The NIST AI Risk Management Framework scales down well: govern, map, measure, manage. For a smaller company that means naming an owner, listing where AI is used, checking what could go wrong, and writing down what you decided. Documenting that earns legal protection in Texas.
The framework was written to flex by organization size, and the smaller-company version is genuinely small: most of the value is in the mapping step, because most companies have never listed where AI is actually in use and what data it touches.
The reason to write it down, beyond good sense: the Texas Responsible AI Governance Act grants a safe harbor to organizations that document AI risk management aligned to this exact framework. A law that tells you in advance what evidence protects you is rare. Details on the Texas AI law page.