NIST AI RMF for Small Businesses: A One-Page Policy, an AI Inventory and Four Simple Tests

The NIST AI RMF is a free, voluntary guidebook for using AI without getting hurt by it. You don't need a risk team or a PhD to use it. A small business can start with a one-page policy, a list of its AI tools and a handful of tests.

Maybe you already use AI: a chatbot answering customer questions, a tool writing social posts, or software screening job applicants. Each of those carries risk. A chatbot can give a wrong answer about your return policy. A screening tool can treat applicants unfairly. A tool can keep customer data you never meant to share.

This post shows how to apply the framework at small-business scale. For the framework itself, see our NIST AI RMF guide and the NIST AI RMF framework page.

The four functions of the NIST AI RMF

Think of a road trip:

• Govern: set the rules for the trip. Who's driving? What's the budget?
• Map: plan the route and know where you are going.
• Measure: check the car. Is the tank full? Are the tires good?
• Manage: fix what you found and keep driving.

The four functions run in a loop. AI tools change, and so do the risks, so you go around again.

Step 1: Govern with a one-page AI policy

Govern is the foundation. For a small business it does not need a 50-page document. One page is enough to start:

• A statement of values. For example: "We will use AI in a way that is fair, transparent and safe for our customers."
• Who is in charge. Name one person as the AI point person. It could be you, your office manager or your most tech-savvy employee. They don't need to be an expert. Everyone just needs to know who decides.
• An approval step. Before anyone starts using a new AI tool, the point person approves it. This stops people from quietly adopting risky tools.

A simple rule worth adding: "We only use AI tools that protect customer data." It gives you a standard to hold every tool against.

Step 2: Map every AI tool you use

Open a spreadsheet and list every AI tool in the business. Ask:

• Do we use a chatbot on our website?
• Do we use AI to write emails, social posts or blog content?
• Do we use AI for scheduling, sales analysis or bookkeeping?
• Do we use AI to screen resumes or rank candidates?
• Do we use AI to generate images?

Then ask your staff. You will find tools you didn't know about.

For each tool, record:

Tool	What it does	Data it uses	Who manages it	Risk level
Example: chatbot	Answers customer questions	Customer messages	Office manager	Medium
Example: writing assistant	Drafts email replies	Customer names and questions	Sales lead	Medium

A tool that touches payment details, health information or hiring decisions is high risk. A tool that suggests hashtags is low.

Mapping also means understanding how a tool reaches a decision. If software screens job applications, know what it looks at.

Step 3: Measure with simple tests

You don't need special skills. Run tests anyone can follow:

• Bias. If you use AI in hiring, create sample resumes with the same qualifications and names that suggest different genders and backgrounds. Compare how the tool ranks them. If it favors one group, stop and look closer. Some places regulate this already: New York City requires a bias audit for automated hiring tools.
• Accuracy. Ask your chatbot the questions customers really ask: return policy, pricing, shipping times. Check every answer. AI can "hallucinate," making up facts that sound true.
• Content. Read what your writing tool produces before it goes out. Does it match the facts? Does it sound like you?
• Data. Check what each tool collects and stores, how long it keeps it, and whether it is used to train the vendor's models.

The goal isn't to find everything wrong. It is a clear picture of where the risks are.

Step 4: Manage what you find

For each risk, pick one of four responses:

1. Avoid it. Stop using the tool. If a hiring tool is biased and can't be fixed, drop it.
2. Reduce it. Add human review. A person checks the chatbot's answers or reads every AI-written post before it goes out.
3. Share it. Move some of the risk to another party through contract terms with the vendor.
4. Accept it. For low-risk tools, write down that you accept the risk and move on.

Plan for failure too. If your AI scheduling tool goes down, what is the manual fallback?

Then go around the loop again. Review the list every quarter and whenever you add a tool.

The four AI risks small businesses run into most

• Biased decisions. AI learns from data, including old unfair patterns. Measure catches it.
• Privacy and security. Uploading a spreadsheet of customer names to an AI tool can break your own privacy promises. Govern and Map catch it.
• Wrong or made-up answers. Measure and human review catch it.
• No explanation. If a customer asks why an AI turned them down and you can't say, you have a problem. Map, which records how each tool decides, helps you answer.

Free resources

• The AI RMF itself and the AI RMF Playbook, which lists suggested actions for each function.
• The Generative AI Profile (NIST AI 600-1), which applies the framework to chatbots and content tools.
• Open-source testing tools such as Google's What-If Tool for looking at how a model behaves on different inputs.

If you want to know which AI laws already apply to you, read our guide to AI governance regulations.

Your first action item

Open a document and write down the three AI tools your business uses most. That is the start of your map, and the start of the NIST AI RMF in your business.

How AccuSights helps

Our AI governance services find the AI your team already uses, set policy and track risk against the NIST AI RMF and ISO 42001. You can start with the free 3-minute AI governance check on that page. If a customer asks for certification, ISO 42001 is the AI management standard that builds on the same ideas. To see where your wider security stands first, take the free Cyber Hygiene Test or book 30 minutes with an engineer.

Questions people ask

What is the NIST AI RMF? The NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0), published in January 2023, is a voluntary guide to managing AI risk, organized into Govern, Map, Measure and Manage.

Is the NIST AI RMF mandatory for small businesses? No. It is voluntary, but customers, contracts and some laws point to it as a reference.

Where should a small business start with the NIST AI RMF? A one-page AI policy that names who is in charge and how new tools get approved, then a list of every AI tool you use.