THE GOVERNANCE GAP: AI Integration in Resource-Prudent Organizations and the Frameworks That Don't Yet Exist

Abstract

Small and mid-sized organizations operating under enforceable federal compliance frameworks — CJIS, CMMC 2.0, HIPAA, FedRAMP — are already using AI-connected tools. Most did not choose to. AI features are arriving through software updates to existing platforms, embedded in products whose compliance posture was authorized before those features existed. The organizations affected share three simultaneous conditions: real compliance obligations, active AI exposure, and no governance infrastructure capable of managing the intersection. The gap is structural. The frameworks currently available — NIST AI RMF, ISO 42001, the EU AI Act — presuppose governance capacity that does not exist in organizations where a single IT director manages the help desk, handles vendor renewals, and covers dispatch system outages. Drawing on OECD and SBA adoption data, Microsoft's H2 2025 AI Diffusion Report, and analysis across six compliance frameworks and three primary sectors, this paper establishes that the frameworks that would tell these organizations what questions to ask have not been written. CJIS contains no AI provisions. FedRAMP's Significant Change Notification standard can trigger re-authorization timelines a 35-person vendor may not survive. The best available legal analysis of the AI/HIPAA intersection identifies three layers of definitional questions that existing regulatory text does not resolve. This paper maps that terrain, identifies where AI-specific guidance exists and where it does not across each major applicable framework, and provides four vendor triage questions designed to create a defensible paper trail before an audit requires one.