Do we need AI governance if we only use ChatGPT or Copilot occasionally?

Yes — occasional use is where most exposure happens, because it is usually unlogged and on personal accounts. A short policy, a company tenant, and an approved tool list resolve the majority of the risk in a couple of weeks. Governance scales with your usage; it does not have to start heavy.

What is the difference between NIST AI RMF and ISO/IEC 42001?

NIST AI RMF is a voluntary US framework organized around four functions — Govern, Map, Measure, Manage — and is what federal and defense-adjacent customers most often recognize. ISO/IEC 42001 is a certifiable AI management system standard, similar in structure to ISO 27001, that produces an auditable certificate. Many organizations adopt the NIST framework first and pursue ISO/IEC 42001 when a customer or procurement process requires proof.

Does AI use put our CMMC or NIST 800-171 compliance at risk?

It can. Entering controlled unclassified information into a commercial AI tool that has not been approved for CUI is a disclosure to an unauthorized system, and it can undermine your SSP and SPRS score. We scope AI tools against your CUI boundary and either block them or move usage into an approved environment such as GCC High.

Can AI tools be used with PHI under HIPAA?

Only where a Business Associate Agreement is in place and the vendor's terms support it. Several AI scribe and note-taking products offer BAAs; most consumer-tier assistants do not. We verify the agreement, configure retention, and document the decision so it holds up in a risk analysis.

How long does it take to get a working AI policy in place?

Most organizations get a policy adopted, a tool register published, and staff trained in two to three weeks. A full NIST AI RMF-aligned program with tenant controls and vendor reviews typically runs six to ten weeks depending on how many tools are already in use.

Will governance slow our teams down?

Done well, it does the opposite. Most of the friction in AI adoption comes from uncertainty — staff either avoid useful tools or use them quietly. A clear approved list and simple data rules let people move faster with less second-guessing.

Do you provide the AI policy template for free?

Yes. Our AI Governance Policy starter template is a fill-in-the-blank policy mapped to NIST AI RMF and ISO/IEC 42001, including an approved tool register, risk tiering matrix, vendor review questions, and a 30-day rollout plan. It is available as a free download.

Back to Home

AI Governance

AI Governance Without the Guesswork

Get control of generative AI before it becomes an audit finding. We build AI governance programs aligned to the NIST AI Risk Management Framework and ISO/IEC 42001 — tool discovery, acceptable-use policy, tenant controls, and the evidence your auditors and customers ask for.

Book a 30-minute, no-obligation risk discovery call.

Worth your time or we send you a $50 Amazon gift card

How Our AI Governance Engagements Work

Pick the starting point that matches where you are today. Most clients begin with a gap assessment and move through the stages as budget and deadlines allow.

Stage 1

AI Governance Starter

2–3 weeks

Get a defensible policy and a real tool inventory in place fast.

Shadow AI discovery and tool inventory
AI acceptable use policy tailored to your data rules
Approved tool register and risk tiering
Leadership readout and staff training session

Stage 2

AI Governance Program

6–10 weeks

Full NIST AI RMF alignment with controls implemented, not just documented.

Everything in Starter
NIST AI RMF gap assessment and control mapping
Tenant hardening, logging, and DLP configuration
AI vendor review process and completed reviews for current tools
Incident response and questionnaire evidence package

Stage 3

ISO/IEC 42001 Readiness

4–8 months

Build the AI management system a certification body will accept.

Everything in Program
AIMS scope, objectives, and Annex A control mapping
Internal audit, management review, and corrective action records
Certification body coordination and mock audit
Ongoing governance operations and quarterly reviews

What You Actually Receive

AI tool inventory with owners and data classifications

AI acceptable use policy and approved tool register

Risk tiering matrix for AI use cases

NIST AI RMF control mapping and gap report

Vendor AI review questionnaire and completed vendor assessments

Training deck, acknowledgment records, and quarterly review calendar

AI governance readiness checklist

Eight checks that separate a company with AI governance from a company with AI exposure. If you cannot answer yes to all eight, start with the free policy template.

1

You know every AI tool in use

Including embedded AI in SaaS you already license and personal accounts staff use for work.
2

Data rules are explicit

Staff know exactly which data — CUI, ITAR technical data, PHI, cardholder data, credentials — never goes into an AI tool.
3

AI runs on company accounts

Company tenant sign-in enforced so prompts are logged and excluded from vendor model training.
4

Vendor terms are verified

Contracts confirm no training on your data, and retention plus deletion terms are documented.
5

New tools need approval

A named owner reviews and approves AI tools before adoption, with the decision recorded.
6

High-risk uses have human oversight

No AI-only decisions on employment, credit, pricing, safety, or regulated data.
7

AI incidents have a playbook

Data exposure or harmful output routes into your existing incident response and notification timelines.
8

Training is current and recorded

Onboarding plus annual training with signed acknowledgments retained by HR or compliance.

Download the free AI policy template

Who needs AI governance now

Defense and manufacturing suppliers whose staff paste drawings, contracts, or CUI-adjacent data into public AI tools

Healthcare and behavioral health practices where AI scribes and note-takers touch PHI

Financial and dealer groups under FTC Safeguards where AI is now part of the vendor risk conversation

Any company answering AI questions in customer security questionnaires or cyber-insurance renewals

Organizations pursuing ISO 27001 or ISO/IEC 42001 certification with AI already in production use

Leadership teams that want the productivity gains without unmanaged shadow AI

Why It Matters

Shadow AI discovery

We inventory every AI tool actually in use — SSO logs, expense records, browser extensions, and embedded AI features in SaaS you already pay for — so the policy covers reality, not assumptions.

NIST AI RMF alignment

Your program maps to the Govern, Map, Measure, and Manage functions, the framework federal and defense customers recognize.

ISO/IEC 42001 readiness

If certification is on the roadmap, we structure the AI management system, roles, and records against Annex A from day one instead of retrofitting later.

Acceptable use people follow

A short, plain-language AI use policy with a live approved-tool register — not a 40-page document nobody reads.

Tenant and data controls

Company-account enforcement, training opt-out, prompt logging, DLP rules, and blocking of unapproved tools — configured, not just recommended.

Questionnaire-ready evidence

Policy, register, risk tiering, vendor reviews, and training records packaged so you can answer AI questions in security reviews in minutes.

How TRNSFRM Gets You There

AI discovery workshop and tool inventory across every department

Risk tiering of each AI use case: low, moderate, high, or prohibited

AI acceptable use policy drafted and adapted to your data classification scheme

Approved tool register with owners, allowed data types, and review dates

Tenant hardening: company sign-in, training opt-out, retention, logging, and DLP

AI vendor review questions and third-party risk process integration

Incident response updates so AI exposure is covered by an existing playbook

Staff training, acknowledgments, and a scheduled quarterly governance review

Frequently Asked Questions

Other frameworks & resources

CMMC Level 2 Definitive Guide

Deep-dive on controls, cost, and process.

CMMC

DoD contractor certification.

NIST 800-171

Federal contractor controls.

ISO 27001

International ISMS certification.

HIPAA

Healthcare PHI protection.

FTC Safeguards

Auto dealer & finance rule.

ITAR

Defense export controls.

Free Compliance Checklist

Score yourself in 10 minutes.

Case Studies

Real certification outcomes.

vCISO Leadership

Strategic security guidance.

A note from our CEO

“Frameworks like CMMC, NIST, and HIPAA aren't just paperwork — they're the difference between winning the next contract and losing it. We've walked dozens of organizations through certification. Let's talk about your path.”

Jeff Dennis

Founder & CEO, TRNSFRM

Ready to Get Compliant?

No pressure. No sales pitch. Just a conversation with an expert to map out your risks, gaps, and next steps.

Not ready to book? — it's free.

Call Now