What AI governance actually looks like outside a Fortune 500
NIST, ISO and the EU AI Act all assume a compliance function. Strip them back and they ask three questions any business can answer. A court case shows why the third one matters.
Abstract. The main AI governance frameworks were written with large organisations in mind. This piece reads three of them (the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act) for what they ask of a business with no legal or compliance team. Underneath the structure, they share three concerns: what data a system touches, who and what can access it, and what happens when it is wrong. A 2024 Canadian tribunal ruling against Air Canada shows what the third question costs when nobody asks it.
Background
The NIST AI RMF 1.0 (January 2023) organises AI risk work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 (December 2023) is a certifiable management-system standard, built like ISO 27001 for information security. The EU AI Act (Regulation (EU) 2024/1689) is law, with obligations scaled by risk level and phased in over several years. Its AI literacy duty in Article 4, which requires organisations using AI to make sure their staff understand it well enough, has applied since 2 February 2025.
What the frameworks have in common
Read side by side, they keep returning to the same three things.
- Data. What goes into the system, where it goes, and whether the provider keeps or trains on it. Most model providers offer business terms or settings that turn training off, but the default varies, so check rather than assume.
- Access. An AI agent connected to a shared inbox or customer database has, in practice, the access of a person in that role. The frameworks treat this as an access-control problem, and so should you: scope it like a new hire's permissions.
- Failure. What happens when the system gives a wrong answer to a real person, who notices, and who is responsible. NIST's Manage function and the AI Act's human oversight requirements are both about this.
Case: Moffatt v. Air Canada (2024)
In 2022 a customer asked Air Canada's website chatbot about bereavement fares. It told him he could apply for the discount after travelling. The airline's actual policy said otherwise, and it refused the refund. At the British Columbia Civil Resolution Tribunal, Air Canada argued that it couldn't be held liable for what its chatbot said. The tribunal rejected that, finding the airline responsible for all the information on its website and ordering it to pay the difference plus interest and fees.
The sum was small. The lesson wasn't. Nothing about this failure needed advanced governance to prevent. It needed someone to have asked, before launch, what happens when the bot gets a policy question wrong.
Customer asks the chatbot about bereavement fares
The chatbot answers, contradicting the written policy
The missing step
Any check on policy answers
No review, no test set of policy questions
Customer relies on the answer, and the refund is refused
Tribunal: the airline is responsible for its chatbot
Discussion
For a small business, the useful part of these frameworks is the habit, not the paperwork. Write down the answers to the three questions for every process that uses AI, name the person who owns each one, and revisit them on a schedule rather than once at launch. If nobody can answer the failure question, a review gate is missing.
Limitations
Three questions are not a compliance programme. Businesses in regulated sectors, or deploying systems the AI Act classes as high risk, will need more than this, and the Act's timetable for high-risk obligations has itself been under revision during 2026. The Air Canada decision came from a small-claims tribunal and isn't binding precedent elsewhere, though it has been widely cited.
Conclusion
Governance doesn't need a committee to be real. It needs someone who can say what data a system uses, who can reach it, and what happens when it's wrong, and who keeps checking.
Where X-GenAI fits
Our responsible AI work writes these answers down for each AI process, mapped to NIST and the AI Act where they apply.
References
NIST (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1.
ISO/IEC 42001:2023. Information technology, Artificial intelligence, Management system.
Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union.
Moffatt v. Air Canada, 2024 BCCRT 149. British Columbia Civil Resolution Tribunal, 14 February 2024.
Get new posts by email
AI updates, trend breakdowns, and picks for the certifications worth your time, a few times a month, when something's worth sending.
Have something like this to automate?