The Small-Business Version of the NIST Framework

I love small businesses, and I know most of them will never hire a compliance department. The good news: the NIST framework scales down beautifully. You don't need four functions with subcategories. You need four honest questions, answered once a quarter.

One: Who decides which AI tools we use? (That's Govern, minus the committee.) Two: What AI are we actually using, and what data does it touch? (That's Map.) Three: Have we tested it on real examples, including checking for unfair outcomes? (That's Measure.) Four: What do we do when it goes wrong? (That's Manage.)

Don't automate chaos. Write the answers on one page, revisit them quarterly, and you're practicing AI governance at a level most enterprises haven't reached.

I explain frameworks; I don't give legal counsel.