The obstacles reported most often are not exotic. Stanford's 2026 AI Index lists gaps in knowledge, budget limits and regulatory uncertainty. NIST adds that AI risk is hard to measure, that acceptable risk is a local decision, and that third-party tools complicate everything. Published frameworks do not remove these problems, but they give a way to name and manage each one.
01What do organisations say slows them down?
Stanford's 2026 AI Index reports that the main obstacles to putting responsible AI into practice are gaps in knowledge (59%), budget constraints (48%) and uncertainty about regulation (41%). The same chapter found that having a written policy is getting more common, with the share of businesses without one falling from 24% to 11%. Writing a policy is easier than carrying it out (Stanford HAI).
02Challenge one: who does the work, and who owns it?
In an IAPP survey of more than 670 people in 45 countries, 23.5% named finding qualified AI professionals as part of the challenge, and only 10 of 671 respondents said they would need no more governance staff in the next 12 months. There is no clear best practice for where the work sits: about half of AI governance professionals were assigned to ethics, compliance, privacy or legal teams, and many programmes draw people from several departments (IAPP, AI Governance Profession Report 2025).
How frameworks answer: the NIST framework's Govern function asks organisations to set up structures, roles and documentation, and says senior leaders set the tone for risk culture (NIST AI 100-1). In a small team that can be one named owner and one backup. The IAPP notes that larger companies can split the tasks across several roles, while smaller ones look for people who can cover all of them.
03Challenge two: how do you measure AI risk?
NIST is frank that this is hard. Its framework lists reasons: there is no agreed way to measure many risks, tests in a lab can differ from real-world use, third-party data and tools can hide their own risk methods, and opaque systems are difficult to inspect. It adds that being unable to measure a risk does not mean the risk is low or high.
Buyers of AI face a specific version of this. A developer and a deployer can see different risks, and the deployer may not notice that their own use brings risks the developer never considered. NIST says every party in the chain shares responsibility for a system that is fit for its purpose.
How frameworks answer: NIST suggests impact assessments and tracking new risks as they appear. These do not produce a single score. They give a record of what you checked and why.
04Challenge three: how much risk is acceptable?
The framework does not set a risk tolerance for you. It says tolerance depends on context, law and the organisation's goals, and can change over time. Where no sector rule exists, the organisation has to define a reasonable level itself.
How frameworks answer: spend effort in proportion to impact. NIST says the highest-risk uses, especially those that affect people directly or rely on sensitive personal data, deserve the most urgent and thorough attention, and that trying to remove all risk can waste scarce resources.
05Challenge four: rules and frameworks keep moving
The IAPP's list of influential AI governance efforts runs across principles, laws, frameworks, declarations and standards groups, and the report calls the field hard to navigate (IAPP, AI Governance in Practice Report 2024). Dates also move. A 2026 amending regulation pushed the EU AI Act's main high-risk duties to 2 December 2027 and 2 August 2028, as of 24 October 2026 (AI Act Explorer).
The UK government met the same problem. Its Department for Science, Innovation and Technology built a self-assessment tool, AI Management Essentials, because many small and medium businesses found existing frameworks hard to use. After a consultation, its December 2025 response said a one-size tool struggled, and that it plans to build guidance aimed at smaller businesses (UK government response).
06What helps in practice?
These are our reading of the sources above, not a tested method.
- Pick one framework as your spine, so you are not juggling five.
- Begin with an inventory of the AI you already use.
- Decide your risk tolerance in writing, then review it when tools or rules change.
- Ask vendors the same few questions every time, and keep their answers.
- Treat a vendor's claims as input to your own testing, because their risk measures may differ from yours.
?What is not known
- The survey figures come from self-reported surveys with different samples, so they show patterns rather than precise rates.
- NIST says methods for measuring AI risk and harms are still being developed and debated, so many risks have no agreed test.
- The UK government has not published the replacement guidance for smaller businesses that its response describes.
QQuestions people ask
What is the biggest AI governance challenge for a small team?
The sources point to knowledge and budget first. A small team can cover most of the basics with an inventory, a named owner and a short written rule, then add detail later.
Do the frameworks solve these challenges?
No. They give a structure for naming and tracking problems. NIST itself says some risks are hard to measure and some tolerances remain unresolved.
Last checked October 24, 2026. Rules and settings change, so open the source to see the current version.
- The 2026 AI Index Report, Responsible AI chapter Stanford HAI Source of the figures on obstacles and on organisations with no responsible AI policy.
- AI Governance Profession Report 2025 IAPP and Credo AI Survey report used for staffing, talent and team-structure findings.
- AI Governance in Practice Report 2024 IAPP and FTI Consulting Used for the range of overlapping principles, laws and frameworks organisations face.
- NIST AI 100-1, AI RMF 1.0 NIST Framework text, including its own section on challenges for AI risk management.
- Digital Omnibus on AI Future of Life Institute, AI Act Explorer Non-official page recording the amending regulation and the new high-risk dates.
- Government response to the consultation on AI Management Essentials UK Department for Science, Innovation and Technology December 2025 response explaining why the tool is being reworked for smaller businesses.
General information, not legal, medical, financial or investment advice. We are not affiliated with any company, agency or standards body named here. See our editorial policy and corrections, or tell us about a mistake at [email protected].