A board member at a healthcare provider gets a question from the accountant: which AI governance framework does the organisation use? She has a three-page AI policy, a list of allowed tools and a training that was given last year. Whether that counts as a framework, she does not know.
The answer: almost. An AI governance framework is a fixed structure of roles, processes and controls through which an organisation handles AI responsibly. It does not say what you decide; it arranges how you arrive at decisions and how you show they are followed. The well-known frameworks are written for organisations that build AI systems or deploy them deliberately. If you mainly use existing AI tools, a small framework of four questions is enough, with an owner per question. The board member is missing two of the four.
What do we mean by a framework?
Three things run together under that word. There are principles: transparency, fairness, human oversight. There are management systems: a cycle of planning, doing, checking and adjusting, with roles, documentation and an audit. And there is legislation, which you do not choose but which applies.
A framework in the sense the accountant means is the second. It answers questions such as: who owns an AI application, how do we assess the risk, when do we look again, and what do we keep as evidence. An AI policy is an outcome of such a structure, not the structure itself. How to write that policy is in writing an AI policy.
Which frameworks exist, and what are they about?
| Framework | What it is | For whom | What it means for everyday AI use |
|---|---|---|---|
| ISO/IEC 42001 | Certifiable management system standard for AI, built like ISO 27001: context, leadership, risk assessment, controls, improvement | Organisations that develop or deploy AI and want to manage it demonstrably | Requires an inventory of AI systems, a risk assessment per system and recorded roles; says nothing about one specific tool |
| NIST AI RMF | Voluntary framework from the US NIST with four functions: Govern, Map, Measure, Manage | Anyone; there is no certification | A way of thinking. Map and Measure ask exactly the questions that count here: which AI is there, and what do we measure about it |
| AI Act | Law, not a framework; obligations per role (provider, deployer) and per risk class | Anyone who offers AI systems in the EU or deploys them | AI literacy (Article 4) and the prohibited practices since 2 February 2025; high-risk rules for applications such as recruitment and evaluation |
| Four questions | A small framework for the use of existing AI tools | Organisations that build no models | Which tools, which decision, do people know, can you show it |
If you already run an ISMS under ISO 27001, you do not need to start a second system for AI use; the existing controls for policy, suppliers and awareness cover a lot, as ISO 27001 and AI shows. What the AI Act concretely asks of an employer, with the dates after the omnibus, is in the EU AI Act for employers.
Why do these frameworks only half fit everyday use?
Because they start from an inventory you already have. ISO/IEC 42001 and the NIST AI RMF assume the organisation knows which AI systems it deploys, and then help with assessing and managing them. That holds for a triage model you had built yourself. It does not hold for the transcription tool a team lead started using last month.
With everyday use of AI tools the inventory is not the starting point but the work. Tools arrive from below, in a browser tab, without a project and without an owner. A framework that starts at "assess every AI system" skips the question that comes before it: which systems are those, actually. What that use is and why a ban does not make it disappear is in what is AI governance and on the AI governance topic page.
What the large frameworks do teach, and what a small framework should take from them: an owner per question, a moment of reassessment, and evidence that consists of more than a signature.
Which four questions are enough?
- Which AI tools are really used here? Not which were bought, but which are opened. This is the question the large frameworks skip, and the only one you cannot answer with a meeting.
- What have we decided per tool, and about which not yet? Four outcomes: allowed, limited use, no decision yet, not allowed. The third is a real status, not a gap. Which fields go with it is in an AI register: what you record in it.
- Do people know that at the moment they open a tool? A decision in a document sent round last year is not a decision that works. It has to be visible where the work happens, with the alternative next to it.
- Can we show that this is how it goes? With figures at organisation level: the share of use through allowed tools, the number of tools without a decision, what happened after a notice. Without people, because none of the four questions needs a name. Why a dashboard is not yet evidence of that is in a dashboard is not evidence.
