Securing & Governing AI · Chapter 13 of 13
The frameworks — NIST, ISO 42001, EU AI Act
What each is for, which you need, and how not to waste a year.
Three names dominate, they are not alternatives to each other, and confusing them wastes considerable time. One is a voluntary structure for thinking, one is a certifiable management system, and one is law.
| What it is | Binding? | Use it for | |
|---|---|---|---|
| NIST AI RMF | A voluntary risk framework in four functions — Govern, Map, Measure, Manage | No | Structuring a programme when starting from nothing |
| ISO/IEC 42001 | A certifiable AI management system standard, ISO-shaped like 27001 | Only if you certify | Demonstrating governance to customers and regulators |
| EU AI Act | Regulation, risk-tiered by use case, with prohibited and high-risk categories | Yes, extraterritorially | Determining legal obligations — do this first |
- First, determine whether the EU AI Act applies and at what tier. It reaches organisations outside the EU whose systems affect people in it, so “we're not European” is not an analysis. Tiering is by use case, not technology — the same model is unregulated in one application and high-risk in another. Most internal enterprise tooling lands outside high-risk, and knowing that early prevents a great deal of unnecessary work.
- Then use NIST AI RMF to structure the programme — free, readable, and organised the way you actually work.
- Then consider ISO 42001 if customers or regulators need a certificate. If you already run 27001 this is an extension, not a new mountain.
Do not start with a framework
The most common failure in AI governance is buying a framework before knowing what you have. Build the inventory first — what exists, who owns it, what it touches, what happens if it is wrong. Everything else is easier afterwards, and roughly half the register usually turns out to be low-consequence internal tooling needing light-touch treatment.
An inventory takes weeks and makes you immediately useful. A framework adopted without one takes a year and makes you unpopular.
Reading a framework for what it actually asks
There are now several AI governance frameworks, and comparing them clause by clause is a poor use of time. They converge on the same small set of demands, and knowing that set means you can read any of them quickly and answer questions about frameworks you have not studied.
- Know where AI is used. An inventory. Every framework asks for this and most organisations cannot produce one — particularly for AI embedded in software they bought rather than built.
- Tier by consequence. Proportionate scrutiny according to what happens when it is wrong, rather than uniform process for everything.
- Assess before deployment, including who could be harmed and how.
- Keep a human meaningfully in the loop for consequential decisions — and note that meaningfully is doing the work in that sentence.
- Monitor after deployment, because performance drifts when the world changes.
- Document: what it does, what it is not for, what data trained it, how it was evaluated, what its limitations are.
- Be able to explain a decision to the person it affected.
The compliance failure is almost never the absence of a framework. It is that controls exist on paper and do not operate.
Every organisation has a policy. Far fewer can produce the artefacts: the inventory with dates, the frozen evaluation set, the override rate, the traced deletion path, the alert that fired and what was done.
So prepare for assessment by producing the evidence rather than the policy, and you will simultaneously discover which controls are not operating — which is the actual point.
And be precise about regulatory status when you talk about it, because this area moves and confident wrong statements are common. Obligations differ by jurisdiction, by risk tier, and by date, and several widely-quoted deadlines have shifted. Check the current position before asserting one, and say when you last checked.
The honest framing for an interview: “the frameworks agree on what to do; the difficulty is entirely in evidencing that you do it.”
Check yourself