A board member at a healthcare provider gets a question from the auditor: which AI governance framework does the organisation use? She has a three-page AI policy, a list of allowed tools and a training session held last year. She does not know whether that counts as a framework.
The answer: almost. An AI governance framework is a fixed structure of roles, processes and controls through which an organisation handles AI responsibly. It does not say what you decide; it sets out how you arrive at decisions and how you show they are followed. The well-known frameworks are written for organisations that build AI systems or deploy them deliberately. If you mainly use existing AI tools, a small framework of four questions is enough, with an owner for each question. The board member is missing two of the four.
What do we mean by a framework?
Three different things go by that name. There are principles: transparency, fairness, human oversight. There are management systems: a cycle of planning, doing, checking and adjusting, with roles, documentation and an audit. And there is legislation, which you do not choose but which applies anyway.
A framework in the sense the auditor means is the second. It answers questions such as: who owns an AI application, how do we assess the risk, when do we look again and what do we keep as evidence? An AI policy is an outcome of such a structure, not the structure itself. For how to write that policy, see writing an AI policy.
Which frameworks exist, and what are they about?
| Framework | What it is | For whom | What it means for everyday AI use |
|---|---|---|---|
| ISO/IEC 42001 | Certifiable management system standard for AI, built like ISO 27001: context, leadership, risk assessment, controls, improvement | Organisations that develop or deploy AI and want to be able to show they manage it | Requires an inventory of AI systems, a risk assessment per system and recorded roles; says nothing about one specific tool |
| NIST AI RMF | Voluntary framework from the US NIST with four functions: Govern, Map, Measure, Manage | Anyone; there is no certification | A way of thinking. Map and Measure ask exactly the questions that count here: which AI is there, and what do we measure about it |
| AI Act | Law, not a framework; obligations per role (provider, deployer) and per risk class | Anyone who offers AI systems in the EU or deploys them | AI literacy (Article 4) and the prohibited practices since 2 February 2025; high-risk rules for applications such as recruitment and evaluation |
| Four questions | A small framework for the use of existing AI tools | Organisations that do not build models | Which tools, which decision, whether people know it, whether you can show it |
If you already run an ISMS under ISO 27001, you do not need to start a second system for AI use; the existing controls for policy, suppliers and awareness cover a lot, as our article on ISO 27001 and AI use shows. For what the AI Act asks of an employer, with the dates as revised by the Digital Omnibus, see the EU AI Act for employers.
Why do these frameworks only half fit everyday use?
Because they start from an inventory you already have. ISO/IEC 42001 and the NIST AI RMF assume the organisation knows which AI systems it deploys, and then help with assessing and managing them. That works for a triage model you commissioned yourself. It does not work for the transcription tool a team lead started using last month.
With everyday use of AI tools, the inventory is not the starting point but the work. Tools come in from the bottom up, in a browser tab, with no project and no owner. A framework that starts at "assess every AI system" skips the question that comes before it: which systems are we actually talking about? For what that use looks like and why a ban does not make it go away, see what AI governance is and the AI governance topic page.
What the large frameworks do teach, and what a small framework should borrow from them: an owner for each question, a set moment to reassess and evidence that amounts to more than a signature.
Which four questions are enough?
- Which AI tools are really used here? Not which were bought, but which are opened. This is the question the large frameworks skip, and the only one you cannot answer with a meeting.
- What have we decided for each tool, and which are still undecided? Four outcomes: allowed, limited use, no decision yet, not allowed. The third is a real status, not a gap. For the fields that go with it, see what to record in an AI register.
- Do people know that at the moment they open a tool? A decision in a document sent round last year is not a decision that works. It has to be visible where the work happens, with the alternative next to it.
- Can we show that this is what happens in practice? With figures at organisation level: the share of use through allowed tools, the number of tools without a decision, what happened after a notice. Not about people, because none of the four questions needs a name. A dashboard on its own does not yet prove it; A dashboard is not evidence explains why.
