Securing & Governing AI · Chapter 13
The frameworks — NIST, ISO 42001, EU AI Act
What each is for, which you need, and how not to waste a year.
Three names dominate, they are not alternatives to each other, and confusing them wastes considerable time. One is a voluntary structure for thinking, one is a certifiable management system, and one is law.
| What it is | Binding? | Use it for | |
|---|---|---|---|
| NIST AI RMF | A voluntary risk framework in four functions — Govern, Map, Measure, Manage | No | Structuring a programme when starting from nothing |
| ISO/IEC 42001 | A certifiable AI management system standard, ISO-shaped like 27001 | Only if you certify | Demonstrating governance to customers and regulators |
| EU AI Act | Regulation, risk-tiered by use case, with prohibited and high-risk categories | Yes, extraterritorially | Determining legal obligations — do this first |
- First, determine whether the EU AI Act applies and at what tier. It reaches organisations outside the EU whose systems affect people in it, so “we're not European” is not an analysis. Tiering is by use case, not technology — the same model is unregulated in one application and high-risk in another. Most internal enterprise tooling lands outside high-risk, and knowing that early prevents a great deal of unnecessary work.
- Then use NIST AI RMF to structure the programme — free, readable, and organised the way you actually work.
- Then consider ISO 42001 if customers or regulators need a certificate. If you already run 27001 this is an extension, not a new mountain.
Do not start with a framework
The most common failure in AI governance is buying a framework before knowing what you have. Build the inventory first — what exists, who owns it, what it touches, what happens if it is wrong. Everything else is easier afterwards, and roughly half the register usually turns out to be low-consequence internal tooling needing light-touch treatment.
An inventory takes weeks and makes you immediately useful. A framework adopted without one takes a year and makes you unpopular.