An AI governance framework for a mid-market brand

An AI governance framework is the set of rules, roles and controls a company uses to decide how it uses AI, what data AI tools may see and how it checks that the rules are followed. For a mid-market ecommerce brand, it does not need to be a long policy manual. It needs four things: an inventory of every AI tool and what data it touches, rules for which data can go where, a named owner for each use, and technical controls and logs that prove the rules work. This guide sets out the frameworks and laws to build on, what applies to a brand selling in the US and EU, and a six-step way to put one in place. It is from Brand Media Works, an AI consulting and marketing data engineering firm for ecommerce brands.

What is an AI governance framework?

Two published standards are the usual starting points (read 4 November 2026):

• NIST AI Risk Management Framework (AI RMF). Released by the US National Institute of Standards and Technology on 26 January 2023, it is intended for voluntary use. Its core has four functions: govern, map, measure and manage. Govern is cross-cutting, and NIST says most users start with govern, then map, then measure or manage. In July 2024, NIST added a Generative AI Profile (NIST-AI-600-1).
• ISO/IEC 42001. Published in December 2023, it specifies requirements for establishing, maintaining and continually improving an AI management system. ISO calls it the world's first AI management system standard and says it applies to organizations of any size that develop, provide or use AI.

NIST describes what to manage, and ISO describes how to run it as an ongoing system. Neither is a law. Laws such as the EU AI Act and California's CCPA set what must be done, and by when.

What does AI governance cost a mid-market brand, and what should be built rather than written?

Published prices for the policy work are modest. One AI firm lists an AI readiness and governance sprint from $7,500, and another prices full compliance readiness for an AI agent at 100 to 170 hours, or $6,100 to $10,400 plus audit (read 18 October 2026).

The larger task is making the rules real in the systems the brand runs. A policy that says "no customer addresses in AI prompts" only works if something enforces it:

• Filters on what goes in and out. Amazon Bedrock Guardrails can block or mask personal data in prompts and responses, at $0.10 per 1,000 text units for its sensitive information filters (read 15 October 2026).
• Vendor terms that match the rules. OpenAI does not train on ChatGPT Business, Enterprise or API data by default. Enterprise admins control retention, and deleted chats are removed within 30 days. API inputs and outputs can be kept up to 30 days for abuse monitoring (read 15 October 2026).
• Logs the brand owns. A record of which tool saw which data, and what it produced, kept in the brand's own cloud account where auditors can see it.

That is where building rather than writing pays off. Brands handling customer records at volume, health data, or EU and California customers should treat the controls as part of the framework, not an afterthought. AI data security on AWS describes how Brand Media Works builds these controls inside a brand's AWS account. Amazon Bedrock Guardrails and customer data covers the filters, and the risks of public AI tools with customer data covers what to restrict.

Which frameworks and laws apply to an ecommerce brand?

Under the EU AI Act, most obligations fall on providers of high-risk systems, and deployers have fewer. The summary places chatbots in the limited-risk tier, where the main duty is to make sure people know they are interacting with AI. The summary used here was updated on 31 August 2026 for the AI Act changes adopted in the Digital Omnibus on AI.

California's deadlines are staggered, according to law firm Hunton Andrews Kurth (read 4 November 2026):

• Attestations that risk assessments were completed are due by 1 April 2028.
• Cybersecurity audit certifications are due on 1 April 2028 for businesses with more than $100 million in revenue, 1 April 2029 for those with $50 million to $100 million, and 1 April 2030 for smaller ones.

How do you build an AI governance framework in six steps?

1. Inventory every AI use. List each tool, who uses it, and what data it sees, including AI features inside existing software such as the help desk, email platform and ad accounts.
2. Classify by risk. Flag any use that makes or supports decisions about people, any that touches customer personal data, and any customer-facing chatbot that must disclose it is AI.
3. Set data rules. Decide which classes of data can go into which tools, and on which plan, based on each vendor's training and retention terms.
4. Name owners. One person accountable for each use, and one for the framework as a whole. This is NIST's govern function.
5. Build the controls. Add filters for personal data, access through approved accounts only, and logs kept in the brand's own storage.
6. Review on a schedule. Check the inventory, incidents and vendor terms each quarter, and before any new AI use goes live. These are NIST's measure and manage functions.

Is there a GDPR equivalent in the US?

Not at the federal level. Privacy law in the US is set state by state, and California's is the most developed. The California Privacy Protection Agency's regulations on risk assessments, cybersecurity audits and automated decisionmaking technology were approved on 22 September 2025 and took effect on 1 January 2026 (read 4 November 2026).

Does AI collect personal data?

AI tools process whatever is put into them, and keep it for as long as the vendor's terms allow. With OpenAI's API, inputs and outputs can be retained for up to 30 days for abuse monitoring. On business plans, OpenAI does not use the data for training by default (read 15 October 2026). The framework's data rules and the vendor's terms together decide what happens to customer data.

Book a discovery call

Frequently asked questions

Does the EU AI Act apply to a US brand?

It can. It applies to deployers outside the EU when their AI system's output is used in the EU, so a brand selling to EU customers with an AI chatbot should plan to disclose it from 2 August 2026.

Do we need ISO/IEC 42001?

No law requires it. It is useful when customers, retail partners or investors ask for evidence of how AI is managed, and its structure works as a checklist even without formal adoption.

Who should own AI governance in a mid-market brand?

One senior owner, often in operations, legal or data, with an owner for each AI use. NIST treats governance as cross-cutting, so it cannot sit with one team alone.