Which AI governance framework to pursue first
If your AI system reaches EU users or its output is used in the EU, the EU AI Act applies by law, whatever else you adopt. ISO/IEC 42001 gives you a management system that an accredited certification body can certify, and NIST AI RMF gives you a voluntary structure with no certificate. The practical question is therefore not which one to pick, but which obligations you already carry and which proof your buyers ask for. Start by mapping where your system is placed on the EU market and which of the Act's risk levels it may fall into, because that determines the deadlines you cannot negotiate.
EU high-risk providers should treat the AI Act as the starting point. The high-risk rules now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, as amended in 2026, so confirm those dates against the consolidated text before you plan. Most Annex III systems use internal-control conformity assessment, so the work you own is documentation, a quality management system and post-market monitoring. ISO/IEC 42001 can support the management side, but the Commission states it does not match the Act's quality management system, so check the harmonised standard EN 18286:2026 for that gap. Enterprise AI vendors selling into regulated buyers often add ISO/IEC 42001 certification as the external proof customers request, while US-only builders with no EU exposure may reasonably start with NIST AI RMF, which is voluntary and free to use.
Combining frameworks makes sense when you need both a legal baseline and a certificate. A workable sequence for many teams is to use the NIST AI RMF Core, particularly the Govern and Map functions, to build the risk vocabulary, then map the resulting controls to the Annex A controls of ISO/IEC 42001 and record your statement of applicability. Confirm with a certification body, before you commit, whether it will certify against ISO/IEC 42001 under ISO/IEC 42006:2025, and ask what the audit cycle and fee structure look like in a written quote. Your largest recurring cost will be keeping the evidence current, so decide who owns each control before you buy any external assessment.
How the EU AI Act, ISO 42001 and NIST AI RMF differ
This table compares the three AI governance instruments by legal force, issuing body, scope, proof, version status and the cost signals that are supplied. Read each cell with its condition, because the right choice depends on whether you place AI systems on the EU market, need a certificate for buyers, or need a voluntary risk vocabulary.
| Dimension | EU AI Act | ISO/IEC 42001 | NIST AI RMF 1.0 |
|---|---|---|---|
| Legal force | Binding regulation. Applies to providers and deployers whose AI systems reach the EU market or whose output is used in the EU, from the dates set in Article 113 as amended in 2026. | Voluntary standard. Becomes contractually binding only when a customer, partner or procurement clause requires it. | Voluntary framework. NIST states neither private nor public organizations are required to use it. |
| Issuing body | European Commission and national market surveillance authorities. The AI Office enforces general-purpose AI model rules. | ISO/IEC JTC 1/SC 42. Certification is issued by external certification bodies, not by ISO. | NIST. NIST does not validate or endorse any organization's use of the framework. |
| Scope | Risk-based. Covers prohibited practices, high-risk systems, transparency duties and general-purpose AI models. Minimal-risk uses are not regulated. | Any organization that provides or uses AI-based products or services, regardless of size or sector. Management system scope is set by the organization. | Any organization designing, developing, deploying or evaluating AI systems. Applies to all sectors and sizes. |
| Proof produced | Conformity assessment for most Annex III systems is internal control (Annex VI). Some biometric systems and Annex I products involve notified bodies (Article 43). | An external certificate from an accredited body is possible, but accreditation of those bodies is voluntary. Requires a statement of applicability justifying each Annex A control. | No certificate, accreditation or conformity assessment program exists. Evidence is your own documentation mapped to the AI RMF subcategories. |
| Version status | Amended by Regulation (EU) 2026/1744. High-risk rules for Annex III systems now apply from 2 December 2027. The first harmonised standard, EN 18286:2026, was cited on 14 October 2026. | Edition 1 (18 December 2023). ISO lists no amendment or revision in progress as of October 2026. | AI RMF 1.0 (January 2023) is being revised under the White House AI Action Plan. NIST has not published a revised version as of 17 October 2026. |
| Cost signals supplied | Fine caps under Article 99: EUR 35 million or 7% of worldwide turnover for prohibited practices, EUR 15 million or 3% for most operator duties. The impact assessment estimated compliance at about two thirds of that maximum, EUR 6,000 to 7,000 per high-risk system by 2025, or roughly 4 to 5% of development cost. | ISO lists the standard at CHF 225 and ISO/IEC 42006:2025 at CHF 159. Certification body audit fees are not supplied, so request a written quote from each body. | No fee is attached to the framework. Costs come from staff time, tooling and any external advisory or assessment work you choose. |
| When this matters most | Matters most when you place AI systems on the EU market, deploy in the EU, or supply models or outputs used there. Confirm your role and risk tier with counsel. | Matters most when enterprise buyers or tenders ask for a certifiable AI management system or when you already run ISO/IEC 27001. | Matters most when you build or buy AI in the US with no EU exposure and need a shared risk vocabulary for boards, customers and internal audit. |
What the EU AI Act makes binding and when it applies
The EU AI Act is the only one of the three frameworks in this comparison with legal force. It is Regulation (EU) 2024/1689, in force since 1 August 2024, and it was amended on 27 July 2026 by Regulation (EU) 2026/1744, the Digital Omnibus on AI. The Commission sorts AI systems into four risk levels: unacceptable risk, where nine prohibited practices now apply, high risk, transparency risk, and minimal or no risk, which the Act does not regulate. Your first task is to classify each product against those levels and the Annex III and Annex I lists, because the obligations attach to the classification, not to the technology.
Article 2 reaches beyond EU companies. It covers providers placing AI systems or general-purpose AI models on the EU market wherever they are established, deployers in the EU, and non-EU providers and deployers whose AI output is used in the EU. As amended in 2026, the high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, replacing the earlier dates of 2 August 2026 and 2 August 2027. Confirm the current consolidated text on EUR-Lex before you set a roadmap, since the dates have already moved once.
Fines under Article 99 are the higher of a fixed amount or a share of worldwide annual turnover: EUR 35 million or 7% for prohibited practices, EUR 15 million or 3% for most operator obligations, and EUR 7.5 million or 1% for misleading information given to authorities. Most Annex III high-risk systems use internal-control conformity assessment under Annex VI, so the provider's own documented process carries most of the evidence burden, while notified bodies are involved for some biometric systems and Annex I products. The first harmonised standard, EN 18286:2026 on quality management, was cited in the Official Journal on 14 October 2026. Ask counsel whether your quality management system should be built against it, and note that ISO/IEC 42001 does not match that system.
Where ISO/IEC 42001 and NIST AI RMF overlap
ISO/IEC 42001 and the NIST AI RMF both ask an organization to set governance, assess impact and manage AI risk across the life cycle, but they express that work differently. The cards below cover where the two line up, where they diverge, and which overlap claims are supported by official sources and which are not.
Governance and policy foundations
ISO/IEC 42001 places policies related to AI in Annex A control area A.2, with internal organization in A.3 and resources in A.4. NIST places the same ground under the Govern function, which NIST describes as cross-cutting. Both expect leadership to set accountability and policy before technical work starts. Check whether your policy set covers the roles and resources each framework names, so one document can serve both.
Impact assessment and risk mapping
Annex A control area A.5 in ISO/IEC 42001 covers AI impact assessment, and ISO/IEC 42005:2025 gives further guidance on running those assessments. NIST's Map function asks teams to establish context and identify risks before measuring them. A single assessment record can often answer both. Confirm that your template captures affected people, intended use and misuse scenarios, since those fields serve both frameworks.
Life cycle, data and use controls
Annex A areas A.6 (life cycle, nine controls), A.7 (data, five controls) and A.9 (use, three controls) describe how AI systems are built, fed and operated. NIST's Measure and Manage functions cover testing, monitoring and response to risks found during those stages. The overlap is practical: evidence from model testing and data reviews can feed both the statement of applicability and NIST's measurement records.
Third parties and interested parties
ISO/IEC 42001 covers information for interested parties in A.8 and third parties and customers in A.10. NIST's Manage function addresses how risks are treated and communicated, and its trustworthiness characteristics include accountable and transparent. If you buy or resell models, vendor obligations and customer-facing disclosures belong in the same register, so confirm who owns each record before audit or customer review.
Shared management system structure
ISO/IEC 42001 uses the harmonized structure shared by ISO management system standards, with requirements in clauses 4 to 10, which makes it compatible with standards such as ISO/IEC 27001. That structure lets an organization that already runs an ISMS add AI-specific clauses without rebuilding its management review, internal audit or corrective action process. NIST's framework is not a management system standard, so it does not share this structure. Confirm which clauses your existing system already covers.
Risk management references ISO/IEC 23894 and 42005
ISO/IEC 23894:2023 gives guidance on AI risk management, and ISO/IEC 42005:2025 covers AI system impact assessment, published 28 May 2025. Both sit in the same JTC 1/SC 42 family as ISO/IEC 42001 and can supply method detail behind the Map and Measure work. Neither is a certification scheme. Confirm with your certification body which of these references it expects to see as evidence before you rely on them in an audit.
Who assesses each framework and what they produce
This table shows who checks each AI governance framework, what that check produces and what is still open to confirm. Read the proof column first: the EU AI Act is enforced by authorities, ISO/IEC 42001 can end in an accredited certificate, and NIST AI RMF produces no certificate at all.
| Framework | Who assesses it | What it produces |
|---|---|---|
| EU AI Act (Regulation (EU) 2024/1689) | National market surveillance authorities enforce the Act for AI systems, and the Commission's AI Office enforces general-purpose AI model rules and certain AI systems it is exclusively competent for. Most Annex III high-risk systems use provider internal-control conformity assessment. | Legal obligations and regulator supervision, not a certificate. Notified bodies are involved for some biometric systems and Annex I products, so confirm which path applies to your system. |
| EU AI Act: conformity route for high-risk systems | Providers run internal control for most Annex III systems. Notified bodies assess some biometric systems and Annex I product systems. Confirm your route against the Act's conformity assessment articles. | A conformity assessment outcome that supports the EU declaration and market access, with market surveillance authorities able to examine it later. The harmonised quality management standard EN 18286:2026 was cited in the Official Journal on 14 October 2026. |
| ISO/IEC 42001 (AI management system) | Accredited certification bodies audit against the standard, operating to ISO/IEC 17021-1 plus the AI-specific requirements in ISO/IEC 42006:2025. Accreditation of those bodies is voluntary. | An accredited third-party certificate for your AI management system, not a legal determination of compliance with the EU AI Act. Confirm with each body its accreditation scope, audit cycle and surveillance schedule. |
| ISO/IEC 42001: accreditation coverage | Accreditation bodies under the Global ACI arrangement endorse sub-scopes, and ISO/IEC 42001 is not yet listed as an endorsed sub-scope in Global ACI-FMRA-001 version 3.3 (August 2026). | Certificates from bodies accredited by Global ACI members may not carry the same mutual recognition as ISO/IEC 27001. Ask each certification body which accreditation body covers its AI scope. |
| NIST AI RMF 1.0 | No assessor. NIST does not validate or endorse any organization's use of the framework and runs no certification, accreditation or conformity assessment program. | Internal documentation you choose to produce against the Govern, Map, Measure and Manage functions. Any claim of AI RMF certification is not a NIST outcome, so ask vendors for the evidence behind such a claim. |
| Legal force | Binding for EU market participants in scope (AI Act), voluntary for ISO/IEC 42001 and NIST AI RMF unless a contract or regulator requires them. | Binding obligations carry maximum fines under Article 99. ISO/IEC 42001 and NIST AI RMF carry none directly, but customers may write them into contracts. |
| Review and revision cycle | The AI Act has applied in stages, with high-risk rules now from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems under the 2026 amendment. | ISO lists no revision under way for ISO/IEC 42001:2023. NIST says AI RMF 1.0 is being revised and has not published a revised version as of 17 October 2026. |
Which combination fits EU high-risk providers, enterprise vendors and US-only builders
If your AI system is high risk under the EU AI Act, the Act is the binding obligation and the rest of the stack supports it. The Act's high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, following the 2026 amendment. Most Annex III systems use internal-control conformity assessment under Annex VI, so the quality management system is your main deliverable rather than a certificate from a third party.
- Legal obligations: The Act sets the duties for providers, including risk management, data governance, technical documentation and post-market monitoring. Confirm each duty against the consolidated text, not a summary.
- Quality management route: The first harmonised standard, EN 18286:2026 on quality management, was cited in the Official Journal on 14 October 2026. Check whether your system's conformity route depends on it.
- Supporting management structure: ISO/IEC 42001 helps you set up an AI management system, but the European Commission says it does not match the Act's quality management system. Treat it as scaffolding, not as the compliance proof.
- Penalty exposure: Maximum fines reach EUR 15 million or 3% of worldwide annual turnover for most operator obligations, whichever is higher.
- Dates: Plan around 2 December 2027 and 2 August 2028 as the amended application dates, and confirm whether your system falls under Annex III or Annex I.
Ask counsel and your notified body or conformity assessment advisor to confirm which route applies to your product and which harmonised standards you will cite.
Enterprise buyers rarely wait for a regulator to ask about AI governance. Procurement and security reviews increasingly request evidence that you run a documented AI management system, and ISO/IEC 42001 is the standard buyers name most often. Your job is to show a coherent system, not to claim a certificate that does not exist for your scope yet.
- Customer evidence requests: Expect questionnaires that ask whether you hold ISO/IEC 42001, which controls you adopt and how you handle AI risk in your products.
- Statement of applicability: Clause 6.1.3 requires a statement of applicability that lists the necessary Annex A controls and justifies including or excluding each one. This document is often the first thing a buyer reads.
- Annex A scope: Annex A has 38 controls across nine objective areas. You do not have to implement every control, but you must justify each exclusion.
- Certification status: ISO does not certify organizations; accredited certification bodies do. Confirm whether your certification body has accredited scope for ISO/IEC 42006:2025, and note that ISO/IEC 42001 is not yet listed as an endorsed sub-scope of the Global ACI recognition arrangement.
- Overlap: If you already hold ISO/IEC 27001, the harmonized structure makes the two management systems easier to run together.
Ask the certification body to confirm its accreditation scope for AI management systems before you promise a certificate date to a customer.
If you build AI products only for US customers and no EU law reaches you, no statute currently requires NIST AI RMF adoption. The framework is voluntary by design, and NIST says neither private nor public sector organizations are required to use it. Its value is as a structured vocabulary for risk, not as a route to proof.
- Voluntary structure: The AI RMF Core has 4 functions, 19 categories and 72 subcategories. Govern is cross-cutting, and most teams start with Map after Govern outcomes are in place. You may choose which categories to use.
- Generative AI profile: NIST AI 600-1, published July 26, 2024, defines 12 generative AI risks and ties suggested actions to AI RMF subcategories. It is useful if you build on generative models.
- Pending revision: As of 17 October 2026, NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan and has not published a revised version. Build your documentation so it can be re-mapped when the revision lands.
- Playbook currency: The Playbook's audit log shows its last content update in August 2023, and AIRC says it will be updated after the framework is revised. Do not treat its suggested actions as current guidance without checking.
- No certification: NIST does not validate or endorse any organization's use of the framework, so describe your alignment in your own words.
Check whether any customer contract or sector regulator you serve asks for a named standard before you choose a stopping point.
In what order to adopt the three frameworks
The sequence confirms which obligations apply, builds one governance baseline, and produces an AI system inventory and a documented statement of applicability that the EU AI Act, ISO/IEC 42001 and the NIST AI RMF can all draw on.
Confirm EU AI Act reach and risk classification
Legal counsel and the product owner decide first whether the Act applies at all. Article 2 covers providers placing AI systems or general-purpose AI models on the EU market, deployers in the EU, and non-EU providers or deployers whose output is used in the EU. For each system in reach, classify it as prohibited, high risk, transparency risk or minimal risk, checking the Annex III and Annex I categories. Output: a signed classification memo per system, with the date of the rules that apply to it, confirmed against the consolidated text as amended in 2026.
Set governance outcomes and AI policies
Risk leadership sets the governance baseline before any system is mapped. Under the NIST AI RMF, this is the Govern function, which NIST describes as cross-cutting. Under ISO/IEC 42001, the equivalent work sits in the policy objectives in Annex A.2 and the internal roles in A.3. Assign accountable owners, define risk tolerance and approval paths, and state which trustworthiness characteristics matter for your products. Output: an approved AI policy and a named owner for each governance decision, which later steps reference.
Build the AI system inventory
Engineering and product teams list every AI system, model integration and third-party AI service in use or in development, including who builds, deploys and uses each one. Record the purpose, the affected people, the data sources and the vendor contracts. This inventory is the input to the classification in step one and to the Map function of the NIST AI RMF. Output: a register that a reviewer can check against production systems, with each entry linked to its risk classification and an accountable owner.
Run impact assessments and risk mapping
For each in-scope system, the team maps context, intended use, misuse, affected groups and risk sources, then records the results. The NIST AI RMF Map and Measure functions cover this work, and ISO/IEC 42005:2025 gives guidance on AI system impact assessment. Use the same assessment for EU AI Act duties where they apply. Output: one impact assessment per system, reviewed by the owner of the risk decision and stored with the data records that support it.
Implement controls and write the statement of applicability
Teams implement the controls required by the EU AI Act for each high-risk system, and the Manage actions chosen from the NIST AI RMF. If the organization builds an ISO/IEC 42001 management system, it selects Annex A controls and records a statement of applicability under clause 6.1.3, which lists each necessary control and justifies including or excluding it. Output: a dated statement of applicability and a control evidence index that map each control to the artifacts that prove it, including the impact assessments from the previous step.
Monitor, review and reuse shared evidence
Operations teams monitor system behavior, log incidents and review the risk decisions on a schedule the organization sets. Each framework uses overlapping evidence, so the same impact assessments, data records, test results and change logs can answer EU AI Act documentation, ISO/IEC 42001 audit requests and NIST AI RMF reporting. Keep one evidence repository with cross-references instead of three parallel sets. Output: a review log showing the date, the reviewer and any changed classification.
Decide on certification only when required
Certification is a separate decision. ISO does not certify organizations; accredited certification bodies do, and accreditation of those bodies is voluntary. ISO/IEC 42006:2025 sets requirements for bodies that certify AI management systems. NIST offers no AI RMF certification, and the EU AI Act does not provide a certificate for compliance. Pursue certification only if a customer contract or a regulator requires it, and ask the certification body whether it holds accreditation for ISO/IEC 42001. Output: a written decision record naming the requirement that justifies the spend, or a note that no certificate is needed.
What drives the cost of AI governance work
The cost of AI governance work comes from four places: the paid standards, your own staff time, outside help, and remediation of the systems themselves. The standards cost least. ISO lists ISO/IEC 42001:2023 at CHF 225 and ISO/IEC 42006:2025, which governs bodies that certify AI management systems, at CHF 159. Those are one-time purchases of the text, but they are not the expensive part. Internal time is. Someone must build the AI inventory, write the policies behind Annex A controls A.2 and A.3, and maintain the statement of applicability required by clause 6.1.3. That work recurs every time a model, vendor or use case changes.
The largest recurring items are usually people and reviews. Legal review of the AI Act risk classification, deployer and provider duties, and the Article 99 exposure (up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices) is a judgment call that counsel should own. Certification body fees for ISO/IEC 42001 are not supplied in our research, so ask each accredited body for a written fee schedule covering the initial audit, surveillance audits and recertification. Ask whether the quote includes travel, the scope of sampled AI systems and the number of audit days. Note that the ISO/IEC 42006:2025 requirements apply to those bodies, and the Global ACI recognition arrangement does not yet list ISO/IEC 42001 as an endorsed sub-scope, so confirm the accreditation status of any body you shortlist.
Treat the Commission's impact assessment figure with care. The impact assessment for the AI Act proposal (SWD(2021) 84 final) estimated, allowing for work companies would do anyway, compliance costs of EUR 6,000 to 7,000 per high-risk AI system by 2025, or roughly 4 to 5% of development cost. That is a pre-adoption estimate for a different legal text, and it predates the 2026 amendment that moved the high-risk dates to 2 December 2027 and 2 August 2028. Use it only as an old order-of-magnitude check. For a current budget, build the estimate from your own system count, your own staff rates and written vendor and advisor quotes. In every quote, ask which items are one-time (gap assessment, first audit, initial documentation, remediation) and which recur (surveillance audits, monitoring, model re-assessment, policy upkeep, retainer support).
Questions buyers ask about AI governance frameworks
Does NIST AI RMF certification exist?
No. The NIST AI RMF has no certification, accreditation or conformity assessment program. NIST states that it does not validate or endorse any individual organization or its approach to using the AI RMF, and the framework is intended for voluntary use. Any firm offering an AI RMF certificate is selling a private assessment, so ask what the document proves, who signed it and whether a customer or regulator will accept it. For proof you can show a third party, pair the AI RMF with an ISO/IEC 42001 certification audit or with your own documented evidence, and ask for the assessment scope in writing before you pay for anything.
Can ISO 42001 satisfy the EU AI Act?
Not by itself. The European Commission says ISO/IEC 42001 helps you set up an AI management system but does not match the EU AI Act's quality management system. The Commission cited the first harmonised standard, EN 18286:2026 on quality management, in the Official Journal on 14 October 2026. ISO/IEC 42001 is useful groundwork for risk management, documentation and governance, and its clause structure is compatible with ISO/IEC 27001. Still, you must map each AI Act obligation that applies to your systems, confirm with your counsel which conformity route applies to your Annex III or Annex I systems, and treat any certificate as one input rather than a legal finding.
What are the EU AI Act fines?
Article 99 sets three maximum tiers, and the higher of the fixed amount or the percentage of worldwide annual turnover applies. Prohibited practices carry up to EUR 35 million or 7% of worldwide annual turnover. Most operator obligations carry up to EUR 15 million or 3%. Misleading information supplied to authorities carries up to EUR 7.5 million or 1%. These are maximums, not expected penalties. Enforcement depends on the authority, the facts and your cooperation, so the exposure you should model is the turnover-based ceiling for the tier that matches your conduct, reviewed with counsel.
How long does AI governance work take and what staff does it need?
Duration depends on how many AI systems you run, which of them are high risk, how much documentation already exists and how many teams must sign off. The effective dates set the outer deadline: under the 2026 amendment, the high-risk rules for Annex III systems apply from 2 December 2027 and for Annex I product systems from 2 August 2028. Staffing usually spans product owners who describe the system, data owners, a risk lead who keeps the register, security and legal reviewers, and an engineering owner for technical documentation and logging. Ask any provider for a written plan that lists these roles and the hours each one contributes, rather than accepting a generic timeline.
Can our team implement AI governance alone?
Often yes for a small set of low-risk systems, if someone owns the register, the policies and the evidence, and leadership accepts the decisions. It becomes harder when you have high-risk systems that need technical documentation, human oversight design, data governance and independent review, or when you plan to pursue ISO/IEC 42001 certification. The certification audit itself is performed by an external certification body, because ISO does not certify organizations. Check whether your team has the time for an internal audit cycle, the authority to change engineering practice and the experience to write a statement of applicability with justified exclusions.
What does DeployOpen issue, and what does it not issue?
DeployOpen does not issue certifications, audit reports, attestations or conformity assessments. Independent auditors and certification bodies perform those. DeployOpen can plan and implement the controls, documentation, evidence and governance processes an assessment will examine, and it can run security testing of AI applications and agents and prepare systems for compliance assessments. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work begins, and ongoing support is available as a retainer. Ask for the written scope and the list of deliverables before you compare quotes, because DeployOpen does not publish a price list.
Which framework should we pick first?
Start with the framework that answers a binding obligation or a contract you already have. If you place high-risk AI systems on the EU market, the EU AI Act sets the obligations, so build the AI system inventory and risk classification first. If customers ask for a certifiable management system, ISO/IEC 42001 gives you an auditable structure, and its Annex A controls can be scoped through a statement of applicability. If you operate only in the US with no contractual demand, the NIST AI RMF gives a voluntary vocabulary for risk, and its Govern function is a sensible first step because most users start with Map after Govern outcomes are in place. Confirm which obligations apply to your systems with counsel before you commit budget.
How DeployOpen prepares AI governance evidence
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and prepares the systems, controls and evidence that AI governance work depends on. We do not issue audit reports, attestations or certifications; independent auditors and certification bodies do.
How we scope
- Written scope names which frameworks apply, such as the EU AI Act, ISO/IEC 42001 or the NIST AI RMF, before work starts.
- Scope lists the AI systems, their owners, deployment locations and the teams that hold governance decisions.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing; a quote follows from that scope.
How we build
- We set up the AI inventory, risk register and documented governance roles inside your own environment.
- We draft a statement of applicability for ISO/IEC 42001 Annex A controls, with justification for each inclusion or exclusion.
- We map AI RMF subcategories to your existing controls and test the evidence those controls produce.
How we hand over
- Handover includes governance documentation, control evidence and a mapping showing which requirement each artifact supports.
- We document residual gaps and the decisions still owned by your legal, risk and compliance teams.
- We confirm with your auditor or certification body which evidence format and sampling they expect before final delivery.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement.
- Retainers can cover periodic review of AI system changes, impact assessments and updated evidence packs.
- We track standard and regulatory updates that affect your scope, such as amendments to the EU AI Act, and report what changes.
Sources and further reading
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex ↗
- Regulation (EU) 2024/1689, consolidated text as amended by Regulation (EU) 2026/1744 (27 July 2026), EUR-Lex ↗
- ISO/IEC 42001:2023 (ISO committee page, with FAQ) ↗
- ISO: Certification ↗
- NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) ↗
- NIST: AI Risk Management Framework FAQs ↗
