NIST AI RMF for small business: the plain-English operator's guide.

The counterargument runs first. Most small businesses believe AI governance is big-company theater. It is not. The carriers underwriting your cyber policy, the buyers signing your master agreement, and the state attorneys general writing 2026 enforcement actions all use the same playbook. They ask for written AI policy, named risk owners, and a logged risk register. If you cannot produce them, you are uninsurable, unsellable, or unprosecutable in your own defense.

The good news is that the minimum viable governance posture is cheap, fast, and aligned to the three frameworks that matter. This guide explains all three in operator language and tells you what to document this quarter.

What is NIST AI RMF in one paragraph?

The NIST AI Risk Management Framework is a voluntary US framework published in January 2023 that organizes responsible AI deployment into four functions. Govern sets the policy. Map identifies the AI systems and their context. Measure quantifies the risks. Manage handles ongoing monitoring and incident response. The framework is not law. It is the reference text every US regulator, insurance carrier, and enterprise procurement team now uses as the default benchmark of due care.

What do the four functions actually mean for a 50-person company?

Govern. A written AI policy signed by the CEO. It names the policy owner, the escalation path, the approved AI systems, and the prohibited use cases. Two pages is fine. Two pages signed beats forty pages drafted.

Map. A risk register. One row per AI system in use. Columns for system name, vendor, data flowing in, output produced, business function affected, risk classification, and named owner. A 12-row spreadsheet is enough for a 50-person company.

Measure. A quarterly review where the named owners log incidents, near-misses, and material changes to any AI system. Sixty minutes per quarter. Documented.

Manage. An incident response procedure. Who gets called when an AI system produces a bad output that reaches a customer or a regulator. Which customers get notified. Which logs get preserved. Which insurer gets called. One page.

Does the EU AI Act actually apply to a US small business?

Article 2 of Regulation (EU) 2024/1689 establishes extraterritorial scope. The Act applies to any provider or deployer whose AI system output is used in the EU, regardless of where the provider or deployer is established. A US SMB sending AI-generated outbound emails to EU prospects is in scope. A US SMB whose AI-scored candidate evaluations are used by an EU subsidiary is in scope. A US SMB with no EU customers and no EU partners is out of scope.

The phased applicability timeline matters. Prohibited practices applied from February 2, 2025. General-purpose AI obligations applied from August 2, 2025. Article 50 transparency applied from August 2, 2026. Annex III high-risk obligations apply from December 2, 2027, and Annex I high-risk obligations from August 2, 2028, under Regulation (EU) 2026/1744. Most SMB use cases (lead triage, proposal drafting, meeting summary) fall into the minimal-risk or limited-risk category and require transparency disclosures rather than conformity assessment. The transparency disclosures are still mandatory. Most SMBs have not implemented them.

What about state-level US legislation?

Colorado SB 26-189 replaced SB 24-205 and starts January 1, 2027. Impact assessments, risk programs and duty of care were removed. Notice, a 30-day adverse-outcome explanation, human review on request and 3-year records remain, with AG-only enforcement and a 60-day cure until January 1, 2030. California SB 942, as amended by SB 1000 effective September 30, 2026, governs AI transparency and removes the 1 million user threshold. Texas TRAIGA (HB 149) took effect January 1, 2026. New York City Local Law 144 regulates automated employment decision tools and applies to any employer hiring in NYC.

None of these is conditioned on company size. A 30-person company hiring in NYC has the same Local Law 144 obligations as a 30,000-person company. The cost of compliance for a small company is low, but only if the system is configured for it from the start. Retrofitting compliance into a poorly configured AI deployment is expensive.

What is ISO/IEC 42001 and should an SMB pursue certification?

ISO/IEC 42001:2023 is the first international management system standard for AI. It is structured the same way ISO 27001 is structured for information security. The standard defines requirements for an AI Management System (AIMS) and is certifiable through accredited bodies. Annex A defines 38 specific controls covering data, lifecycle, third-party relationships, and impact assessment.

For B2B SMBs selling into the enterprise, ISO 42001 alignment will show up in RFPs the same way SOC 2 did between 2018 and 2020. Alignment (self-attested) is achievable in 90 days. Certification (third-party audited) is a 9-to-12 month engagement and is premature for most companies under 100 seats.

What is the difference between aligned and certified, and why does it matter?

Aligned means the organization has implemented the framework's controls and self-attested to that implementation. Certified means an accredited third-party body has audited the implementation and issued a formal certificate. NIST AI RMF does not have a certification scheme. All NIST alignment is self-attested. ISO 42001 does have a certification scheme. The EU AI Act has a conformity assessment process for high-risk systems but no general AI certification.

Honest service providers say aligned when they mean aligned. Providers who claim NIST certification are misrepresenting the framework. This matters because the misrepresentation itself becomes a discoverable item in a regulatory action or breach litigation. The cheapest insurance is precise language.

FAQ

Sources

1. NIST, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)," NIST AI 100-1, January 2023.
2. NIST, "Generative AI Profile," NIST AI 600-1, July 2024.
3. European Commission, Regulation (EU) 2024/1689 (EU AI Act), Articles 2, 9, 26, and 99, Official Journal of the EU, July 2024.
4. ISO/IEC 42001:2023, "Information technology, Artificial intelligence, Management system," International Organization for Standardization, December 2023.
5. Colorado General Assembly, SB 26-189, signed May 14, 2026, duties effective January 1, 2027, impact assessments removed.
6. California Legislature, SB 942 as amended by SB 1000, effective September 30, 2026.
7. Texas Legislature, TRAIGA (HB 149), effective January 1, 2026.
8. New York City Department of Consumer and Worker Protection, "Automated Employment Decision Tools (Local Law 144)," rules effective July 5, 2023.