need a compliance team.

Item 3 and item 4 are what employees actually read, so they belong in your AI acceptable use policy, the one document everyone signs. The other three live with the owner.

What the framework documents do not tell you

Every framework assumes someone has time to run it. That is the part that fails in mid-size companies. The policy gets written, the committee meets twice, and six months later the tool inventory is fiction because three teams bought their own AI subscriptions on a card.

The fix is not a better template. It is one owner with a small, fixed amount of time, and a rule that new AI tools get added to the inventory before anyone pays for them. If you are big enough that this is a real job, that is when the chief AI officer question becomes serious. Below that, it is a few hours a month for someone who already has the vendor list.

ISO/IEC 42001 also exists as a management-system standard for AI. If a customer ever requires it, you will know, because it will be in the contract. Until then, a NIST-shaped two-pager is the one that gets used.

Where to start this week

Name the owner. Then have them send one message to every team lead: "List every AI tool your team used this month and what you put into it." That list is your Map step, and it is almost always the most surprising document in the whole exercise.

If you lead the company and want the executive view of where AI fits before you govern it, my guide to AI for executives covers that. If you want outside help, read what to ask an AI consultant before you sign anything. And if you want the inventory, the risk map and a written roadmap done for you, that is exactly what my AI Readiness Assessment produces ($2,500, delivered in two weeks).