A board-ready AI governance framework for a mid-size company fits on two pages. It names who owns AI decisions, lists the AI already in use, sets rules for what data can go into which tool, sorts each use by risk, and sets when the board hears back. The checklist below has the ten items, and each one is short enough to write before the next board meeting.
This post is for the CEO of a private company with 100 to 500 people whose board has asked for an AI policy. You probably do not have a chief AI officer or an AI risk committee. You do have staff using AI tools today, a system of record such as NetSuite, and a board that wants to see someone in charge.
The Gnar Company builds a board-grade AI roadmap and a fully scoped first build. On its AI strategy page, Gnar scores every AI opportunity on ROI, implementation cost, data readiness, reasoning risk and behavior-change cost. Governance is the set of rules that decide which of those uses the company runs, and how the board keeps track of them.
What is an AI governance framework?#
An AI governance framework is the short set of rules a company uses to decide which AI it uses, who is accountable for it, and how problems get caught and reported. It covers the tools staff pick up on their own as well as the systems the company builds or buys.
Two public standards are a good place to start. The NIST AI Risk Management Framework, released on January 26, 2023, is intended for voluntary use. NIST is revising it as part of the White House AI Action Plan, and it added a Generative AI Profile in July 2024. ISO/IEC 42001 is an international standard for an AI management system, written for organizations of any size that develop, provide or use AI.
Neither one is a policy you can hand to your board as it stands. A mid-size company needs the same ideas in a form one executive can run with the people already on staff.
Why does a private company board need one now?#
A private board needs a framework because staff may already be using AI that the company never formally adopted. In a Census Bureau working paper on its AI survey of US businesses, covering November 2025 to January 2026, 36 percent of firms where workers use AI showed no sign of formal company adoption. The authors say that pattern suggests AI spreading from the bottom up.
The Census Bureau found that 32 percent of firms with 100 to 249 employees used AI in the survey period ending May 3, 2026, a different measure from the 36 percent above.
The legal view points the same way. A May 2026 briefing for directors from the law firm Fenwick says directors have fiduciary duties to implement and monitor AI governance systems, particularly when AI represents a mission-critical business risk. The briefing is addressed to directors, and your outside counsel can tell you how it applies to a private company in your state.
The practical risk at a mid-size company is usually plain. Someone pastes customer pricing into a public chatbot. A sales team builds a quoting shortcut on a spreadsheet nobody owns. An assistant answers a question from the wrong field in the ERP. A framework makes catching each of these somebody's job.
What does the board approve, and what does management run?#
The board approves the framework, the risk limits and the large bets, and management runs everything else. Keeping that line clear stops the board from approving every chatbot and stops management from launching a risky system without telling anyone.
| Decision | Who owns it |
|---|---|
| The framework itself and any change to it | The board approves, the CEO proposes |
| Which data may never go into an outside AI tool | The board approves the rule, the AI owner (the executive named in item 1) enforces it |
| Approving a new low-risk use, such as drafting internal email | The AI owner |
| Approving a high-risk use, such as anything that sets prices or touches pay | The CEO, reported to the board |
| AI projects above a spending limit the board sets | The board |
| Who owns each core data set | The CEO assigns, the data owner runs it |
| The quarterly AI report | The AI owner writes it, the board reviews it |
Set the spending limit and the definition of high risk in the framework itself. Then the board only sees the decisions that need it.
The framework checklist: 10 items#
These ten items are the core of the framework, and each one needs only one or two short paragraphs. Written that way, the document fits on two pages.
- One named owner. Name one executive who owns AI decisions, usually the COO, CFO or head of IT. Write down what they can approve alone and what goes to the CEO or the board.
- An inventory of AI in use. List every AI tool and AI feature in use today, the team using it, and the data it touches. Ask each department head, and check expense reports and software bills for AI subscriptions. Start here, because the Census working paper above suggests part of the list may be news.
- An approved tools list. Say which AI tools staff may use for work and on which account type, such as a company account rather than a personal one. Anything not on the list needs the owner's approval.
- Data rules. Sort your data into a few classes, such as public, internal, confidential and restricted. Say which classes may go into which tools. Customer pricing, employee records and anything covered by a contract usually sit in the strictest class.
- One home for each core data set. Name the system of record for each core data set and the team that owns it. Customers, items, prices and vendors are the usual ones. The rule is simple: the data is edited only in its system of record, and every other system reads from there.
- Risk tiers. Sort every AI use into low, medium or high risk by what it can affect. Drafting an internal memo is low. Anything that changes a price, a payment, a customer record or a person's pay is high.
- A person checks high-risk output. For high-risk uses, a named person reviews the AI's output before it reaches a customer, the books or an employee. Write down who that is for each use.
- Questions for every AI vendor. Before you sign, ask each vendor where your data is stored, whether it is used to train their models, how long they keep it, and what happens to it when the contract ends. Keep the answers with the contract.
- A quarterly report to the board. The AI owner sends the board one page each quarter. The template is below.
- What to do when something goes wrong. Say who staff tell when AI produces a wrong or harmful result, how fast the owner responds, and when the board hears about it.
Items 2, 4 and 5 do most of the work. If you only have time for three, write those first.
How does the checklist map to NIST's AI Risk Management Framework?#
The checklist touches each of the four functions in NIST's framework, so you can show the board how it lines up with a public standard. NIST's framework core is built around four functions: govern, map, measure and manage. Govern is designed to run through the other three.
| NIST function | What NIST asks, in plain words | Checklist items |
|---|---|---|
| Govern | Policies and practices for AI risk are in place and followed, and legal requirements are understood and documented | 1, 3, 4, 9, 10 |
| Map | The context of each AI use is understood: what it is for, who uses it, and where | 2, 6 |
| Measure | Metrics are chosen for the risks already mapped, starting with the most significant | 7, 9 |
| Manage | AI risks are ranked, responded to and managed based on what was mapped and measured | 4, 5, 8, 10 |
NIST says its actions are not a checklist and are not necessarily an ordered set of steps. That leaves room for a short version. The ten items above are one company-sized way to touch each function.
How does it line up with the five pillars Fenwick recommends?#
The checklist also maps to the five pillars that Fenwick's briefing recommends for a board's AI framework. If a director has read that briefing, this table shows where each pillar has a home in your two pages.
| Fenwick's pillar | Where it sits in the checklist |
|---|---|
| Strategy and investment | The spending limit in the decision table, and your AI roadmap |
| Risk assessment and oversight | Items 6, 7 and 9 |
| Accountability for AI systems and decisions | Items 1 and 5, plus the decision table |
| Stakeholder transparency | Item 9 covers the board. The company still has to decide what it tells customers and employees about its AI use |
| Legal and regulatory compliance | Items 4 and 10, with your outside counsel |
The same briefing also suggests rules for the AI tools directors themselves use: which tools are allowed, what data may be shared, how long it is kept, and what security the provider must meet. Add one line for that under item 3.
What should the board see every quarter?#
The board should see one page every quarter that shows what changed, what went wrong and what it needs to decide. Keep the same headings every time so directors can compare quarters.
- Inventory changes. AI tools added or removed since the last report, with the team and the data class for each.
- New uses approved. Each new use, its risk tier and who approved it.
- Incidents. What went wrong, who caught it, and what changed so it does not happen again. Include the number of incidents and the number of high-risk outputs the reviewer corrected.
- Results. For each approved AI project, the target set when it was approved and the result so far.
- Data problems found. Core data sets that turned out to live in two places, or that nobody owned.
- Decisions for the board. Anything above the spending limit and any change to the framework. Also list the high-risk uses the CEO approved, for the board's information.
A one-page report with these six headings covers what the board approved and what it needs to decide. It also leaves a written record that the board did its oversight.
How data ownership shaped the AI plan at Counter Culture Coffee#
At Counter Culture Coffee, the data map found the data foundation needed guardrails before wider use across the company, and the recommendation was one home for each of the master data sets kept in spreadsheets or in more than one system. Counter Culture is a specialty coffee roaster that runs on NetSuite, with Shopify for commerce, Zoho for account management and spreadsheets doing supporting work. The engagement mapped every system and data flow with NetSuite at the center, and the findings were presented to Counter Culture's board.
The data map found a foundation that was "largely sound in the hands of the system experts who know it, but it needs guardrails before wider use across the company." A handful of master data sets lived in spreadsheets or in more than one system. That meant manual re-keying and reports that did not always match. Pulling a reliable number from NetSuite often depended on the few people who knew which fields to use.
That matters for AI. An assistant is only as reliable as the data it reads, and it has no way to know which of two similar fields is the right one.
The recommendation was to give each of those data sets a single home in NetSuite or Zoho, based on which team owns and uses it most, and to retire the spreadsheet and duplicate copies. Master data is edited only in its system of record, and every other system reads from there. That is item 5 on the checklist above.
Governing a trusted set of NetSuite data, with agreed definitions and clear ownership, makes three complex builds possible at once: a plain-language query assistant, an executive scorecard and automated board reporting. At Counter Culture, weak data readiness capped an opportunity's score regardless of its upside.
The plan also put people in charge. Counter Culture left with 34 projects ready to start and 8 already underway, led by five internal champions from IT, finance and operations using Claude.
How do you get the framework approved at the next meeting?#
You get it approved by sending a short draft early, with the inventory attached, and asking for one clear vote. The steps below fit in the weeks before a regular board meeting.
- Build the inventory first. Ask each department head what AI their team uses and on what data. At Counter Culture, the systems map grouped more than 60 tools by function. The inventory is the evidence that the framework is needed.
- Draft the two pages. Write the ten items in plain language, with the decision table and the risk tiers.
- Name the owner and the data owners. Put names next to items 1 and 5.
- Have counsel read the data rules. Ask outside counsel to check items 4 and 10 against your contracts and your state's laws.
- Send it ahead of the meeting. Give directors time to read it, and talk it through with the board chair before the meeting.
- Ask for one vote. Ask the board to approve the framework, the spending limit and the date of the first quarterly report.
If the board also wants to see where AI will pay off, Gnar's post on an AI roadmap the board will fund covers that plan. A quick way to see where your company stands is Gnar's AI Readiness Assessment, a 10-question check. If the inventory turns up core data spread across systems, cleaning it up at the source comes before any AI that reads it.
Producing code is close to free now. Understanding your operation is not. A good governance framework is mostly a written record of that understanding: what you use, what data it reads, who owns it, and when the board will hear about it.
