Governome

AI Governance Frameworks & Standards

Voluntary and certifiable structures for managing AI risk — what regulators point to when they're asking whether your risk management was actually reasonable.

Frameworks and standards don't carry the force of law on their own, but they matter for a very practical reason: when a regulator, a plaintiff's attorney, or an enterprise customer's security team asks how you manage AI risk, "we follow the NIST AI RMF" or "we're certified to ISO/IEC 42001" is a concrete, checkable answer in a way that "we're careful" is not.

We use "framework" for voluntary guidance without a formal certification path (NIST AI RMF, the OECD AI Principles) and "standard" for the certifiable, auditable specifications (ISO/IEC 42001, ISO/IEC 23894) — different governance instruments, same underlying job: giving you a structure to point to when someone asks how AI risk gets managed here.

Recently updated

Government policy officials discussing international AI principles
Photo: Zoshua Colah via Unsplash

frameworks

OECD AI Principles

The OECD AI Principles are the highest-level, most widely adopted AI governance principles internationally — the shared foundation most national AI policies, including the EU AI Act, build on.
Governome Editorial Team · 1 min read
Risk analysts mapping AI risk factors on a whiteboard during a working session
Photo: Walls.io via Unsplash

frameworks

ISO/IEC 23894

ISO/IEC 23894 adapts ISO 31000 risk management principles specifically for AI systems. It's guidance, not a certifiable standard — but it's the practical reference for the risk-assessment work ISO 42001 requires.
Governome Editorial Team · 2 min read
Auditor reviewing AI management system documentation for certification
Photo: Zulfugar Karimov via Unsplash

frameworks

ISO/IEC 42001

ISO/IEC 42001 is a certifiable AI management system standard. Unlike the NIST AI RMF, an accredited body can actually audit you against it and issue a certificate.
Governome Editorial Team · 2 min read
Risk management team analyzing AI system risk factors in a meeting
Photo: Christina @ wocintechchat.com M via Unsplash

frameworks

NIST AI Risk Management Framework (AI RMF)

The NIST AI RMF is a voluntary, four-function framework for managing AI risk. It carries real legal weight in the US — Colorado's AI Act ties an affirmative defense directly to it.
Governome Editorial Team · 2 min read

Frequently asked questions

Are AI frameworks legally required?
No — frameworks and standards are voluntary. But several regulations reference them as evidence of reasonable practice (Colorado's AI Act explicitly creates an affirmative defense tied to NIST AI RMF compliance, for instance), so "voluntary" doesn't mean "irrelevant to your legal exposure."
What's the practical difference between a framework and a standard?
A framework like the NIST AI RMF gives you a structure and vocabulary for managing risk, but there's no third party auditing you against it. A standard like ISO/IEC 42001 is certifiable — an accredited body can audit your AI management system against the standard's specific requirements and issue a certificate, similar to how ISO 27001 works for information security.
Which framework should a company adopt first?
For most US-based organizations, the NIST AI RMF is the natural starting point — it's the framework US regulators and courts most commonly reference, it's free, and it maps cleanly onto existing risk management vocabulary. Organizations with EU exposure or enterprise customers demanding third-party certification often move toward ISO/IEC 42001 as a second step.

Related topics