AI governance: NIST AI RMF, EU AI Act and ISO/IEC 42001

What AI governance covers

AI governance is the set of policies, roles and processes that keep AI use safe, legal and aligned with the organisation’s goals. It covers security, but also privacy, fairness, transparency, accuracy and accountability. Security teams are often asked to help because they already run risk assessments, supplier reviews and controls frameworks such as ISO/IEC 27001.

NIST AI Risk Management Framework

The NIST AI RMF 1.0 (published as NIST AI 100-1) is a voluntary framework from the US National Institute of Standards and Technology. It describes characteristics of trustworthy AI, such as valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair. Its core has four functions:

• Govern: set policies, roles, accountability and a risk-aware culture. It underpins the other three.
• Map: understand the context, intended use, people affected and potential harms of each AI system.
• Measure: test, evaluate and track the identified risks with suitable methods and metrics.
• Manage: prioritise and treat risks, respond to incidents and monitor over time.

NIST also publishes a companion profile for generative AI (NIST AI 600-1) and a playbook with suggested actions.

The EU AI Act

The EU AI Act is a European Union regulation that entered into force in 2024, with its obligations applying in phases over the following years. It can apply to organisations outside the EU when their AI systems are placed on the EU market or their output is used in the EU. It sorts AI uses into tiers:

• Unacceptable risk: banned practices, such as social scoring by public authorities and certain manipulative techniques.
• High risk: uses in areas such as critical infrastructure, employment, education and access to essential services. Providers must manage risk, data quality, documentation, human oversight, accuracy, robustness and cybersecurity.
• Transparency obligations: for example, people should be told when they are talking to a chatbot, and certain synthetic content must be labelled.
• Minimal risk: most other uses, with no new legal duties.

It also sets duties for providers of general-purpose AI models. Timelines and guidance have been adjusted since adoption, so always check the current official position before advising on deadlines.

ISO/IEC 42001 and putting it together

ISO/IEC 42001:2023 specifies an AI management system (AIMS). It follows the same high-level structure as ISO/IEC 27001, with clauses on context, leadership, planning, support, operation, performance evaluation and improvement, plus annex controls for AI. Organisations can be certified against it, and those already certified to ISO/IEC 27001 can extend existing processes. ISO/IEC 23894 gives related guidance on AI risk management.

Tip: start with an AI inventory. You cannot govern systems you do not know about, including AI features switched on inside software you already use.