An AI governance framework is the set of roles, policies, controls and checks that decide how your company chooses, builds, uses and monitors AI. For a SaaS company with 20 to 200 people, it comes down to five things: a named owner, a register of every AI use, a risk tier for each use, a short policy people can follow, and controls built into the systems themselves. This guide shows how to build each one, which outside frameworks to borrow from, and where AI should not be used at all.

TL;DR

Table of Contents

What an AI governance framework is

Strip away the vendor language and the definition is simple. NIST’s AI Risk Management Framework describes governance as the policies, processes, documentation, roles and competencies that manage AI risk across the full lifecycle, aligned with organizational values and covering third-party systems and data. In plain terms: who decides, on what basis, with what evidence, and who answers when something goes wrong.

If you want the broader business case for governance as a discipline, corporate governance basics show the same logic of accountability and oversight applied to a whole company.

Why a growing SaaS company needs one

Most SaaS teams already use AI. Sales drafts outreach with an assistant, support pastes tickets into a chatbot, finance tries a model on reconciliations, engineers use code assistants. Nobody decided this as a company, and nobody owns it. That is the gap a framework closes.

The practical payoff is speed, not paperwork. A well-run framework gives you what BetterCloud calls a foundational operating system of roles and controls that makes AI adoption faster, more secure and auditable in the shared-responsibility setups typical of SaaS. Your enterprise customers will also ask for it in security questionnaires, usually before they ask about your model.

The components every framework needs

The Human Technology Institute at UTS lists the essentials: accountability structures, AI principles and policies including red lines, risk management, and practical controls for monitoring and reporting across the lifecycle. The same paper makes a point worth remembering: principles alone are not enough. They have to become specific red lines for buying, designing and deploying AI.

Here is how that translates for a 20 to 200 person company.

Component What it looks like in a SaaS company
Accountability One named executive owner, plus a named owner for each AI use
Principles and red lines A half-page list of what AI may never do here
Inventory A living register of every AI tool and use
Risk tiers Low, medium, high, each with required controls
Practices and controls Checklists, approval steps, permissions, logging
Monitoring Scheduled reviews, incident handling, vendor change tracking

The four activities from NIST

NIST organizes the work into four linked functions. GOVERN sets accountability and policies, MAP establishes context and potential impacts, MEASURE tests and monitors, and MANAGE prioritizes and treats risk. GOVERN runs through everything else, while the other three apply to specific AI systems and lifecycle stages. For a small company, read it as a loop: decide who is in charge, understand each use, check how it behaves, fix what is wrong, repeat.

Four linked NIST AI governance functions

ISO/IEC 42001 as a management system

ISO/IEC 42001:2023 defines an AI management system as interrelated organizational elements that set policies, objectives and the processes to achieve them, and it requires continual improvement. It is built for organizations of any size that develop, provide or use AI. You do not need certification to borrow its logic. If a large customer later asks about it, your framework will already follow a recognizable shape.

Who should own AI governance

The most common failure is shared ownership, which means no ownership. The HTI paper recommends a hierarchy of responsibilities that defines who is accountable for decisions on AI procurement, management and ongoing oversight. Here is a workable split for a growth-stage SaaS company:

  1. One executive owner. Someone with authority across Finance, Sales, Customer Success and Product. At this size that is usually the CEO or COO, or a fractional executive.
  2. A process owner per AI use. The head of the department that depends on it, not IT by default.
  3. A reviewer for data and security. Whoever handles GDPR and security questions today.
  4. A short review rhythm. Monthly at first, quarterly once things settle.

Do not form a large committee. In a company of 60 people, a committee of eight is a meeting nobody attends.

Step 1: Build the inventory

You cannot govern what you cannot see. The Chartered Banker-style practice note from CBA suggests starting discovery across procurement and contracts, approved-app registers, vendor release notes, expenses, team surveys and process-owner interviews. Expense reports are a good tell: look for small monthly subscriptions to AI tools that never went through procurement.

Then create a living register. For each use, record:

A spreadsheet is fine to start. Remember that vendors add AI features to tools you already own, so recheck after major product updates.

Step 2: Tier each use by consequence

The same practice note recommends classifying AI by the consequences of failure, not the sophistication of the technology. Factors include possible harm to individuals, decisions about people, scale and speed, detectability and reversibility, and use of personal or confidential data.

Applied to SaaS:

For high-consequence uses, the note calls for stronger controls, including impact assessment and a human override that actually works. Write down why each use landed in its tier, so the reasoning survives staff changes.

Where AI does not belong

A framework that only says yes is not governance. We would keep AI out of, or tightly boxed in, these areas:

These are your red lines. Put them on one page.

What your AI use policy should cover

A use policy is the part of the framework your staff actually read. HTI describes practices and controls as the functional tools, such as checklists or design requirements, that turn high-level policies into actionable instructions. Keep yours to two pages and cover:

  1. Approved tools and how to request a new one.
  2. Data rules: what may and may not be entered, by data class.
  3. Red lines: the list above, adapted to you.
  4. Human review: which outputs need a person’s sign-off before they leave the company or change a record.
  5. Disclosure: when customers must be told AI is involved.
  6. Incident reporting: where to report a bad output or data leak, and what happens next.
  7. Ownership: who to ask, and who updates the policy.

A policy is the instruction layer. The framework is the policy plus the inventory, tiers, owners, controls and reviews around it.

Europe: what the law adds

A voluntary framework and a legal duty are different things. Frameworks like NIST and ISO/IEC 42001 are voluntary structures. GDPR, the EU AI Act and NIS2 are laws with their own scope. What follows is general information, not legal advice, and following a framework does not guarantee compliance with any of them. Ask qualified counsel how they apply to your products.

GDPR

When AI processes personal data, GDPR applies as it does to any processing. The European Data Protection Board says data protection impact assessments are an important element of accountability where AI-model processing is likely to result in high risk to people’s rights and freedoms. It also notes that controllers can document the steps taken to limit personal-data collection, reduce identifiability and guard against extraction. Your register and tiers are the natural home for that documentation.

The EU AI Act

Regulation (EU) 2024/1689 sets risk-based rules covering banned practices, high-risk AI, transparency duties, general-purpose AI models, governance and enforcement, with some exemptions. Among other things, providers of high-risk systems must manage risks across the lifecycle and keep technical documentation, and the Act also sets duties for deployers and transparency duties for some systems. Whether you are a provider, a deployer or both depends on what you build and use. Obligations phase in over time, so check the Commission’s official pages for current application dates.

The practical point is that an inventory with owners, tiers and evidence is the raw material for any of these duties. Evidence you can trace is also what buyers increasingly want, as this piece on EU AI Act traceable evidence argues for startups selling into regulated deals. The European Commission’s AI Alliance community adds that setting up governance now can help companies prepare for the AI Act and avoid compliance overhead later.

NIS2

NIS2 is the EU’s cybersecurity directive. Depending on your sector and size, you or your customers may fall under it, which affects how you handle security risk, incidents and suppliers. Treat AI tools as part of that supply chain and ask your counsel whether it covers you.

Step 3: Put controls inside your systems

A policy that depends on memory drifts. BetterCloud notes that for SaaS companies, automation keeps governance in place, because manual policy tracking leads to drift as vendors and models update. Microsoft’s guidance similarly points to embedding controls in the SaaSOps stack, such as data loss prevention and access management, plus continuous monitoring, audits and performance reviews.

In practice that means:

Step 4: Monitor and review

NIST is clear that governance is cross-cutting, informing every other function, not a one-time project. Set a calendar: a monthly look at new tools and incidents, a quarterly review of high-tier uses, and a re-tier whenever a use changes data, scope or vendor. Retire what nobody uses.

Our perspective

We see the same pattern in SaaS companies with 20 to 200 people: AI is already in use, and nobody owns it. Governance written as a standalone document then sits beside the work instead of inside it.

We build in a fixed order. First the data foundation: CRM and finance data as the source of truth, with one agreed version of the numbers. Then the AI layer, connecting that data to the assistant your team already uses. Then department agents for Finance, Sales and Customer Success, working within permissions, with approval where needed and an audit trail. Governance is not a layer added at the end. GDPR, NIS2 and the EU AI Act are design requirements from the first day, and our build, pilot and testing run on self-hosted European infrastructure in Germany.

Our perspective, overview diagram

We also think AI should be adopted one process at a time, starting with the most expensive one. Trying to govern fifteen experiments at once is how frameworks become shelfware. Pick one process, tier it, own it, measure it, then move to the next.

Nothing here replaces your lawyer. A framework helps you prepare and show your work; it does not guarantee compliance.

, Claus Nielsen

How NordOps Consulting can help

If your team uses AI and nobody owns it, our Fractional Chief AI Officer service gives you one named person with 25 years of operational leadership who decides where AI pays, sets the governance, and builds the agents.

There are a few ways in. The AI Snapshot is a one-off, priced at €2,500-€3,500. The AI Readiness Assessment starts from €4,500. The Fractional Chief AI Officer runs from €3,000 per month at Advisor level, from €6,500 per month at Operating level and from €11,000 per month at Embedded level. Builds are priced at 30% of the first-year saving once it is measured and proven, or at a fixed price agreed before work starts. You own what is built, including source code, documentation and infrastructure at handover. Start with a free 30-minute discovery call on the NordOps Consulting website.

FAQ

What is the difference between an AI governance framework and an AI use policy?

The policy is the short rulebook staff follow: approved tools, data rules, red lines and review steps. The framework is the whole system around it, including ownership, the inventory, risk tiers, controls and monitoring. You need both, and the policy is usually the first thing to write.

Do we need ISO/IEC 42001 certification?

Not as a starting point. The standard is designed for organizations of any size that develop, provide or use AI, and you can borrow its structure without certifying. Consider certification if customers or tenders start requiring it.

Which framework should a small SaaS company start with?

NIST AI RMF is a practical start because its four functions, GOVERN, MAP, MEASURE and MANAGE, map easily onto an inventory, tiers and reviews. BetterCloud notes SaaS governance can use NIST AI RMF and COBIT aligned with existing IT and business strategy. Add legal requirements from GDPR and the EU AI Act where they apply to you.

Who should own AI governance in a company of 50 people?

One executive, typically the CEO, COO or a fractional AI leader, with a named owner in each department for its own AI uses. Avoid a committee. Clear accountability for procurement, management and oversight matters more than the title.

How long does it take to set up?

A first version of the inventory, tiers and a two-page policy is realistic within weeks, because it is mostly discovery and decisions. The ongoing part is the review rhythm, which never ends by design.

Sources