Key takeaways
- NIST's AI Risk Management Framework (AI RMF) is voluntary, published by a federal standards agency, and free to read at nist.gov.
- It has four functions: Govern, Map, Measure, and Manage — each one maps to something a small business can do without a compliance team.
- Govern means naming an owner and writing down the rules. Map means knowing what AI tools you actually use.
- Measure means checking a tool's risk before you rely on it. Manage means fixing problems and reviewing on a schedule.
- You don't need to adopt the whole framework formally — even applying it informally puts a small business ahead of where most currently are.
NIST's AI Risk Management Framework sounds like it was written for a Fortune 500 compliance department, and in some of its detail, it was. But the four functions underneath it — Govern, Map, Measure, Manage — describe exactly the same set of questions any small business should already be asking about the AI tools it uses. This guide translates each one into something you can actually do this month.
What the NIST AI RMF actually is
The National Institute of Standards and Technology (NIST) is the U.S. government's standards agency — the same body behind widely used cybersecurity frameworks. In 2023, it published the AI Risk Management Framework (AI RMF), a voluntary set of guidance for organizations building, buying, or using AI systems. It isn't a law, a certification, or a checklist you file with anyone. It's a shared vocabulary and structure for thinking about AI risk, and it's increasingly the reference point that insurers, enterprise customers, and even regulators point to when they ask a smaller vendor how it manages AI.
The framework itself doesn't require anything specific — no particular tool, no particular headcount, no specific document. That flexibility is what makes it usable by a five-person company and a five-thousand-person one at the same time, at very different levels of formality.
The four functions, translated
The full framework document runs long, with detailed subcategories meant for larger AI development teams. For a small business using AI tools rather than building them, the four functions collapse into something much simpler.
| NIST function | What it means for a small business |
|---|---|
| Govern | Someone owns AI decisions, and there's a written policy people can point to. |
| Map | You know which AI tools are actually in use, and what data each one touches. |
| Measure | Before relying on a tool, you've checked basic things: data handling, accuracy limits, who reviews the output. |
| Manage | You act on what you find — fix gaps, retire risky tools, and revisit the whole thing on a schedule. |
Govern: name an owner, write it down
This is the foundation the other three functions sit on. Without a named owner and a basic policy, "we manage AI risk" is just a feeling, not a process. See our AI governance starter kit for exactly how to set this up in an afternoon.
Map: know what you're actually running
Most small businesses underestimate how many AI tools are already in use across the team — built into software they already pay for, adopted individually by employees, or added by a vendor without much fanfare. Mapping means writing all of it down in one place: the tool, who uses it, and what kind of data passes through it.
Measure: check before you trust
Once you know what's in use, look at each tool with a short, consistent set of questions — does it retain your data, does it train on your input, who's accountable if it gets something wrong. This doesn't require technical expertise; it requires asking the vendor directly and writing down the answer.
Manage: act on it, then repeat
Findings that go nowhere aren't risk management. If Measure turns up a tool with no admin controls handling customer data, Manage is the step where you either restrict its use or replace it — and then put the next check on the calendar so the cycle continues.
You don't have to move through Govern, Map, Measure, Manage in strict sequence. What matters is that all four keep happening on a recurring basis, not that you complete them once in order.
Why this is worth doing now, not later
The businesses most exposed to AI risk aren't the ones using AI aggressively — they're the ones with no visibility into how it's already being used. Data security and compliance concerns are the single biggest barrier to AI adoption for small and midsize businesses, cited by 49% of SMB leaders in Upwork's 2026 State of AI in SMBs research. A lightweight application of the NIST functions is exactly what turns that hesitation into something manageable: you don't have to stop using AI to reduce the risk, you have to know what's happening and check it periodically.
The framework covers more than chatbots
Most small businesses first encounter AI risk through everyday tools — chatbots, writing assistants, transcription software. The NIST framework was written with a broader scope in mind, including AI systems that make or influence decisions: resume screening, credit or eligibility scoring, pricing algorithms, and automated content moderation. If your business uses any AI feature that affects a real decision about a customer or employee — not just drafts text — that feature deserves a closer look under the Measure function specifically, since the cost of an error is higher than a poorly worded email.
This doesn't mean every small business needs to apply the full weight of the framework to every tool. It means the four functions scale in intensity along with the stakes: a chatbot used for internal brainstorming gets a light touch, while a tool that decides which applicants move forward in a hiring process deserves real scrutiny before it's trusted.
What NIST means by "trustworthy" AI
The framework organizes its guidance around the idea of trustworthy AI — systems that are valid and reliable, safe, secure, accountable and transparent, explainable, privacy-enhanced, and fair. For a small business, most of these translate into questions you can ask a vendor directly rather than technical properties you need to measure yourself:
- Reliable: Does the tool perform consistently, or does its output vary unpredictably in ways that matter for your use case?
- Safe and secure: Does the vendor have basic security practices, and what happens to your data if something goes wrong on their end?
- Transparent: Can you tell customers, when relevant, that AI was involved in a decision or response?
- Fair: If the tool influences a decision about a person — hiring, pricing, eligibility — has anyone checked whether it treats similar cases consistently?
None of these require a technical audit for most small-business use cases. They require asking the right question before you rely on a tool, and writing down the answer — which is exactly what the Measure function is for.
How this relates to actual regulation
It's worth being precise about what the NIST framework is and isn't, because the two get conflated often. It is not a law, and adopting it doesn't automatically satisfy any specific state or federal requirement — those come from separate statutes, and some industries layer their own rules on top (health data, financial services, employment decisions). What the framework does provide is a common structure that regulators, insurers, and larger business partners increasingly recognize and reference, even when it isn't legally mandatory. A small business that can point to a Govern/Map/Measure/Manage process, however informal, is often in a stronger position when a partner, insurer, or regulator asks how it manages AI risk — not because the framework itself carries legal weight, but because it demonstrates the underlying practice actually exists.
A simple starting checklist
- Name one person as the AI risk owner (Govern).
- Build a one-page list of every AI tool currently in use and what data it touches (Map).
- Ask each vendor four questions: data retention, training on your data, SSO/admin controls, and human-review expectations (Measure).
- Set a quarterly date to revisit the list, retire unused tools, and update the answers (Manage).
- Write a short policy that reflects what you find, and route it through your attorney before rolling it out.
None of these five steps requires new software or a consultant to execute. They require roughly a day of focused attention from one person, followed by a recurring thirty-minute check-in each quarter. That's a modest investment set against what the framework is meant to prevent — an AI-related mistake nobody saw coming because nobody was looking.
It's worth revisiting this checklist any time the business changes in a way that touches AI use — a new hire in a role that handles customer data, a new software platform that adds AI features, or a new state law that affects your industry. The framework itself doesn't expire, but your specific application of it does, once enough has changed underneath it.
Once this checklist is in motion, most of the rest of your AI governance work is just maintaining it. Pair it with a written AI acceptable use policy so the Govern function has something concrete behind it, and revisit our AI governance starter kit for the full register template.
◆ Small Business AI Kickstart
Get AI ready today.
Before it's too late.
yforest AI Labs comes to your company, trains your team, and ships your first tools.
FAQ
Is NIST's AI RMF a law we have to follow?
No. It's a voluntary framework published by the National Institute of Standards and Technology. Nobody is required to adopt it, but it's increasingly used as the reference point insurers, partners, and regulators point to when they ask how a company manages AI risk.
Do we need a formal risk management program to use this framework?
No. A small business can apply the four functions informally — a tool register for Map, a short checklist for Measure, a named owner for Govern, and a review date for Manage — without building a formal program.
How is this different from just having an AI acceptable use policy?
The policy tells employees what's allowed. The RMF is a broader way of thinking about AI risk across the whole business — including tools you build or buy, not just how staff use chatbots day to day.
Where do we start if this feels like too much at once?
Start with Map: write down every AI tool currently in use and what data it touches. That single step usually reveals more risk than owners expect, and it's the foundation the other three functions build on.
Does adopting the NIST AI RMF replace legal or compliance advice?
No. It's a risk management framework, not a substitute for legal review of contracts, privacy law, or industry-specific regulation. Use it alongside legal counsel, not instead of it.
Sources
This guide is general information, not legal advice. Have a qualified attorney review any policy before you adopt it.