By Laas NurySearch for "AI governance framework" and you get documents written for banks and governments: steering committees, ethics boards, dozens of controls and a maturity model. For a company with a few hundred people and a handful of AI tools, that is not governance. It is a reason to do nothing.
Governance for a mid-sized company has to answer five questions, and each answer fits in a few lines: who is responsible, what do we use, how does something new get approved, how do we keep an eye on it, and what do we do when it goes wrong. This article gives you the one-page version, and explains each part.
The one page
| Part | What it says | Who | How often |
|---|---|---|---|
| 1. Owner | One named person is accountable for AI in the company | A member of management | Permanent |
| 2. Register | Every AI tool and AI feature in use, with owner, purpose and data | The owner keeps it | Updated with every change |
| 3. The check before go-live | Every new AI use is checked in three questions before it is used | The owner, with the requester | Per new use |
| 4. Controls per level | What each level of use requires: from "use with care" to "tested, logged, approved" | The tool owner | Per use |
| 5. People | The AI policy and an introduction for everyone; deeper explanation for daily users | The owner and team leads | First week, and per new tool |
| 6. Incidents | Where to report, who acts, what gets recorded | The owner | When it happens |
| 7. Review | The register, the incidents and the rules are reviewed | Management | Every quarter, briefly |
That is the whole framework. The rest of this article explains the parts that need it.
1. One owner, not a committee
One person in management is accountable for AI in the company. Often that is the COO, the operations manager, the IT lead or the CFO: someone who knows the processes and can say no. They do not need to be technical. They need to keep the register current, run the check on new uses, and bring the quarterly review to the table.
The EU AI Act does not require an AI officer or a governance board, and the European Commission says so explicitly. What it does require is that you know your AI and can show what you did about it.
2. The register: what you actually use
The register is the foundation. One line per AI tool or AI feature, including the AI switched on inside software you already use:
- What it is and what it is used for.
- Who owns it, and who uses it.
- Which data goes in, and where that data is stored.
- Its level (see part 4).
- What users need to know, and when they got the introduction.
Most mid-sized companies end up with five to fifteen lines. If you cannot fill in a line, you have found your first governance issue.
3. The check before something new goes live
Every new AI use, whether a new tool or a new purpose for an existing one, goes through three questions before anyone relies on it:
- Does it make or support decisions about people? Hiring, assessing staff, credit, insurance pricing, access to services. If yes: it is probably a high-risk use under the EU AI Act, and it needs level 3.
- Does personal data or confidential information go in? If yes: check the GDPR basis, where the data is stored and whether the supplier trains on it. Where the use is likely to create a high risk for people, do a DPIA.
- Does it act on its own, or does a person check every output before it is used? If it acts on its own: it needs limits, a log and a way to stop it.
The answers decide the level.
4. Three levels, three sets of controls
| Level | When | What it needs |
|---|---|---|
| 1. Use with care | A person uses the output and checks it; no personal data or decisions about people | Listed in the register; covered by the AI policy; users introduced |
| 2. Checked and recorded | Personal or confidential data goes in, or the output feeds a business process | Level 1, plus: supplier and data location checked, a named owner who knows its failure modes, spot checks on the output, a DPIA where needed |
| 3. Tested, logged and approved | It acts on its own in your systems, or it makes or supports decisions about people | Level 2, plus: tested on real cases before go-live, a full log of what it did, human approval for anything irreversible, limits and a way to stop it, and the specific AI Act duties where it is a high-risk use |
Most of what a company uses sits at level 1. A few processes sit at level 2. Level 3 is where the effort belongs, and it should be rare.
5. People
Governance fails when the people using AI do not know the rules. Two things cover it: the AI policy with a short introduction for everyone, and an explanation of each tool for the people who use it daily. This is also your answer to the AI Act's AI literacy duty. Our article on writing an AI policy includes a two-page template.
6. When something goes wrong
Decide in advance where people report problems (an address, a person), who looks at them, and what gets recorded. Typical incidents: personal data put into an unapproved tool, an AI output that reached a customer unchecked, an agent that did something outside its limits. Make reporting easy and blame-free; the incidents you hear about are the ones you can fix.
7. The quarterly review
Thirty minutes, once a quarter, with management:
- What was added to the register, and what was removed?
- Which incidents happened, and what changed because of them?
- Is anything moving towards level 3, such as a new use that touches decisions about people?
- Are there deadlines coming up, such as the EU AI Act's high-risk obligations from December 2027?
That is enough to keep governance alive without it becoming a job.
When you need more
The one-page framework is sized for a company that uses AI. You need more when:
- You build AI for others. Then you are a provider under the AI Act, with duties of your own.
- You have several high-risk uses, such as AI in hiring or credit decisions.
- Your customers ask for certification. ISO/IEC 42001, the international standard for AI management systems, is the usual answer. The NIST AI Risk Management Framework is a free, well-structured reference for going deeper.
For everyone else: one page, one owner, and a register that is actually kept up to date will do more than a sixty-page framework nobody opens. For the legal background behind the levels, see the EU AI Act for companies that use AI.
