AI governance: NIST AI RMF, ISO 42001, EU AI Act
The three names that dominate AI governance questions are different kinds of thing. The NIST AI Risk Management Framework is a voluntary framework that tells an organisation how to think about AI risk. ISO/IEC 42001 is a management system standard that an auditor can certify. The EU AI Act is binding law that sorts AI systems into risk tiers and attaches legal duties to each tier. The decision rule: if a question asks for a way to structure risk work, think NIST; for something to be audited and certified, think ISO 42001; for something that is mandatory and depends on how risky the use case is, think the EU AI Act.
Three instruments, three jobs
| NIST AI RMF 1.0 | ISO/IEC 42001:2023 | EU AI Act (Regulation 2024/1689) | |
|---|---|---|---|
| Nature | Voluntary framework | International management system standard | Regulation with legal force in the EU |
| Question it answers | How do we identify and manage AI risk? | Do we run AI governance as a managed, auditable system? | Is this system allowed, and what must we do for it? |
| Output | A way of working, no certificate | A certificate from an accredited third-party audit | Compliance obligations, enforcement and penalties |
| Organised around | Four functions | Management system clauses plus controls | Risk tiers, plus rules for general-purpose models |
These do not compete. A company can use the NIST framework to run its risk assessments, build an ISO 42001 management system around them, and use the EU AI Act to decide which systems need the heaviest controls.
What each one contains
NIST AI RMF. NIST published AI RMF 1.0 on 26 January 2023 and states that it is intended for voluntary use (NIST). Its core has four functions: Govern, Map, Measure and Manage. Govern is the cross-cutting one: culture, policy, accountability and oversight that apply to the other three. Map establishes context and identifies the risks of a specific use. Measure analyses and tracks those risks with tests and metrics. Manage prioritises and acts on them. The framework also lists characteristics of trustworthy AI, such as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. NIST later released a Generative AI Profile (NIST-AI-600-1, July 2024) that applies the framework to generative systems, and its page notes that AI RMF 1.0 is being revised as part of the White House AI Action Plan, so check the current version before relying on details.
ISO/IEC 42001. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, and it is certifiable. It follows the same harmonised structure as other ISO management standards such as ISO/IEC 27001, which is why organisations that already run an information security management system can extend it. The full text is sold by ISO, so this guide describes it from public summaries and does not quote its controls. For exams the useful point is the nature of the standard: it is about running governance as a continuous, documented management system, not about technical testing of one model.
EU AI Act. The Commission’s description of the Act (European Commission; legal text on EUR-Lex) uses four levels of risk. The Commission now calls the third level transparency risk; many study guides still use the older label limited risk:
| Tier | Meaning | Examples |
|---|---|---|
| Unacceptable risk | Prohibited | Social scoring, untargeted scraping of faces to build recognition databases |
| High risk | Allowed with strict obligations | AI in employment, education, credit scoring, critical infrastructure |
| Transparency risk (limited risk) | Disclosure duties | Telling people they are talking to a chatbot, making generated content identifiable, labelling deep fakes |
| Minimal risk | No specific rules | Spam filters, AI in video games |
High-risk systems need a risk management system, data quality controls, logging, documentation, human oversight and robustness. Dates matter and have moved: the Commission page lists eight prohibitions applying from February 2025 (a ninth, on AI that generates non-consensual intimate content, added by the AI Omnibus, applies from December 2026), general-purpose model obligations from August 2025, transparency rules from August 2026, and, after the AI Omnibus amendment that entered into force on 27 July 2026, high-risk rules from 2 December 2027 for Annex III use cases and 2 August 2028 for AI embedded in regulated products. Certification bodies and exam writers update slowly, so treat dates as something to verify, not memorise.
A small worked example
A bank wants a model to rank loan applicants. The use is credit scoring, so under the EU AI Act it falls in the high-risk tier, which triggers documentation, human oversight and logging duties. To meet them, the bank maps the model’s purpose and affected groups, measures bias and accuracy, and manages findings with an owner and a review cycle, which is the NIST Map, Measure and Manage loop under a Govern function that assigns accountability. The bank then wraps this in an AI management system so that policy, inventory, impact assessment and monitoring are repeatable and auditable, and it may seek ISO 42001 certification to show it. Related ground is covered in responsible AI principles and risk management.
Which exams test this
| Exam | How the topic appears | Covered on this site |
|---|---|---|
| AAIA | Domain 1, AI Governance and Risk (33%): governance and programme management, AI risk management, and leading practices, ethics, regulations and standards, seen from the auditor’s side | Governance and risk |
| AAIR | Domain 1, AI Risk Governance and Framework Integration (37%): ownership and accountability, policies, regulatory compliance and legal considerations, and fitting AI risk into the enterprise risk framework | Governance and frameworks |
| AAISM | Domain 1, AI Governance and Program Management (31%): stakeholder needs, industry frameworks and regulatory requirements, and AI security policies | Governance and programme management |
| CY0-001 | Domain 4, AI Governance, Risk, and Compliance (19%): governance structures and roles, AI risks, and the effect of the EU AI Act, OECD standards, ISO AI standards and the NIST AI RMF on business use of AI | Governance, risk and compliance |
| AB-731 | Implementation and adoption strategy domain (20–25%): set governance principles for AI use and an AI council, aligned with Microsoft’s responsible AI policies; the external frameworks are not named | Implementation and adoption |
| AIF-C01 | Domain 5, Security, Compliance, and Governance (14%), task 5.2: governance and compliance for AI systems, such as policies, review cadence and the Generative AI Security Scoping Matrix; a minor topic, and building governance frameworks is out of scope | Security, compliance and governance |
CY0-001 is the only outline here that names the NIST AI RMF, ISO AI standards and the EU AI Act. The ISACA exams list regulations, standards and frameworks as subtopics and ask what they consistently require rather than clause numbers. AB-731 and AIF-C01 test governance as an organisational practice (principles, councils, policies, review processes), so do not expect questions on ISO clause content or EU AI Act tiers there.
How exam questions use the distinction
The trap is treating the three as interchangeable. Watch for these constraint words:
- “Voluntary”, “guidance”, “no certification”: NIST AI RMF.
- “Certified”, “audited by a third party”, “management system”: ISO/IEC 42001.
- “Mandatory”, “prohibited”, “penalties”, “high-risk system”, “provider of AI in the EU”: EU AI Act.
- “FIRST” in a governance scenario: usually an inventory of AI systems or an accountable owner, before choosing a framework.
- A framework or certificate is never described as proof of legal compliance on its own.
Practice questions
Question 1. A multinational wants an independent third party to attest that it runs a documented, continually improved system for governing its AI. Which instrument fits?
- A. The NIST AI Risk Management Framework
- B. The EU AI Act
- C. ISO/IEC 42001
- D. A model card for each system
Show answer
Answer: C
ISO/IEC 42001 is a certifiable management system standard, so an accredited auditor can attest to it. The NIST AI RMF is voluntary guidance with no certificate. The EU AI Act is law, not a certification scheme. A model card documents one model and does not attest to an organisation’s governance system.
Question 2. A company in the EU deploys an AI system that screens job applicants. Under the EU AI Act risk-tier approach, how is it classified and what follows?
- A. Unacceptable risk, so it must be banned outright
- B. High risk, so strict obligations apply
- C. Transparency (limited) risk, so only a chatbot disclosure is needed
- D. Minimal risk, so no rules apply
Show answer
Answer: B
AI used in employment is a listed high-risk use, which brings obligations such as risk management, documentation, logging and human oversight. It is not prohibited, because only practices like social scoring are banned. The transparency and minimal risk levels do not cover systems that decide access to work.