AI Governance Playbook
The AI Governance Playbook is a free tool that builds a tailored AI governance framework for a small business adopting AI-powered apps, agentic systems or agentic workflows, with findings, recommendations and a 90-day plan aligned to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
- NIST AI RMF · ISO 42001 · EU AI Act
- Findings, recommendations & 90-day plan
- FREE, built by an AI-Native vCISO for SMBs
What is the AI Governance Playbook?
The AI Governance Playbook is a free, self-serve tool from IRM Consulting & Advisory that builds a tailored AI Governance Framework for a small business adopting AI-powered apps, agentic systems, or agentic workflows. You capture your business context and the tool generates a professional, downloadable document with prioritized risk findings, practical recommendations, and a 90-day action plan, aligned to the NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
What is AI Governance?
AI Governance is the set of policies, roles, processes, and controls an organization uses to make sure the AI systems it builds or adopts are safe, fair, transparent, secure, and compliant with the laws that apply to it. For a small business this means knowing which AI tools are in use, who is accountable for them, what data they touch, and how risks like bias, hallucination, data leakage, and vendor lock-in are managed. Frameworks such as the NIST AI RMF, ISO/IEC 42001, and the EU AI Act define what good AI governance looks like; this free playbook turns them into practical steps sized for a small business.
What you get
- A tailored AI Governance Framework and Playbook
- Prioritized AI governance and security risks based on your business context
- Practical, actionable recommendations
- A phased 90-day AI governance action plan
- Alignment to the NIST AI RMF, ISO/IEC 42001, and the EU AI Act
- A professional, downloadable document
Who it is for
The Playbook is built for small and medium businesses, startups, and growing companies that are adopting AI faster than their governance can keep up, and that do not yet have a dedicated AI governance function.
How it works
Capture your business context
Describe your business, the AI-powered apps, agentic systems, and workflows you are adopting, and the data they touch.
Generate your tailored framework
The tool analyzes your context against the NIST AI RMF, ISO/IEC 42001, and the EU AI Act to identify governance and security risks.
Download your playbook and 90-day plan
Receive a professional document with prioritized risk findings, practical recommendations, and a phased 90-day action plan.
Not loading? Open the AI Governance Playbook tool in a new tab.
This playbook is a working draft to support professional review and decision-making. It is not legal advice. We recommend you seek advice from a Virtual CISO. Learn more about our AI Governance services.
What's inside the playbook
Every generated playbook is a nine-section AI governance document tailored to your business context. The sections below are the actual sections of the document, in the order they appear.
| Section | What it contains |
|---|---|
| 1. Executive Summary | Your overall AI risk profile (Low, Moderate, High, or Critical), your business context and top AI objectives, and a bottom-line summary of the fastest path to safe adoption. |
| 2. Business Profile & Environment | A structured table of your organization: industry, size, jurisdictions, customer type, data in scope for AI, regulations and standards, AI maturity, planned use cases, AI system types, agent action scope, existing governance, technical capability, risk appetite, cloud and AI platforms, and the governance owner or sponsor. |
| 3. The Governance Framework | The three foundations the playbook is built on: the NIST AI Risk Management Framework as the operating model (Govern, Map, Measure, Manage), ISO/IEC 42001 as the management-system backbone, and the EU AI Act as the regulatory floor, flagged as "applies to you" or "monitor" based on your jurisdictions. For agentic adopters it adds Agentic AI lifecycle governance, The four agentic safeguards, and Defense in depth (input, system and output), plus guidance on scaling governance as you grow. |
| 4. Findings | Prioritized AI governance and security risk findings derived from your intake: your data, use cases, system types, agent action scope, and existing controls. |
| 5. Recommendations | Practical, prioritized recommendations, each tagged by priority, sized for a small business rather than an enterprise program. |
| 6. Roles & Responsibilities | Who owns what: the governance owner or sponsor, and the roles a small team needs to cover policy, approvals, vendor review, and incident response without a dedicated AI governance function. |
| 7. 90-Day Implementation Plan | A phased action plan: Phase 1, Days 0 to 30, Foundation and visibility; Phase 2, Days 31 to 60, Controls and enablement; Phase 3, Days 61 to 90, Operationalise and scale. |
| 8. Metrics & Ongoing Monitoring | The measures that keep the program alive after day 90: adoption, policy exceptions, incidents, vendor reviews, and review cadences. |
| 9. Appendix, Key Terms | Plain-language definitions of the AI governance vocabulary used throughout the document, so the playbook is readable by non-specialists. |
How the playbook maps to NIST AI RMF, ISO/IEC 42001 and the EU AI Act
Each section of the playbook implements a specific part of the three frameworks it is aligned to: the NIST AI Risk Management Framework's four functions (Govern, Map, Measure, Manage), the management system requirements and Annex A controls of ISO/IEC 42001:2023, and the obligations of the EU AI Act. The table maps every playbook section to its counterpart in each framework.
| Playbook section | NIST AI RMF | ISO/IEC 42001 | EU AI Act |
|---|---|---|---|
| 1. Executive Summary | Govern: risk framing and organizational accountability | Clause 4 (context of the organization), Clause 5.1 (leadership and commitment) | Risk-based approach that underpins the Act (Article 9 risk management thinking) |
| 2. Business Profile & Environment | Map: establish context, inventory AI use cases and systems | Clauses 4.1 and 4.2 (context, interested parties), Annex A.4 (resources for AI systems) | Article 6 and Annex III: classifying use cases by risk category |
| 3. The Governance Framework | Govern: policies, culture, and roles across all functions | Clause 5 (leadership), Annex A.2 (AI policies) | Article 4 (AI literacy), Article 9 (risk management system) |
| 4. Findings | Map and Measure: identify and analyse AI risks | Clause 6.1.2 (AI risk assessment), Clause 6.1.4 and Annex A.5 (AI system impact assessment) | Article 9 (risk identification), Article 27 (fundamental rights impact assessment for deployers) |
| 5. Recommendations | Manage: prioritize and act on risks | Clause 6.1.3 (AI risk treatment), Annex A reference controls | Articles 9 to 15: data governance, documentation, transparency, human oversight, robustness |
| 6. Roles & Responsibilities | Govern: defined roles, responsibilities, and lines of accountability | Clause 5.3 (roles and authorities), Annex A.3 (internal organization) | Article 26 (deployer obligations), Article 14 (human oversight) |
| 7. 90-Day Implementation Plan | Manage: implement treatments on a plan with owners and dates | Clause 6.2 (AI objectives and planning), Clause 8.1 (operational planning and control) | Phased compliance planning against the staged applicability dates of the EU AI Act |
| 8. Metrics & Ongoing Monitoring | Measure: track, evaluate, and improve over time | Clause 9.1 (monitoring and measurement), 9.2 (internal audit), 9.3 (management review) | Article 72 (post-market monitoring), Article 73 (serious incident reporting) |
| 9. Appendix, Key Terms | Shared vocabulary across all four functions | Clause 3 (terms and definitions, via ISO/IEC 22989) | Article 3 (definitions) |
Want to measure yourself against ISO/IEC 42001 directly? Run the free ISO 42001 Gap Assessment, or explore IRM's AI Governance services for hands-on help implementing the playbook.
AI Governance Playbook FAQs
Yes. The AI Governance Playbook is a free, self-serve tool. You capture your business context and it generates a tailored AI governance framework and 90-day plan at no cost.
The Playbook aligns its findings, recommendations, and 90-day plan to the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act.
This playbook is a working draft to support professional review and decision-making. It is not legal advice. We recommend you seek advice from a Virtual CISO.
The Playbook is a free self-serve starting point that produces a draft framework and action plan. IRM's AI Governance services provide hands-on, expert-led design and implementation of a full governance program. Many businesses start with the Playbook, then engage IRM for implementation support.
Contact Us
Cybersecurity & AI insights
Free Cybersecurity Tools for Small Businesses
An AI Agent Just Ran Its Own Five-Day Cyberattack
MCP, A2A, and ACP: The Plumbing Behind AI Agents
Our Industry Certifications
Our diverse industry experience and expertise in AI, Cybersecurity & Information Risk Management, Data Governance, Privacy and Data Protection Regulatory Compliance is endorsed by leading educational and industry certifications for the quality, value and cost-effective products and services we deliver to our clients.
We specialize in transforming small and medium-sized SaaS & AaaS businesses into cyber-resilient organizations with cost-effective Virtual CISO Services.
Awards & Recognition
