AI Governance Frameworks Compared: NIST, ISO 42001, EU AI Act, and CoreGuard

Published by the US National Institute of Standards and Technology in January 2023, the AI RMF is a flexible, non-prescriptive framework organized around four core functions: GOVERN, MAP, MEASURE, and MANAGE. GOVERN establishes accountability structures and policies. MAP identifies AI risks in context. MEASURE analyzes and assesses risks using qualitative and quantitative methods. MANAGE prioritizes and treats identified risks. The framework is accompanied by an extensive Playbook of suggested practices organized by subcategory.

The RMF is designed to be industry-agnostic and outcome-oriented: it describes the risk management activities an organization should perform without dictating exactly how to perform them. This flexibility is a feature for organizations building governance programs — it means the RMF maps onto almost any organizational structure and any AI use case. It is also the source of the RMF's primary limitation in regulated contexts: flexible frameworks cannot produce consistent, comparable compliance evidence across organizations.

Published in November 2023, ISO/IEC 42001 is the first internationally recognized management system standard for AI — the direct parallel to ISO 27001 for information security management. It specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). Like all ISO management system standards, it follows the Annex SL structure: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement.

ISO 42001 certification requires an accredited third-party audit of the management system, not just self-declaration. The standard addresses AI-specific requirements including AI policy, AI risk assessment and treatment, impact assessments, and controls for responsible AI development and use. Annex A provides a catalog of objectives and controls that certified organizations should consider, covering data quality, model documentation, and human oversight.

The EU AI Act entered into force on August 1, 2024, and is the world's first comprehensive binding regulation specifically for artificial intelligence. It applies a risk-based tiered approach: systems posing unacceptable risk are prohibited, high-risk AI systems are subject to extensive requirements, and lower-risk systems face lighter transparency obligations. High-risk systems include AI used in credit scoring, employment decisions, education access, essential services, and critical infrastructure.

The requirements for high-risk AI systems are substantive: risk management systems, data governance measures, technical documentation, record-keeping, transparency, human oversight, accuracy and robustness requirements, and conformity assessments before market placement. Penalties for violations reach €35 million or 7% of global annual turnover. The Act applies to any organization placing high-risk AI systems on the EU market or into service, regardless of where the provider is located.

The OECD Principles on Artificial Intelligence, adopted in May 2019 and updated in 2024, are the foundational international reference for AI governance. They have been endorsed by over 40 countries and form the conceptual backbone of numerous national AI strategies and regulations. The five principles are: inclusive growth and sustainable development, human-centred values and fairness, transparency and explainability, robustness and security, and accountability. The OECD also maintains a monitoring framework for tracking AI incidents and policy developments across member countries.

SR 11-7 is the Federal Reserve's supervisory guidance on model risk management, issued in 2011 and explicitly extended to AI/ML systems in subsequent guidance. It requires that models used in material bank decision-making be conceptually sound, validated before use, and subject to ongoing monitoring and reporting. The OCC's parallel guidance (OCC 2011-12) establishes identical expectations for national banks. While framed as guidance rather than binding regulation, SR 11-7 compliance is examined as part of bank safety and soundness examinations — material deficiencies result in regulatory findings with tangible consequences.

AI systems used for credit decisions, fraud detection, capital modeling, and stress testing are squarely within SR 11-7's scope. The guidance requires model developers to document their development process, data sources, assumptions, and limitations. It requires independent model validation — not just by the team that built the model. And it requires ongoing performance monitoring with defined thresholds for escalation and remediation.