AI governance for mid-market companies: a practical starter

This guide is for CEOs, CTOs, COOs, compliance and data protection leads in companies of roughly 50 to 2,000 people that already use AI in products or operations, or are about to. It explains why governance reaches mid-market companies now, what the EU AI Act asks and when, which frameworks help, a ten-step governance baseline, controls for AI agents, and how to answer the AI questions in customer questionnaires. It is part of our technology trends 2026 series. It is practical guidance, not legal advice.

In this guide

• Why governance reaches mid-market companies now
• What the EU AI Act asks, and when
• Frameworks that help
• The governance baseline in ten steps
• Controls for AI agents and integrations
• Answering AI questions in customer questionnaires
• How Netbase governs its own AI delivery
• Limitations of this guide
• Frequently asked questions
• How this guide was made
• Next step

Why governance reaches mid-market companies now

Three things arrived at the same time.

Regulation with dates. The EU AI Act is the first comprehensive AI law, and its obligations apply in phases through 2028. It can reach companies outside the EU when their AI systems or outputs are used in the EU.

Customers ask. Enterprise buyers now send AI sections in their supplier questionnaires: where do you use AI, on which data, with which models, who reviews the output? A company without answers loses deals before any regulator calls.

AI can act. Agents that call tools and APIs turn a wrong answer into a wrong action. Postman's 2025 State of the API report found that 51% of developers name unauthorised or excessive API calls from AI agents as their top security concern.

Most mid-market companies are deployers: they use AI systems built by others, or build features on top of commercial and open-weight models. Deployers have lighter duties than providers of high-risk systems, but not none, and customers expect governance whatever the legal minimum.

What the EU AI Act asks, and when

The last two dates come from the AI Omnibus, which entered into force on 27 July 2026 and moved the high-risk deadlines; it also extended simplified obligations beyond SMEs to small mid-cap companies. Check the European Commission's pages for the current text before you act.

Frameworks that help

ISO/IEC 42001. The international standard for an AI management system: policy, roles, risk assessment, impact assessment, controls over the AI lifecycle and continual improvement. It fits companies that already run ISO 27001 for information security, because the structure is similar.

NIST AI Risk Management Framework. A voluntary framework organised in four functions: govern, map, measure and manage. It is a practical vocabulary for risk conversations, wherever you are based.

OWASP Top 10 for LLM Applications. A security list for applications built on language models, including prompt injection and excessive agency, with mitigations engineers can apply directly.

You do not need all three at once. Use the EU AI Act to know what is required, ISO/IEC 42001 or the NIST framework to organise the management system, and OWASP to secure what you build.

Controls for AI agents and integrations

Agents and AI features wired into business systems need controls beyond a policy document:

• Narrow tools. Give each agent only the tools and data its task needs, with read-only access first.
• Approval for impact. Payments, refunds, price changes, customer messages and data deletion need a person's approval until the error rate is proven low.
• Scoped credentials. Agents use their own identities and scopes, never shared admin keys.
• Rate limits and monitoring. Watch agent calls like any new client, and alert on unusual volumes.
• Decision logs. Record inputs, tool calls and outcomes per case, so failures can be traced and explained.
• A manual fallback. Every automated process keeps a way to hand the case to a person.

Our comparison of AI agents and workflow automation explains when an agent is worth that overhead, and our agentic commerce readiness guide applies the same controls to shopping agents.

Answering AI questions in customer questionnaires

Buyers' questionnaires usually ask five things. Prepare the answers once and keep them current:

• Where AI is used. From your inventory, in plain language.
• Which data it sees. From your data rules, including whether customer data trains any model.
• Which models and suppliers. From your supplier checks.
• Who reviews outputs. From your oversight rules.
• How incidents are handled. From your incident route, with the contact point.

Service firms and agencies meet these questions most often; see our professional services industry page for the operating context.

How Netbase governs its own AI delivery

Netbase applies the ISO/IEC 42001 AI management system framework to its own AI delivery practice. That is how we run our work, not a claim about a client's system. It sits on top of the security practices used on every project: secure code review and version control, TLS in transit and AES at rest, role-based access control, MFA for admin dashboards, vulnerability scanning and penetration testing, and NDAs and DPAs on request. Netbase holds ISO 27001 certification and a SOC 2 Type II attestation for its own operations.

See security and compliance

We work with the major commercial and open-weight AI models and choose per project, which keeps governance about the use case rather than one vendor. Our delivered AI includes 4over4's recommendation engine, part of an engagement in which 4over4 reported revenue up 82% within six months, and anonymised projects for clients who are not named, such as a RAG knowledge assistant. Governance is built into our responsible AI and MLOps and quality and security services.

Limitations of this guide

• This is general guidance, not legal advice. Obligations depend on your role, sector and markets.
• EU AI Act dates reflect the European Commission's pages as read in September 2026, after the AI Omnibus; they can change again.
• Summaries of ISO/IEC 42001, the NIST framework and OWASP describe their purpose, not their full requirements.
• Nothing here implies that following the baseline makes any system compliant.

How this guide was made

The Netbase Editorial Team wrote this guide from the European Commission's AI Act pages, the ISO, NIST and OWASP references and Netbase's verified security and AI facts. David (CEO) reviewed every Netbase statement. Drafting used AI assistance (Claude).

Next step

Share your AI inventory, or the questionnaire a customer sent you, and we will book a solution review to set a proportionate baseline. You can also see how we build digital products with governance inside, explore digital transformation consulting, read about retail and ecommerce, or browse more Netbase insights.

Related services and solutions