EU AI Act, NIST AI RMF, ISO 42001: what actually applies to a small company

Almost everything written about AI governance is written for a company with a compliance team. If you have 40 people and no general counsel, the honest questions are narrower: what already binds me, what might later, and what can I ignore?

This is that answer. It is not legal advice, and the dates below moved once already in 2026, so check your own exposure with a lawyer before you rely on any of it.

The short version

• Three duties already bite. Prohibited practices and AI literacy since February 2025, and enforcement machinery since August 2026.
• One ordinary habit makes you high-risk: using AI to screen or rank job candidates.
• The hard deadlines moved to 2027 and 2028, which is runway, not a reprieve.
• Two of the three frameworks are voluntary. Only the EU AI Act is law.
• Start with an inventory. It is the one artefact all three ask for, and the only one worth building before you know which rules apply.

Which of the three is actually law?

Only the first.

	What it is	Binding?	Certificate?
EU AI Act	EU regulation, risk-tiered by use case	Yes, if your output reaches people in the EU	No, but high-risk systems need a conformity assessment
NIST AI RMF	US voluntary framework: Govern, Map, Measure, Manage	No	No
ISO/IEC 42001	Management-system standard for AI	No	Yes, and buyers are starting to ask

The Act applies on the basis of where the output lands, not where you are registered. A Bangalore or Austin company whose AI touches people in the EU can be in scope. There is no blanket small-company exemption — but there is something better, which is that most of what small companies do with AI sits in the tiers with almost no obligations.

When each duty bites

Dates are from the European Commission's own AI Act page, read on 31 October 2026. Switch between the three phases.

The demanding part — high-risk systems — moved in 2026 under the AI Omnibus. Read that as about sixteen extra months of runway, not a cancellation. The deadline moved; the obligation did not, and nothing in the Omnibus delayed the duties already in force.

One caveat on the transparency duties, which cover disclosing that someone is dealing with an AI system and labelling AI-generated content. We have seen 2 August 2026 given for these in secondary coverage rather than confirmed on a primary page, so treat the date as approximate and the duty as live.

Penalties, from secondary reporting that is consistent across sources: up to €35 million or 7% of global turnover for prohibited practices, and up to €15 million or 3% for other violations. Those ceilings are written for companies that can pay them; the point for a small company is that the ceiling exists, not that it is likely.

The one that catches normal companies

Annex III lists the high-risk areas: biometrics, critical infrastructure, education, employment, migration, asylum and border control, and access to essential services such as credit.

Look at that list as a 50-person company and most of it is irrelevant. One entry is not. Employment. If you use AI to screen CVs, rank applicants or score candidates, you are using AI in a high-risk area — and that is now a mainstream habit in small companies, usually adopted by a founder or an ops lead without anyone framing it as a compliance decision. The same goes for any AI involved in deciding who gets credit.

If that is you, this is the one thing on the page worth acting on. Everything else can wait.

You probably already own the main artefact

Here is the part nobody selling compliance software mentions. All three frameworks ask, in different vocabulary, for the same starting artefact: a list of your AI systems, with an owner for each.

• ISO/IEC 42001 asks for an inventory of AI systems and their purposes.
• The NIST AI RMF's Map function is identifying your AI systems and their context.
• The Act requires high-risk systems to be registered, and you cannot classify what you have not listed.

If you have run any serious AI work, you may have this already under a different name. We install an agent register on every engagement — every agent, its owner, its spend cap, its off switch — because agents that nobody owns fail quietly and burn money. We built it as an operational control, not a compliance one. It turns out to be most of the inventory all three frameworks want.

That is the useful insight for a company with no compliance team: the governance work that pays for itself operationally is also the governance work the frameworks ask for first. Do it for the first reason and the second comes free. Do it only for the second and you will build a binder nobody reads.

What to do in the next month

Six steps, in order. Tap each one.

Where we fit, and where we do not

A fractional CAIO owns exactly this: the AI policy, who can switch on which tool, vendor choice, the agent register, and whether the money spent on AI comes back. That is the seat these frameworks assume exists and that most small companies do not have.

What we are not: lawyers, auditors, or a certification body. We will not tell you whether you comply, and anyone who offers to do that from the outside without reading your systems is guessing. We help you build the inventory, the policy and the ownership — then you take a short, factual picture of your AI use to a lawyer, which is a much cheaper conversation than the one that starts with "we are not sure what we are running".

If the security side of this is the live worry rather than the regulatory side, start with AI security for SMEs and prompt injection and agent permissions instead.

Sources. Dates and the Annex III areas: the European Commission's AI Act page, read 31 October 2026. Penalty ceilings, the ISO/IEC 42001 and NIST AI RMF descriptions, and the August 2026 transparency date: secondary coverage, consistent across several sources but not confirmed against primary text. Verify anything you plan to rely on.