AI governance frameworks: NIST AI RMF, ISO 42001 and the EU AI Act

What is AI governance?

AI governance is how an organization decides who may build or buy AI, for what purposes, under what controls, and who answers when it goes wrong. In practice it combines a written policy, named owners, an inventory of AI systems, risk and impact assessments, testing before release, monitoring after release, and a way to report and fix incidents. NIST describes the goal as managing risks to individuals, organizations and society while improving the trustworthiness of AI systems (NIST).

The term covers both voluntary practice and legal duty. Most of what organizations call AI governance in the United States is voluntary, built on the NIST framework or the ISO standard. In the European Union, the AI Act turns several governance practices into legal obligations for high-risk systems, such as a documented risk management system and a quality management system (Regulation (EU) 2024/1689). The same internal program can usually serve both purposes, which is why the three are often mapped against each other.

AI governance framework comparison

The table compares the three main reference points and NIST's generative AI companion. Status is as of November 9, 2026.

Framework	Type	Mandatory?	Certifiable?	Publisher	Best used for
NIST AI RMF 1.0 (AI 100-1)	Risk management framework	No; voluntary	No	NIST, US Department of Commerce	Structuring risk work across the AI lifecycle
NIST AI 600-1, Generative AI Profile	Profile of the AI RMF	No; voluntary	No	NIST	Generative AI risks such as confabulation and synthetic content
ISO/IEC 42001:2023	Management system standard	No; voluntary	Yes, by an accredited certification body	ISO and IEC	An auditable, organization-wide AI management system
EU AI Act	Regulation	Yes, for in-scope providers and deployers	High-risk systems undergo conformity assessment	European Union	Legal compliance for AI placed on or used in the EU market

The NIST documents are free; the ISO standard is sold by ISO and national standards bodies. NIST's framework is organized around four functions, Govern, Map, Measure and Manage (NIST AI 100-1). ISO/IEC 42001 follows the harmonized structure of other ISO management system standards, so it can sit alongside an existing information security or quality program. The AI Act sets outcomes in law but leaves the method to the organization, and refers to harmonised standards still being developed.

NIST AI RMF

NIST released the AI Risk Management Framework 1.0 on January 26, 2023, for voluntary use (NIST). It lists seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed (AI 100-1). Its core has four functions. Govern sets the culture, policies and accountability that apply throughout; Map establishes the context and identifies risks for a given system; Measure analyses and tracks those risks; Manage prioritizes and acts on them.

On July 26, 2024, NIST added the Generative AI Profile, NIST AI 600-1, which applies the framework to risks specific to generative systems (NIST). NIST also publishes a Playbook of suggested actions and a crosswalk to other frameworks. As of November 9, 2026, NIST says the AI RMF 1.0 is being revised as part of the White House AI Action Plan; no revised version has been published (NIST). The administration's AI policy traces to Executive Order 14179 of January 23, 2025, which called for that action plan (90 Fed. Reg. 8741).

ISO/IEC 42001

ISO/IEC 42001:2023 was published in December 2023 and sets requirements for establishing, implementing, maintaining and continually improving an AI management system, according to ANAB, the US accreditation body. It is written for any organization that develops, provides or uses AI. Its components include AI risk assessment, AI impact assessment of effects on individuals, groups and society, data management, and a set of controls in its annexes.

Its distinguishing feature is certification. An independent certification body can audit an organization's AI management system and certify that it conforms; the certificate covers the organization's processes, not any particular AI product (ANAB). ANAB launched its accreditation program for 42001 certification bodies in January 2024. Certification is voluntary and is not required by any statute discussed on this page, although buyers increasingly ask for it in procurement.

How ISO 42001 relates to the NIST AI RMF

The two are complementary. The NIST framework explains what AI risk management should consider and offers a vocabulary for it; ISO/IEC 42001 specifies a management system that can be audited. Organizations commonly use NIST to shape risk assessments and 42001 to organize policies, roles, records and internal audits around them. Neither satisfies the EU AI Act on its own, because the Act sets specific legal requirements for high-risk systems.

EU AI Act governance duties

The AI Act converts several governance practices into law, mostly for high-risk systems. Under the Digital Omnibus (Regulation (EU) 2026/1744), those duties apply from December 2, 2027 for Annex III systems such as hiring and credit scoring, and from August 2, 2028 for AI in regulated products. The duties below come from the text of Regulation (EU) 2024/1689.

• Risk management system (Article 9). Providers of high-risk systems must establish, document and maintain a continuous, iterative risk management process across the system's lifecycle.
• Quality management system (Article 17). Providers must put in place a documented quality management system of written policies, procedures and instructions, covering regulatory strategy, design, testing and data management.
• Deployer duties (Article 26). Deployers must use high-risk systems according to the instructions, assign human oversight to people with the necessary competence, training and authority, and keep automatically generated logs for at least six months.
• Fundamental rights impact assessment (Article 27). Public bodies, private entities providing public services, and deployers using AI for creditworthiness or life and health insurance pricing must assess the impact on fundamental rights before use.
• Post-market monitoring (Article 72). Providers must collect and analyse performance data throughout the system's life.

One governance duty already applies to almost everyone. Article 4 has required AI literacy measures since February 2, 2025. The Omnibus, in force since July 27, 2026, replaced the duty to ensure a sufficient level of literacy with a duty to take measures supporting it, an obligation of effort rather than outcome, according to Lewis Silkin and Bristows. Deployers of high-risk systems remain subject to the more specific competence requirement in Article 26(2). Our EU AI Act guide covers scope and deadlines.

AI governance principles and best practices

The frameworks converge on a short list of practices. The list below draws on the NIST functions and the ISO management system components described above; it is a summary of common elements, not a legal checklist.

1. Inventory. Keep a register of AI systems in use or development, with owner, purpose, data and vendor.
2. Classify by risk. Sort systems by potential harm, and flag any that fall into regulated categories such as hiring, credit or health.
3. Assess before release. Run a documented risk and impact assessment, including testing for accuracy, bias and misuse.
4. Assign human oversight. Name people with authority to pause or override a system.
5. Monitor and log. Track performance and incidents after deployment and keep logs.
6. Disclose. Tell people when they are dealing with AI and label synthetic content where the law requires it.
7. Train. Give staff who build, buy or use AI training proportionate to their role.
8. Review vendors. Put governance terms in contracts with AI suppliers.

AI governance policy

An AI policy is the written document that sets these rules for staff: which tools are approved, what data may go into them, what uses are prohibited, who approves new uses, and how incidents are reported. ISO/IEC 42001 treats an AI policy as a core element of the management system (ANAB). A policy only works if it names owners and is backed by the inventory and review steps above.

AI governance model and roles

Most governance models combine a senior accountable owner, a cross-functional review group drawing on legal, security, privacy and the business, and system-level owners who run assessments and monitoring. NIST's Govern function places accountability structures and organizational roles at the center of the framework (AI 100-1). Smaller organizations often assign these roles to existing privacy or security leads rather than creating new ones.

AI governance regulations to track

No US federal law requires a general AI governance program as of November 9, 2026. Several state laws require specific governance steps, and one rewards use of a recognized framework.

• Texas TRAIGA (HB 149). In force since January 1, 2026. A defendant may avoid liability if it discovers a violation through an internal review while substantially complying with the NIST Generative AI Profile or another recognized AI risk framework (HB 149 enrolled text).
• Colorado SB 26-189. From January 1, 2027, deployers of automated decision-making technology in consequential decisions owe notice, explanation, correction and human review (Colorado General Assembly). See our Colorado page.
• California SB 53. In force since January 1, 2026; large frontier developers must publish a frontier AI framework and transparency reports and report critical safety incidents (FPF). See our SB 53 page.
• California SB 1119 (Adam's Law). From July 1, 2027, companion chatbot operators that allow children must run risk assessments, publish a child safety policy and later submit to independent audits (ZwillGen).
• EU AI Act. Article 4 literacy now; high-risk governance duties from December 2027 (Regulation (EU) 2026/1744).

For a single view of these obligations with start dates, see the AI compliance checklist, and for the wider body of law, the state AI law tracker.

What changed

• 2026-11-09: Framework status checked: NIST AI RMF 1.0 still current and under revision; no ISO/IEC 42001 revision announced.
• 2026-07-27: EU Digital Omnibus entered into force: Article 4 AI literacy softened; high-risk dates moved to December 2027 and August 2028.
• 2026-04-07: NIST released a concept note for an AI RMF profile on critical infrastructure.
• 2026-01-01: Texas TRAIGA took effect, with a defense tied to the NIST Generative AI Profile.
• 2025-02-02: EU AI Act Article 4 AI literacy measure began to apply.
• 2024-07-26: NIST published the Generative AI Profile, NIST AI 600-1.

Frequently asked questions

What is AI governance?

AI governance is the set of policies, roles, assessments and controls an organization uses to manage the risks of AI it develops or uses. It typically includes an AI inventory, risk and impact assessments, human oversight, monitoring and incident handling, and a written AI policy.

What is the best AI governance framework?

It depends on the goal. The NIST AI RMF is free and widely used to structure risk work; ISO/IEC 42001 suits organizations that want a certifiable management system; the EU AI Act is mandatory for in-scope systems in the EU. Many organizations use NIST for risk method and ISO 42001 for the management system.

How does ISO 42001 relate to NIST AI RMF?

They are complementary. NIST's framework sets out what AI risk management should cover, organized into Govern, Map, Measure and Manage. ISO/IEC 42001 specifies an auditable management system that can be certified by a third party. Neither is legally required in the US.

Is AI governance required by law?

Not generally in the US as of November 9, 2026, but specific laws require parts of it: Colorado, California and Texas impose duties or offer defenses tied to governance. In the EU, the AI Act requires risk and quality management for high-risk systems from December 2027 and AI literacy measures now.

Sources

1. NIST: AI Risk Management Framework
2. NIST AI 100-1: AI RMF 1.0 (PDF)
3. ANAB: ISO/IEC 42001 AI management systems
4. EUR-Lex: Regulation (EU) 2024/1689 (AI Act)
5. EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
6. Lewis Silkin: the Digital Omnibus on AI enters into force (July 27, 2026)
7. Bristows: the Digital Omnibus on AI, key changes
8. Texas Legislature: HB 149 enrolled text
9. Colorado General Assembly: SB26-189
10. Federal Register: Executive Order 14179 (90 Fed. Reg. 8741)