Sooner or later, someone asks how your organization controls its AI: a customer’s procurement team, an auditor, a regulator or your own board. Three names come up in almost every answer: the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act. They are different kinds of things: a free method, a standard you can be certified against and a law with fines.
This is part 1 of Level 4 (Expert) in our AI Security learning path. You will learn what each framework requires, how their parts map onto each other and where a security team should start. Level 4 keeps the example from Level 3: the online shop. It now runs several AI systems: a support assistant, a fraud model that screens payments, product recommendations and a tool that pre-sorts job applications for its warehouse. The threat model from Level 3 is one of the risk assessments that all three frameworks ask for.
Three frameworks, three kinds of obligation
AI governance means the roles, rules and routines that decide which AI an organization uses, for what purpose and under which controls. The three frameworks support this work from different angles:
- The NIST AI RMF is voluntary guidance. NIST, the US National Institute of Standards and Technology, published version 1.0 in January 2023 (Source: NIST AI 100-1, AI Risk Management Framework 1.0, 2023, nist.gov). Nobody audits you against it.
- ISO/IEC 42001 is an international standard for an AI management system (AIMS), published in December 2023 (Source: ISO/IEC 42001:2023, iso.org). An accredited certification body can audit it and issue a certificate.
- The EU AI Act is a law: Regulation (EU) 2024/1689, in force since August 1, 2024. It sets duties for organizations that build or use AI systems in the EU, and national authorities enforce it.
The difference matters in practice. A risk process aligned with NIST shows good practice but proves nothing to an auditor on its own. An ISO/IEC 42001 certificate proves that a management system works — not that a specific AI system is safe or legal. And the AI Act looks at specific systems and roles, not at how mature your organization feels.
The NIST AI RMF: a shared method for AI risk
The AI RMF describes trustworthy AI with seven characteristics: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. Its core organizes the work into four functions:
- Govern sets up culture, policies, roles and rules for suppliers. It is cross-cutting: it shapes the other three functions.
- Map establishes the context: purpose, users, legal rules and the risks of every component.
- Measure tests and tracks these risks with suitable methods and metrics.
- Manage decides what to fix first, treats the risks, monitors systems in use and responds to incidents.
The functions split into 19 categories and these into concrete outcomes. GOVERN 1.6, for example, asks for mechanisms to inventory AI systems. MEASURE 2.7 asks that security and resilience are evaluated and documented. MANAGE 4.3 asks that incidents and errors are communicated to the relevant AI actors, including affected communities. The free AI RMF Playbook suggests actions for each outcome, which turns the framework into a practical checklist for any sector.
For generative AI, NIST added a profile: NIST AI 600-1 (July 2024). It describes 12 risks that generative AI creates or makes worse. Among them are confabulation (confident, made-up answers), data privacy, information security and risks in the value chain of models and components. NIST also maintains a taxonomy of attacks on machine learning, NIST AI 100-2, which part 2 of this level uses for adversarial machine learning.
ISO/IEC 42001: a management system you can certify
ISO/IEC 42001 applies to any organization that develops, provides or uses AI. It follows the harmonized structure of other ISO management system standards, such as ISO/IEC 27001 for information security. Clauses 4 to 10 set the requirements: context of the organization, leadership, planning, support, operation, performance evaluation and improvement — the Plan-Do-Check-Act cycle.
Three elements are specific to AI:
- an AI risk assessment and risk treatment, with a Statement of Applicability that lists which controls apply and why;
- an AI system impact assessment, which looks at consequences for individuals, groups and society, not only for the company;
- Annex A, a reference set of 38 controls in nine areas: AI policies, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. Annex B explains how to implement each control.
A certificate follows an audit by an accredited body, and regular surveillance audits keep it valid. If you already run ISO/IEC 27001, you can reuse most of the machinery: document control, internal audits, management reviews and corrective actions.
Two limits matter. First, a certificate covers a scope that the organization defines — perhaps one product line, not the whole company. When a vendor shows you a certificate, read the scope statement. Second, the standard asks you to manage risks; it sets no technical thresholds, such as an accuracy level or a test that every model must pass.
The EU AI Act: duties by role and risk class
The AI Act assigns duties by role and by risk. There are two main roles. The provider develops an AI system and places it on the market or puts it into service under its own name. The deployer uses an AI system under its own authority. A deployer can become a provider, for example by putting its name on a high-risk system or by changing a system’s intended purpose so that it becomes high-risk (Article 25). The Act sorts AI systems into four risk levels:
- Prohibited practices (Article 5) — for example social scoring, untargeted scraping of facial images, and emotion recognition at work or in schools, except for medical or safety reasons. From December 2, 2026, the ban also covers AI systems that create intimate deepfakes of real people without their consent or child sexual abuse material.
- High-risk systems (Article 6) — AI in products covered by EU safety laws (Annex I) and uses listed in Annex III, such as recruitment, credit scoring, education and critical infrastructure. Providers must meet requirements from risk management and data governance to logging, human oversight and cybersecurity (Articles 9 to 15). Before the system reaches the market, they must show this in a conformity assessment. Deployers must, among other things, assign trained people for human oversight, monitor the system and keep its logs for at least six months (Article 26).
- Transparency duties (Article 50) — people must learn that they are dealing with an AI, unless this is obvious; providers must mark AI-generated content in a machine-readable way; deployers must disclose deepfakes.
- Minimal risk — everything else, such as spam filters or product recommendations. The Act adds no new duties here, but other laws, such as the GDPR, still apply.
Separate rules apply to providers of general-purpose AI models, the large models behind chat assistants. Models with systemic risk, the most capable ones, must also be evaluated, including adversarial testing, and their providers must report serious incidents. Across all levels, Article 4 asks providers and deployers to support the AI literacy of their staff.
For the shop, this gives four different answers. It built the support assistant itself on top of an LLM API. So it is the provider of that system and must make sure that customers know they are chatting with an AI. The fraud model and the recommendations bring no new duties under the Act, though the GDPR still applies. The bought tool that pre-sorts job applications is high-risk under Annex III. From December 2, 2027, the shop as its deployer needs trained human oversight, monitoring and logs, and it must tell applicants that an AI system is involved. And an idea from the call center — analyzing the emotions of its own staff — is prohibited.
The timeline matters as much as the classes. The Act applies in stages, and an amendment from July 2026 moved the high-risk dates and added the new bans (Regulation (EU) 2026/1744, the “Digital Omnibus on AI”):
Fines for prohibited practices can reach €35 million or 7% of worldwide annual turnover. Most other violations can cost up to €15 million or 3%. The higher amount applies, but for small and medium-sized companies the lower one (Article 99). Use this section for orientation, not as legal advice.
How the three frameworks fit together
The frameworks do not compete. The AI Act says what the law requires for specific systems and roles. ISO/IEC 42001 gives you the management system that makes these duties routine and auditable. The NIST AI RMF gives your teams a method and a vocabulary to find, measure and treat the risks. All three feed on the same evidence: an inventory, risk and impact assessments, test results, logs and incident records.
The crosswalk shows where the same task appears in each framework. It is our own simplified mapping, not an official one:
| Task | NIST AI RMF | ISO/IEC 42001 | EU AI Act (high-risk) |
|---|---|---|---|
| Policy, roles, accountability | Govern | Clause 5; A.2, A.3 | Art. 17 (providers), Art. 26 (deployers) |
| Inventory of AI systems | GOVERN 1.6 | Clause 4; A.4 | Art. 6 with Annex III (classification), Art. 49 (registration) |
| Risk and impact assessment | Map, Measure | Clauses 6.1 and 8; A.5 | Art. 9; Art. 27 (fundamental rights impact assessment) |
| Data quality and governance | Map, Measure | A.7 | Art. 10 |
| Testing, robustness, security | MEASURE 2.1, 2.7 | Clause 8; A.6 | Art. 15 |
| Documentation and logs | Govern, Manage | Clause 7.5; A.6 | Art. 11, Art. 12 |
| Human oversight and intended use | MAP 3.5 | A.9 | Art. 14, Art. 26 |
| Monitoring and incidents | MANAGE 4.1, 4.3 | Clauses 9 and 10 | Art. 72, Art. 73 |
| Training and AI literacy | GOVERN 2.2 | Clauses 7.2 and 7.3 | Art. 4 (all systems) |
| Suppliers and third parties | GOVERN 6, MANAGE 3 | A.10 | Art. 25 |
One trap is common: an ISO/IEC 42001 certificate does not prove compliance with the AI Act. The Act checks high-risk duties system by system, in a conformity assessment. The European standards bodies CEN and CENELEC are writing harmonized standards for the Act; once their references are published, meeting them creates a presumption of conformity (Article 40). Until then, ISO/IEC 42001 is a strong foundation, not a shortcut.
Where to start
The right entry point depends on what you need first:
| Your situation | Start with | First result |
|---|---|---|
| You build or use AI in the EU, especially in hiring, credit, education or other Annex III areas | AI Act: classify every system and your role | A list of systems with risk class, role and deadline |
| Customers or tenders ask for proof of AI governance | ISO/IEC 42001: gap analysis against clauses 4–10 and Annex A | A scope, a gap list and a plan toward certification |
| Your teams need a practical risk method | NIST AI RMF with the Generative AI Profile | A risk process with owners and metrics |
| You already run ISO/IEC 27001 | Extend the existing management system to AI | Shared audits, documents and roles |
Whichever you choose, five steps serve all three frameworks:
- List every AI system: your own, bought tools and AI features in existing software — one entry per use, not per vendor.
- Classify each entry: your role, the AI Act risk class and the data it touches.
- Name an owner for each system and one person who runs the process.
- Assess the top risks with a threat model and an impact assessment.
- Keep the evidence in one place: assessments, test results, logs and incidents. Part 5 builds a secure AI program around these steps.
Tools support this work; they do not make the decisions. According to the vendor, Airia secures and governs AI agents, models, tools and data access in enterprises — a place where an inventory and policies can live. Checkr, by its own description, runs background and identity checks for hiring and lending decisions. Both are high-risk areas under the AI Act, so ask such vendors whether AI is involved and how they classify it. Pangram Labs, according to the vendor, detects AI-generated text, which helps with checks but does not replace the provider’s marking duty. More tools are in the AI Security section.
Short descriptions from our tool comparison, based on the vendors' information — not tested by ABXK.