Standards, Frameworks and Laws: Reading AI Governance Requirements Correctly

AI governance conversations often put three names side by side: ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act. They do overlap in subject matter. But treating them as interchangeable leads to expensive mistakes, such as believing a certificate equals legal compliance, or that a voluntary framework can be ignored when a regulator asks questions.

Three different kinds of instrument

How do they fit together?

Think in layers.

1. The law sets the outcome you must achieve. For a high-risk AI provider under the EU AI Act, that includes a risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness, a quality management system and post-market monitoring.
2. The management system provides the machinery. ISO/IEC 42001 gives you policy, roles, risk and impact assessment, life-cycle controls, internal audit and management review, the organisational infrastructure that produces and maintains compliance.
3. The risk framework sharpens the method. The NIST AI RMF’s Govern, Map, Measure and Manage functions, and its Generative AI Profile, give detailed thinking on context, measurement and response.

None of these layers substitutes for another. A certified AIMS that never classified its systems under the AI Act has a gap. A thorough AI Act gap assessment with no management system behind it tends to decay after the project ends.

Questions to ask about any AI requirement

• Is it binding? Law, contract or voluntary choice?
• Who is it addressed to? A provider, deployer, importer, an organisation in general, or a model developer?
• What triggers it? A risk tier, a use case, a data type, a market?
• When does it apply? Under the EU AI Act this changed in 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the main high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• How is it demonstrated? Certificate, conformity assessment, documentation on request, or self-assessment?

A practical starting sequence

1. Build an AI inventory, including vendor features and internal tools.
2. Classify each system under the laws that reach you, and record your role.
3. Stand up governance: an accountable owner, a cross-functional review group and decision rights for high-impact uses.
4. Adopt ISO/IEC 42001 structure for policy, risk, impact assessment and audit, whether or not you intend to certify.
5. Use the NIST AI RMF to deepen mapping and measurement, especially for generative AI.
6. Track guidance, codes of practice and harmonised standards as they are published.

Further reading in the Academy

Read the full guides to ISO/IEC 42001, the NIST AI RMF and the EU AI Act.