AI regulations & frameworks
AI regulations & frameworks
The law and the layers
The EU AI Act, ISO/IEC 42001, and the NIST AI RMF are not three options to choose between. The EU AI Act is the law: it sets the legal obligations that apply to the relevant actor, system, and use case. ISO/IEC 42001 is the certifiable management system standard that gives your governance an auditable backbone. The NIST AI RMF is the risk method that runs inside it. They are complementary and layered, and this section covers each layer and how they connect.
Organizations meeting AI regulation for the first time tend to ask the wrong first question: which framework should we pick. The frameworks answer different questions, and the three layers are a proven way to combine them: not a required architecture, but a practical one. The law sets the obligations and the deadlines. The management system standard turns obligations into an operating structure that a certification body can audit. The risk framework supplies the method for identifying and treating AI risk within that structure.
One connection between the layers deserves early attention, because it is widely assumed and legally false. ISO/IEC 42001 certification does not create a presumption of conformity with the AI Act. That presumption attaches only to harmonized European standards after the Commission cites them in the Official Journal, and the first candidates are only now reaching publication. Until relevant harmonized standards or common specifications provide a presumption of conformity, providers substantiate compliance through other technical and documentary evidence within the applicable conformity assessment procedure.
The law
The frameworks
NIST AI RMF.
The voluntary risk method: four functions, govern, map, measure, and manage, and why alignment is not certification.
ISO/IEC 42001.
The certifiable management system standard: what the AIMS requires, what the certificate proves, and the ISO/IEC 42006 question behind every certificate.
OECD AI Principles.
The intergovernmental reference point that the other layers cite, and the OECD classification framework for AI systems that operationalizes it. The OECD AI Principles sit at a different level: a widely recognized policy and values reference, not a compliance method or a certifiable management system.
Each framework page carries the same companion piece: the frameworks comparison, which sets the three layers side by side and shows where they overlap and where they do not.
Kept current
Time-bound facts on these pages carry a date stamp. The regulation changed in July 2026 and the first European AI standard reached publication the same month; where a page depends on a moving fact, the stamp tells you when it was last verified against the official source.