AI governance / Reference directory
AI governance frameworks, standards and regulations
AI governance frameworks and standards help organizations assign responsibility, manage AI risk and oversee how AI systems are used. Some provide voluntary guidance; others set management-system or technical requirements. Laws and regulations can impose separate, binding duties.
Compare the main approaches, identify relevant requirements and consult the original publications. The right combination depends on your AI systems, organizational role, sector and jurisdiction.
Choosing the right approach
Which requirements apply?
What needs to be demonstrated?
-
Legal and contractual dutiesIdentify obligations relevant to your role, location and use of AI.
-
Organizational governanceSelect an approach for policies, responsibilities and risk decisions.
-
Controls and assuranceDetermine how safeguards will operate and how claims will be checked.
01 / Compare key frameworks
Which AI governance framework should you use?
ISO/IEC 42001 is suited to organizations establishing a formal, certifiable AI management system. NIST AI RMF provides a voluntary approach to identifying and managing AI risk. The EU AI Act is legislation, not an optional governance framework; its applicable requirements must be addressed separately.
- ISO/IEC 42001
- AI management systemOrganizational requirements covering accountability, risk and impact assessment, controls, internal audit and improvement. It can support independent certification within a defined scope. Read the ISO 42001 guide.
- NIST AI RMF
- Voluntary AI risk managementGuidance for managing AI risks through Govern, Map, Measure and Manage. It does not establish a certifiable management system. Read the NIST AI RMF guide.
- EU AI Act
- EU legal requirementsBinding obligations apply according to the organization’s role, the AI activity and the relevant provisions. View the regulation.
- OWASP and CSA
- Application and cloud AI securityResources for evaluating security threats and selecting controls for language models, agents, applications and cloud-based AI. Browse security resources.
- IIA and ISACA
- Audit and technology-risk practiceProfessional guidance for reviewing governance, assessing controls and examining the evidence behind AI risk decisions. Browse assurance resources.
- NIST TEVV and ISO/IEC 42005
- Evaluation and impact assessmentMethods and guidance for testing system behavior and examining consequences for affected people and organizations. Browse evaluation resources.
Important: adopting a framework is not the same as meeting a law. Nor does management-system certification prove that every AI product or output is safe, reliable or lawful.
02 / How they work together
How do AI laws, standards and frameworks fit together?
An organization may need to comply with legislation, establish governance arrangements, secure its systems and verify that controls work. These tasks overlap, but one does not replace another.
A practical order of work
Identify obligations. Establish responsibility. Apply controls. Review the evidence.
Determine which laws, regulations, contracts and sector rules apply. The answer depends on your location, organizational role and how the AI system is used.
Choose how policies, responsibilities, risk decisions and management reviews will be organized. ISO/IEC 42001 and NIST AI RMF offer different approaches.
Address relevant issues such as cybersecurity, data quality, supplier dependencies, human oversight, system changes and incident response.
Use evaluation, impact assessment, internal audit or independent assessment as appropriate. Retain evidence that supports the claims and decisions being made.
- Enterprise AI governance
- ISO/IEC 42001Supported, where useful, by ISO/IEC 23894 and the NIST AI RMF.
- AI in the EU market
- EU AI ActAssess legal obligations first, then select appropriate management, security and testing practices.
- Generative AI and agents
- NIST Generative AI ProfileCombine relevant risk guidance with application security and operational controls.
- Audit and assurance
- Internal audit and evaluationUse appropriate audit methods, impact assessments and technical testing. ISO/IEC 42006 addresses bodies that certify AI management systems.
03 / Official sources and guidance
AI laws, standards, frameworks and assurance resources
Browse by subject and follow the publisher links for the original text, scope and latest status. Proposed laws and developing standards appear separately from published instruments.
- Law / regulation
- May impose binding duties.Check the relevant jurisdiction, role and activity before choosing voluntary guidance.
- Standard
- Provides defined requirements or guidance.Not all standards support certification.
- Framework
- Organizes governance, risk or assurance practices.Some are voluntary; others become relevant through contracts or sector requirements.
- Guidance / code
- Helps put requirements into practice.Check its source, status and intended audience.
04 / Related publications
Research and policy publications
Principles, declarations, research papers and policy reports can inform AI governance, but they do not necessarily create binding duties or specify implementable controls. This directory concentrates on instruments that organizations can use for governance, compliance, security, evaluation and assurance.
For policy context or emerging research, consult the original publication and distinguish its recommendations from enforceable requirements or established standards.
Research and policy guidance should be assessed for its authority, publication status and relevance to the particular AI activity.
05 / Common questions
Questions about AI governance standards
What is an AI governance framework?
It provides an approach to assigning responsibilities, identifying risks, deciding how AI systems may be used and reviewing the results. Some frameworks offer voluntary guidance; management-system standards establish formal requirements, and laws may impose binding obligations.
What is the difference between ISO/IEC 42001 and NIST AI RMF?
ISO/IEC 42001 defines requirements for an AI management system that may be independently certified. NIST AI RMF is a voluntary risk-management framework. Organizations can use both, but neither replaces the other automatically.
Does ISO 42001 certification establish EU AI Act compliance?
No. ISO/IEC 42001 certification applies to a defined management-system scope. EU AI Act duties must be assessed against the law, the organization’s role and its covered activities.
What should a small organization do first?
Identify the AI systems it develops, supplies or uses; determine relevant legal requirements; assign decision-making responsibility; and review the most consequential risks. Choose additional standards and controls according to those needs.
06 / About this directory
Sources and use of this directory
The directory brings together laws, standards, governance frameworks, security resources and assurance guidance. Their applicability depends on jurisdiction, organizational role, sector, system type, use and contractual commitments.
Entries link to the issuing organization or an authoritative publication source. Publication status, revisions and legal effect can change; check the original source before relying on an entry for a compliance or certification decision.
For implementation and audit work, record the exact document title, edition, applicable date and source. Preserve the version used for an assessment so that its conclusions can be reviewed later.