AI governance as co-regulation: a practitioner-informed framework for defense-sector small and medium-sized enterprises

Purpose This paper aims to examine how practitioners supporting defense-sector small and medium-sized enterprises (SMEs) place artificial intelligence (AI) governance within the coregulatory regime of National Institute of Standards and Technology Special Publication 800-171, the cybersecurity maturity model certification program, contracts and assessors. Design/methodology/approach An exploratory survey of 38 practitioners, recruited through a public LinkedIn post, combined a risk-to-control-family mapping task, artifact feasibility ratings and open-ended responses. Analysis was descriptive, with exploratory correlations adjusted for multiplicity and one researcher coded the open text. Findings Respondents concentrated AI risk on a few evidence-bearing control families, led by audit and accountability, risk assessment, access control and system and information integrity. Perceived compliance strain was high and readiness low. Artifacts resembling existing evidence, such as audit trail exports, were rated most feasible. Guidance ambiguity was the leading barrier. No exploratory association survived adjustment for multiplicity. Research limitations/implications The purposive sample and self-reported perceptions support pattern identification, not population estimates or claims about implementation outcomes. Practical implications Assessors and prime contractors could reduce SME burden by publishing exemplar AI evidence artifacts mapped to existing control families. Originality/value The study develops coregulation as a lens on the evidence burden of small firms at the base of regulatory chains, reports the full risk-to-control matrix and derives a seven-module framework that separates survey-supported elements from design choices.