AI Governance Framework: A Simple Template for Mid-Sized Companies

An AI governance framework is the set of rules a company uses to decide which AI tools get approved, who signs off on a new use case, and what data those tools can touch. A mid-sized company does not need an enterprise programme to get this right. Four parts are enough: an inventory, risk tiers, a named owner, and a review cadence.

Most of the AI governance material written for large enterprises assumes a dedicated compliance function and a multi-quarter rollout. A mid-sized company has neither. What it has is a handful of teams already using AI tools, a leadership team that wants to say yes to that without losing sight of the risk, and no time to read an 80-page framework before deciding what to do Monday morning. This post is the version built for that company.

Why this gap is showing up now

A June 2026 survey by Netrio, run by Censuswide, asked 401 US IT leaders at organisations with 200 to 5,000 employees about AI. Eighty-two percent said AI is in production somewhere in their organisation or in widespread use. Only 26 percent said it is scaled and governed enterprise-wide. Forty-two percent have a formal AI policy with actively enforced controls.

Netrio is a managed service provider, so read this as vendor research rather than an independent audit. Even allowing for that, the shape of the finding matches what we see in our own engagements: adoption moves faster than the rules meant to manage it. Employees and teams pick up AI tools long before a company decides how to govern them, not because anyone is being reckless, but because the tools are one browser tab away and the governance conversation has not happened yet.

That gap between adoption and governance is the actual risk, more than any single tool. A company with no inventory does not know how many AI tools are touching customer data, let alone whether any of them should be. Closing that gap does not require slowing adoption down. It requires writing down four things before the gap gets any wider. Our shadow AI guide covers how to find out what is already in use, which is the honest starting point for the inventory below.

The four parts of a starter framework

These four parts are our recommendation. They simplify two public references worth knowing about. The NIST AI Risk Management Framework has a core of four functions: Govern, Map, Measure, and Manage. IBM's implementation guide runs to eight steps. Neither is wrong. Both assume more headcount than a mid-sized company has to spend on governance alone.

An AI inventory. A living list of every AI tool in use, official or not, with a named owner for each one. This is the part most companies skip, and it is the part everything else depends on. You cannot tier risk for a tool nobody has written down.

A risk tier for each use case. AI uses carry different stakes, so each needs a different level of review. The three-tier model below gives you a starting point, and it is deliberately simple enough that a manager can apply it without calling the framework owner for every decision.

A named owner for the framework itself. Someone whose job includes updating the rules when a new tool or a new law shows up. This does not need to be a dedicated hire. It needs to be someone's explicit responsibility, in writing, so the framework has a single point of accountability instead of quietly belonging to everyone and no one.

A review cadence. A set date when the inventory and risk tiers get checked again, so the framework does not quietly go stale while the tools underneath it keep changing. A framework reviewed once and never again is a snapshot, not a programme.

AI governance also depends on the data underneath it. Our sister site's data governance framework guide covers owners, definitions, and access rules for that data, which is worth lining up alongside the inventory above before you tier risk for anything that touches it.

A simple risk tiering model

Three tiers are enough to start. This model is our own recommendation, not a published standard, and it is built to be applied by a manager in the moment rather than escalated for every request.

Low risk. Brainstorming, drafting, and internal research with no client or employee personal data involved. Needs no approval beyond the tool being on the approved list.

Medium risk. Company data is involved, or the output reaches a client, but a person reviews it before it goes out. Needs a manager's sign-off, logged once rather than re-approved every time the same workflow runs.

High risk. The AI tool makes or shapes a decision about a customer or employee, or data leaves company systems with no human review. Needs sign-off from whoever owns the framework, logged in the inventory alongside the use case it covers.

The tiers exist to make the easy decisions fast, not to make every decision slow. Most AI use inside a mid-sized company sits in the low tier. Treating all of it as medium or high risk is the fastest way to make people route around the framework entirely.

Two tools, two approval paths

Here is a hypothetical example, not drawn from a client, that shows how the tiers work in practice.

A marketing team at a 150-person company wants an AI tool to draft social posts from competitor research. The tool touches no client or financial data, so it lands in the low risk tier. It goes on the approved list, and the team starts using it the same week, with no further sign-off required.

A finance team at the same company wants an AI tool to draft first-pass variance commentary from the monthly close. That touches financial data and reaches other departments, so it lands in the medium tier. A manager reviews the first month of output before it goes out unsupervised, and once that review is clean, the workflow runs with spot checks rather than line-by-line approval.

Two tools, two approval paths, from the same four-part framework. That is the point. The framework should make the easy decision fast and the harder decision deliberate, without forcing every request through the same review queue regardless of what is actually at stake.

When a lightweight framework is not enough

ISO/IEC 42001 is the certifiable AI management system standard. ISO says it applies to organisations of all sizes and sectors. Certification involves an external audit, so it is worth considering when a client, regulator, or contract specifically asks for it, not as a default next step after the starter framework is in place.

Until then, the four-part framework above is a practical starting point, not a placeholder for something more serious later. Most mid-sized companies get real value out of the inventory and the risk tiers alone, long before certification is anywhere on the table, and the framework you build now becomes the evidence base if certification does come up.

We built a one-page version of this framework your team can fill in directly. Take our AI Readiness Scorecard to see where your organisation stands first, or talk to our team if you want help applying the framework itself.