Eight practical steps to trustworthy AI.
A simple, repeatable structure for governing AI in a small or mid-sized organization. Each step maps to the NIST AI Risk Management Framework and ISO/IEC 42001, so the work holds up with auditors, insurers and buyers.
Inventory
List every AI tool in use, who uses it, what data goes in, and what decisions it touches. Include the AI features hiding inside software you already pay for.
Policy & ownership
Write a plain-language AI acceptable-use policy and name an owner for each tool. Someone has to be accountable for saying yes or no.
Data protection
Decide what data may never go into AI tools (patient records, Social Security numbers, financials) and put technical guardrails behind the rule.
Vendor vetting
Check how each AI vendor stores, trains on and shares your data. For healthcare, confirm whether a Business Associate Agreement is offered and signed.
Access & logging
Use company accounts with single sign-on and MFA, not personal logins. Turn on audit logs so you can see who used what.
Testing
Test AI chatbots and integrations for prompt injection, data leakage and wrong answers before customers or patients see them.
Training
Give staff short, practical training: what is allowed, what is not, and how to spot an AI output that should not be trusted.
Quarterly review
Every quarter, re-check the inventory, vendors, incidents and policy. AI tools change monthly; your controls should keep up.
How the framework lines up with the standards
NIST AI RMF 1.0 functions: Govern, Map, Measure, Manage. ISO/IEC 42001 references are to management-system clauses and Annex A control areas. Mappings are indicative and are refined for each client.
| Step | NIST AI RMF function | ISO/IEC 42001 reference |
|---|---|---|
| 01 · Inventory | Map | Clause 4, 6.1, A.6 |
| 02 · Policy & ownership | Govern | Clause 5, A.2, A.3 |
| 03 · Data protection | Map / Manage | A.7 |
| 04 · Vendor vetting | Govern / Map | A.10 |
| 05 · Access & logging | Manage | A.6.2.8, A.9 |
| 06 · Testing | Measure | A.6.2.4, Clause 9.1 |
| 07 · Training | Govern | Clause 7.2, 7.3 |
| 08 · Quarterly review | Govern / Manage | Clause 9, 10 |
Why eight steps and not eighty?
Large frameworks are written for large companies. Small organizations need the same protections in a form one owner can run. The eight steps cover the risks that matter most, and each can be expanded as your AI use grows.
Ways to put it to work
- AI Risk Assessment measures where you are on all eight steps.
- Home Care Starter delivers steps 1 through 4 and 7 for agencies.
- Fractional AI Governance Officer runs step 8 every quarter.
Not sure where AI is already being used in your business?
Start with a 30-minute call. We will ask a few plain questions, tell you what we would look at first, and give you a fixed price if an assessment makes sense.