ExponenLabsExponenLabs
AI governance · For companies without a compliance team

Most AI rules do not apply to you. Find out which ones do.

Everything written about the EU AI Act, the NIST AI Risk Management Framework and ISO 42001 is written for companies with a general counsel. If you have forty people and no compliance function, the honest questions are narrower: what already binds me, what might later, and what can I safely ignore? Three duties already bite, one ordinary habit makes you high-risk, and most of the rest is years away or not law at all.

Book a 30-min AI operations callGet your AI operating plan (2 min)

Month to month · Stop any month, keep everything

You speak to the senior lead who would do the work. If we are not the right fit, we will say so.

Free · no sign-up · instant result

Which of the three is actually law?

Only the first. The other two are voluntary, which does not mean they do not matter commercially — it means nobody can fine you for skipping them.

  • EU AI Act

    Law

    EU regulation, risk-tiered by use case.

    Binding on you?
    Yes, if your output reaches people in the EU
    Certificate?
    No, but high-risk systems need a conformity assessment

  • NIST AI RMF

    Voluntary

    US voluntary framework: Govern, Map, Measure, Manage.

    Binding on you?
    No
    Certificate?
    No

  • ISO/IEC 42001

    Voluntary

    Management-system standard for AI.

    Binding on you?
    No
    Certificate?
    Yes, and enterprise buyers are starting to ask

The Act applies on the basis of where the output lands, not where you are registered. There is no blanket small-company exemption.

When each duty bites

Dates from the European Commission’s own AI Act page, last checked 31 October 2026.

Already in force

  1. 2 February 2025

    Prohibited practices

    A short list of uses banned outright, including social scoring. Almost no ordinary business is near this line.

  2. 2 February 2025

    AI literacy

    The duty that gets missed. If your staff use AI systems, you are expected to make sure they have a sufficient grasp of what those systems do. No certificate to buy, no form to file.

  3. 2 August 2025

    General-purpose AI providers

    This binds your model vendor, not you. Useful as leverage: they now have documentation duties you can ask them to meet.

  4. 2 August 2026

    Enforcement

    The AI Office and national authorities became responsible for supervising and enforcing the Act.

Still ahead

  1. 2 December 2027

    Annex III high-risk

    Risk management, data governance, documentation, human oversight, conformity assessment and registration. Moved here from August 2026 by the AI Omnibus.

  2. 2 August 2028

    Annex I high-risk

    AI embedded in products already regulated under other EU law: medical devices, machinery, vehicles. Irrelevant to most small companies.

The high-risk deadlines moved in 2026 under the AI Omnibus. Read that as roughly sixteen extra months of runway, not a cancellation: the deadline moved, the obligation did not.

The one that catches normal companies

Annex III lists the high-risk areas. Read it as a 50-person company and most of it is irrelevant. One entry is not.

  • Common for an SME

    Employment

    Screening CVs, ranking applicants or scoring candidates. Now a mainstream habit in small companies, usually adopted without anyone framing it as a compliance decision. If one entry here applies to you, it is almost always this one.

  • Common for an SME

    Essential services

    Access to essential services, including credit. Rare for most small companies, but absolute when it applies.

  • Rare for an SME

    Education

    AI that decides access to education or scores learning outcomes. Only relevant if you are in education.

  • Rare for an SME

    Biometrics

    Biometric identification and categorisation. Take advice if you are anywhere near this.

  • Rare for an SME

    Critical infrastructure

    AI managing the safety of utilities and transport networks. If this is you, you already have a compliance function.

  • Rare for an SME

    Migration & borders

    Migration, asylum and border control. Government and government-adjacent work only.

“Common” and “rare” are our reading of what a 20–200 person company typically does, not a legal classification. The Act does not rank the areas.

You probably already own the main artefact

All three frameworks ask, in different vocabulary, for the same starting point: a list of your AI systems, with an owner for each. ISO 42001 calls it an inventory. The NIST AI RMF calls it Map. The Act requires high-risk systems to be registered, and you cannot classify what you have not listed.

We install an agent register on every engagement — every agent, its owner, its spend cap, its off switch — because agents nobody owns fail quietly and burn money. We built it as an operational control. It turns out to be most of what all three frameworks want first.

That is the useful part for a company with no compliance team: the governance work that pays for itself operationally is also the governance work the frameworks ask for first. Do it for the first reason and the second comes free.

Read the long version

What you end up with

  • An inventory of every AI tool and agent in use, including the ones nobody approved
  • A named owner against each one — a person, not a department
  • The agent register: owner, spend cap, off switch, scoped permissions
  • A one-page AI policy your people will actually read
  • A straight answer on whether AI touches your hiring, and what to do if it does
  • Your team told how the tools fail, not just how to use them

What this is not

We are not lawyers, not auditors and not a certification body. We will not tell you whether you comply, and anyone who offers to do that from the outside without reading your systems is guessing.

  • A legal opinion on whether you comply
  • An ISO 42001 certification audit
  • A compliance platform licence
  • A guarantee against enforcement

What we do instead: build the inventory, the policy and the ownership, so you can take a short, factual picture of your AI use to a lawyer. That is a much cheaper conversation than the one that starts with “we are not sure what we are running”. The seat that owns this is the fractional CAIO. If the security side is the live worry rather than the regulatory side, start with AI security for SMEs.

AI governance questions

The questions small companies actually ask. Answers are general information, not legal advice.

Does the EU AI Act apply to a small company outside the EU?
It can. The Act applies based on where the output lands, not where the company is registered, so an AI system whose output reaches people in the EU can be in scope regardless of headquarters. There is no blanket small-company exemption. What changes with size and use case is which tier you fall into, and most small companies fall into the low-obligation tiers rather than the high-risk one. This is not legal advice; check your own exposure with a lawyer.
What AI Act duties are already in force?
Three matter to a small company. The ban on prohibited practices and the AI literacy duty have applied since 2 February 2025. Obligations on general-purpose AI model providers have applied since 2 August 2025, which binds your model vendor rather than you. And since 2 August 2026 the AI Office and national authorities have been responsible for enforcement. High-risk obligations are later: 2 December 2027 for standalone Annex III systems and 2 August 2028 for AI embedded in regulated products.
What makes a small company high-risk?
The most common route for an ordinary small company is using AI in employment or in access to essential services such as credit. Annex III lists areas including biometrics, critical infrastructure, education, employment, migration, asylum and border control. Screening CVs or ranking candidates with AI is the habit that quietly moves a normal business into the high-risk tier. Most other small-company uses, such as drafting copy or summarising tickets, do not.
Do we need ISO 42001 certification?
Only if a customer asks for it. ISO/IEC 42001 is a voluntary, certifiable management-system standard for AI, and it is increasingly requested by enterprise buyers in procurement. If nobody is asking, certification is a cost with no buyer attached. The underlying discipline it describes, principally an inventory of your AI systems and defined ownership, is worth doing either way and costs nothing.
Is the NIST AI RMF mandatory?
No. The NIST AI Risk Management Framework is voluntary guidance, organised around four functions: Govern, Map, Measure and Manage. It is not a law and there is no certificate. It is useful to a small company as a vocabulary and a checklist, and it is increasingly referenced in US federal procurement, so it can matter commercially even though it never binds you legally.
Are you lawyers?
No. We are not lawyers, not auditors and not a certification body, and we will not tell you whether you comply. We help you build the inventory, the policy and the ownership, so that you can take a short, factual picture of your AI use to a lawyer. That is a much cheaper conversation than the one that starts with "we are not sure what we are running".
Who leads this work?
A fractional CAIO. AI governance is not a separate product we sell; it is part of what the Chief AI Officer seat owns, alongside AI policy, decision rights, vendor choice and measuring return. It is scoped and priced on the free call, like everything else.

Find out what actually applies to you

Thirty minutes with a senior lead. We will tell you which of this reaches you, which does not, and whether the answer needs a lawyer or an afternoon.

Book a 30-min AI operations call

You speak to the senior lead who would do the work. If we are not the right fit, we will say so.