Mid-market companies do not need a large AI ethics office. They need to know what AI is in use, set clear rules, decide who approves what, and be able to show control when a customer, auditor or regulator asks. That can start in 30 days.
Week 1: Find out what is already in use
Survey teams and check expense reports, browser extensions and vendor contracts. Most companies find more AI in use than leadership expected, including AI features switched on inside existing software. Record each use case with its owner, the data it touches and who it affects.
Week 2: Set the rules
Write a short AI use policy in plain language: approved tools, data that must never be entered into unapproved tools, when a person must review AI output, and how to request a new tool. Two pages that people read beat twenty that nobody does.
Week 3: Decide who decides
Agree decision rights. A typical pattern: team leads approve low-risk internal uses, a small AI review group approves anything touching customer data or customer-facing output, and the executive team approves uses that affect pricing, credit, hiring or financial reporting.
Week 4: Put the first controls in place
- A risk rating for each use case (low, medium, high).
- Human review for high-risk and customer-facing outputs.
- Vendor review questions for AI tools: data use, retention, training on your data, security.
- An incident route: who to tell when AI output causes harm or an error.
Which frameworks to align to
The NIST AI Risk Management Framework is a free, widely used US reference for organizing AI risk work. ISO/IEC 42001 is the international standard for an AI management system, useful if customers ask for certifiable assurance. Aligning to both from the start avoids rework later.
Keep an eye on regulation, without waiting for it
Rules are moving quickly. In 2026 the EU agreed to delay the main high-risk obligations of its AI Act, while transparency duties stayed on an earlier timeline. In the US, Colorado repealed its 2024 AI Act and replaced it with a narrower law focused on consumer notice and rights, and its enforcement is also subject to a federal court challenge. The practical lesson: build a governance program that works under any of these regimes, and have legal counsel confirm what applies to you.
If you would like this done with you, our AI Governance and Policy engagement delivers the inventory, policy, decision rights and control library in four to eight weeks.