# AI governance framework: NIST AI RMF, ISO 42001 and EU AI Act compared

Source: https://airedteamingservices.com/guides/ai-governance-framework/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

Pick an AI governance framework by trigger: NIST AI RMF, ISO/IEC 42001, the EU AI Act and security references, with 2026 EU dates and where test evidence fits.

> **Short answer:** Use the frameworks together. NIST AI RMF 1.0 is voluntary risk practice, ISO/IEC 42001 is an auditable management system, and the EU AI Act is law with Annex III high-risk duties from 2 December 2027. OWASP, MITRE ATLAS, ETSI and CSA AICM add security detail. Choose by what triggers the work: a buyer form, EU sales or a certificate request.

An AI governance framework is a written set of roles, risk steps and records for how an organization builds and uses AI. No single document covers everything. In 2026 most teams pick from NIST AI RMF, ISO/IEC 42001 and the EU AI Act, then add security references for the technical detail. This page compares them, gives a decision table by trigger and shows where test evidence plugs in. It is not legal advice.

## Which AI governance frameworks exist in 2026?

The main documents split into three groups: risk practice, auditable standards and law, plus a set of security references. They answer different questions, so the choice is rarely either/or.

| Document | Type | Certifiable | Use it for |
|---|---|---|---|
| NIST AI RMF 1.0 (AI 100-1) and AI 600-1 | Voluntary framework and profile | No | Organizing AI risk work |
| ISO/IEC 42001:2023 | Management-system standard | Yes, for an organization | An audited AI management system |
| EU AI Act, Regulation (EU) 2024/1689 | Law | Not applicable | Legal duties for EU-market AI |
| OWASP LLM Top 10 2026, MITRE ATLAS | Security reference lists | No | Naming and testing technical risks |
| CSA AI Controls Matrix v1.1 | Control catalog | Not stated on the page we read | Control objectives for AI |
| ETSI EN 304 223 V2.1.1 | European standard | Not stated | Baseline security requirements |

Our [frameworks page](/frameworks/) maps findings to the security references. The [AI governance page](/guides/ai-governance/) covers the program side.

## NIST AI RMF and AI 600-1: voluntary risk practice

NIST AI RMF 1.0 (NIST AI 100-1) was published January 26, 2023. NIST describes it as "voluntary, rights-preserving, non-sector specific, and use-case agnostic" ([NIST](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10)). NIST also says on its AI RMF page that the AI RMF 1.0 is being revised as part of the White House AI Action Plan, so check for the current text.

The Generative AI Profile, NIST AI 600-1 (July 2024), is a companion resource. Suggested action MS-2.7-007 reads "Perform AI red-teaming to assess resilience against" several attack classes, including prompt injection ([NIST AI 600-1](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence)). A suggested action is guidance. Nobody certifies against it.

Use NIST when you want a shared vocabulary for risk and have no audit deadline. For detail see [NIST AI RMF and red teaming](/guides/nist-ai-rmf-and-red-teaming/).

## ISO/IEC 42001: certifiable management system

ISO/IEC 42001:2023 (edition 1.0, published 2023-12-18) specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organization ([IEC Webstore](https://webstore.iec.ch/en/publication/90574)). An auditor certifies the organization and its scope. A certificate does not cover one product.

Pick ISO 42001 when a customer asks for a certificate, or when you want an outside audit to force the records to exist. It costs time: policies, risk assessments, internal audits and management review. We explain the clauses and Annex A in the [ISO 42001 guide](/guides/iso-42001/).

## EU AI Act: law, with new dates

The EU AI Act is a regulation, so it binds regardless of your framework choice. Regulation (EU) 2026/1744, the Digital Omnibus on AI, dated 8 July 2026 and published 24 July 2026, changed the high-risk dates.

| Duty | Original date | Date now in Art. 113 |
|---|---|---|
| High-risk systems under Annex III (Art. 6(2)) | 2 August 2026 | 2 December 2027 |
| High-risk systems under Annex I (Art. 6(1)) | 2 August 2027 | 2 August 2028 |
| GPAI obligations (Chapter V) | 2 August 2025 | Unchanged |

Source: [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) and [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj). The Omnibus also sets 2 December 2026 for Art. 50(2) marking of generative systems placed on the market before 2 August 2026.

Art. 15(5) requires resilience against attempts to alter use, outputs or performance by exploiting vulnerabilities. Art. 15 does not use the words "red team" or "penetration test". See [EU AI Act red teaming](/guides/eu-ai-act-red-teaming/).

## Security references: OWASP, ATLAS, ISO/IEC 27090, ETSI, CSA AICM

Security references describe technical risk and controls. They fit inside any governance framework.

- OWASP Top 10 for LLM Applications 2026 (published August 4, 2026) and the OWASP Top 10 for Agentic Applications (December 9, 2025) list risks.
- MITRE ATLAS release v2026.10 lists 129 techniques and 77 case studies of attacks on AI systems.
- ISO/IEC 27090 is reported by heise online (2026-10-19) as a guide on security threats to AI systems: "There is no certification". We could not confirm the publication date on iso.org.
- ETSI EN 304 223 V2.1.1 is titled "Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems".
- CSA AI Controls Matrix v1.1 has "247 control objectives across 18 domains".
- NIST IR 8596, the Cyber AI Profile, is a draft (initial preliminary draft, December 16, 2025).

## Which one fits which trigger?

Choose by the event that started the work. The table gives a first move and a second move.

| Trigger | Start with | Then add | Test evidence to keep |
|---|---|---|---|
| Customer security questionnaire asks about AI | NIST AI RMF structure and OWASP list mapping | ISO 42001 if the buyer names it | Scoped test report, controls that held |
| Selling into the EU | EU AI Act risk classification (ask counsel) | Art. 15 resilience measures for high-risk systems | Report mapped to your resilience measures |
| Enterprise asks for a certificate | ISO/IEC 42001 | NIST AI 600-1 for generative AI detail | Test reports linked to the risk register |
| You ship agents with tools | OWASP Agentic Top 10 and ATLAS | CSA AICM control objectives | Tool-permission tests, approval tests |
| No trigger yet | NIST AI RMF | OWASP LLM Top 10 mapping | One baseline test of the main AI app |

## Where does testing evidence fit in each?

Testing evidence shows that a control works on a named system. Each framework has a place for it.

- NIST AI RMF: the Measure function, for example action MS-2.7-007 for red-teaming.
- ISO/IEC 42001: risk assessment, verification and validation, and monitoring in the management system.
- EU AI Act: Art. 15 resilience for high-risk systems. Art. 55(1)(a) adversarial testing applies to providers of general-purpose AI models with systemic risk.
- Security references: finding IDs. A finding labeled LLM01:2026 or AML.T0051.001 is easier to place in a buyer's form.

A test report does not make a system compliant with any of them. Pair it with the policies and records the framework asks for. To build the evidence, see [how to scope an AI red team](/guides/how-to-scope-an-ai-red-team/) and our [AI red teaming methodology](/methodology/).

## Questions

### Which AI governance framework should a startup use first?

Start with the document your next buyer names. If nobody names one, NIST AI RMF is free and voluntary, so it is a low-cost way to organize risk work. Add ISO/IEC 42001 only when a customer asks for a certificate or you want an audited system.

### Are NIST AI RMF and ISO 42001 competing?

No. NIST AI RMF is a voluntary framework for managing AI risk. ISO/IEC 42001 is a standard that an auditor can certify an organization against. Many teams use the NIST structure for risk work and keep the records in an ISO-style management system.

### Does the EU AI Act apply to a company outside the EU?

It can. We did not analyze the territorial rules here. Ask counsel whether your system is placed on the EU market or its output is used in the EU. This page is not legal advice.

### Where do penetration tests and red team reports fit?

They are evidence. They support risk assessment, verification and monitoring in each framework. None of the frameworks we read names a mandatory red team for ordinary AI applications. Art. 55 adversarial testing binds providers of general-purpose AI models with systemic risk.

## Sources

- [NIST AI RMF 1.0 publication page](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10)
- [NIST AI 600-1: Generative AI Profile](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence)
- [NIST AI Risk Management Framework page](https://www.nist.gov/itl/ai-risk-management-framework)
- [IEC Webstore: ISO/IEC 42001:2023](https://webstore.iec.ch/en/publication/90574)
- [Regulation (EU) 2024/1689 (EU AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj)
- [OWASP GenAI LLM Top 10 2026 README](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/README.md)
- [MITRE ATLAS data release v2026.10](https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.10)
- [CSA AI Controls Matrix v1.1](https://cloudsecurityalliance.org/blog/2026/07/14/ai-controls-matrix-v1-1-strengthening-the-foundation-for-trustworthy-ai)
- [ETSI EN 304 223 V2.1.1](https://www.etsi.org/deliver/etsi_en/304200_304299/304223/02.01.01_60/en_304223v020101p.pdf)
- [heise online: ISO/IEC 27090 aims to secure AI systems (2026-10-19)](https://www.heise.de/en/news/ISO-IEC-27090-aims-to-secure-AI-systems-11493284.html)
- [NIST CSRC IR 8596 initial preliminary draft](https://csrc.nist.gov/pubs/ir/8596/iprd)