AI Governance Framework: How NIST, ISO/IEC 42001, and the EU AI Act Fit Together

It is the structure an organization uses to decide which AI it will use and on what conditions: owners with the authority to approve or stop a use case, rules for people using AI tools, a method to tier and assess each system, the evidence required before launch, and monitoring afterward. Public frameworks such as the NIST AI RMF and ISO/IEC 42001 supply the vocabulary and structure, and laws such as the EU AI Act set minimum duties. The organization’s own decisions are what turn those sources into a framework.

There is no official set of three pillars. Vendors and institutes publish different lists, from three pillars to five. The split this page uses is law (what you must do), a management system (how you keep doing it), and risk practice (how you judge one system). Whatever structure you choose, check that it covers all nine decisions above.

The most widely adopted five are the values-based OECD AI Principles, adopted in 2019 and updated in May 2024, with 47 adherents: inclusive growth, sustainable development and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability. They state values, not procedures. The nine decisions are how an organization turns them into owners and records.

The NIST AI Risk Management Framework, AI RMF 1.0, released January 26, 2023. It is voluntary and organizes AI risk work into four functions: Govern, Map, Measure, and Manage, with 19 categories and 72 subcategories. Govern is cross-cutting and shapes the other three. NIST added a Generative AI Profile, NIST AI 600-1, on July 26, 2024, and states that AI RMF 1.0 is being revised under the White House AI Action Plan.

It can. Article 2 applies the Act to providers that place AI systems on the EU market wherever they are based, and to providers and deployers outside the EU where the output of the system is used in the EU. A US employer screening applicants in the EU, or a US software company selling an AI feature to EU customers, should treat the Act as reaching that system until qualified counsel concludes otherwise.

No. ISO/IEC 42001 is a voluntary international standard. Some customers and procurement teams ask for it, and a certificate shows an audited management system. It is not what the EU AI Act asks for: that law sets duties by role and risk class, and a certificate does not by itself show that any system meets them.

Not one that would work. A framework is a set of decisions only your organization can make: who can stop a system, what data may enter which tool, which use cases count as high-risk for you, and what evidence a launch requires. A copied framework carries someone else’s answers. This page gives the structure and points to the Institute’s published document for each decision. The decisions themselves stay yours.

Agents take actions, such as updating a record or making a payment, rather than only answering. Singapore’s IMDA published its Model AI Governance Framework for Agentic AI on January 22, 2026, with four dimensions: bound the risk up front by limiting an agent’s autonomy and its access to tools and data; make people accountable through checkpoints that require human approval; apply technical controls across the agent’s lifecycle; and prepare end users through transparency and training. Each maps to a decision above: bounding to decision 4, checkpoints to decision 6, lifecycle controls to decisions 5 and 9, and user preparation to decisions 3 and 7.