AI Governance Framework: Components, Standards and How to Choose

What is an AI governance framework?

An AI governance model answers a plain question: who is allowed to do what with AI, under which rules, and how do we know the rules are followed? A good framework is not a document set on a shelf. It is a working system with named owners, a list of AI systems, a way of rating their risk, controls proportionate to that risk, and evidence that the controls run.

It also differs from a law or a standard. Laws such as the EU AI Act set binding obligations. Standards such as ISO/IEC 42001 describe a management system you can certify against. Voluntary frameworks such as the NIST AI RMF give structure without certification. Your own framework is the internal layer that makes any of these operable.

The seven components of a working framework

AI governance best practices converge on the same building blocks, whichever external reference you follow.

1. Inventory. A maintained list of every AI system and use case, including vendor features and unapproved tools, with owner, purpose, data and model involved. Nothing else works without it.
2. Risk classification. A consistent method to place each system into a tier, based on impact on people, sensitivity of data, autonomy and regulatory category.
3. Ownership. A named accountable person per system, a cross-functional oversight group, and clear escalation to senior management or the board.
4. Policies. A short set of rules covering acceptable use, data handling, procurement, human oversight and incident response.
5. Controls. Technical and procedural measures matched to the risk tier, such as access control, input and output filtering, testing, approval gates and monitoring.
6. Evidence. Records that show the controls operated: logs, approvals, test results, training records and review minutes.
7. Review. A recurring cycle to reassess risk, retire systems, learn from incidents and update policy as rules and models change.

The EU AI Act in a framework context

Regulation (EU) 2024/1689 is a binding, risk based law (EUR-Lex). It entered into force on 1 August 2024 and applies in stages, with prohibitions from 2 February 2025, general-purpose AI obligations from 2 August 2025 and most remaining obligations from 2 August 2026. Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the high-risk requirements to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products, so check the current consolidated text for the applicable dates. EU institutions have discussed adjusting parts of the timeline, so verify dates against the current official text and the European Commission overview.

Its reach is wide. Under Article 2 it covers providers placing AI systems on the EU market whatever their location, and providers and deployers outside the EU where the output is used in the EU. Penalties reach up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other obligations. The Act tells you what you must do for regulated systems. It does not give you a full management system, which is where standards help.

ISO/IEC 42001 and the NIST AI RMF

ISO/IEC 42001:2023 is an AI management system standard, published in December 2023 and certifiable by an accredited body (ISO). It uses the harmonised structure shared with ISO/IEC 27001:2022, so organisations with an existing information security management system can extend it rather than start over. It asks for scope, leadership commitment, risk assessment, controls, internal audit and continual improvement.

NIST AI RMF 1.0, released in January 2023, is voluntary and organised into four functions: GOVERN, MAP, MEASURE and MANAGE (NIST). A Generative AI Profile, NIST AI 600-1, followed in July 2024. It is strong on practical risk thinking and vocabulary, and it does not lead to a certificate.

How do the three compare and combine?

They answer different questions, which is why they combine well.

• EU AI Act: what the law requires of specific systems and roles. Binding, with penalties.
• ISO/IEC 42001: how to run a repeatable management system. Certifiable, so it gives external assurance.
• NIST AI RMF: how to think about and measure AI risk. Voluntary and flexible.

A practical combination is to use ISO/IEC 42001 as the skeleton, NIST AI RMF as the risk method inside it, and the EU AI Act as the legal requirements checklist applied to the systems it covers. One inventory and one risk register can then serve all three, with controls mapped once and evidenced once.

Which framework fits which organisation in AI governance?

The right starting point depends on your role and market, not on which framework is most fashionable.

Provider selling into the EU market

Start from the EU AI Act, because obligations attach directly to you, including for high-risk systems and general-purpose models. Add ISO/IEC 42001 to build the quality and risk management system that the Act's requirements assume, and use NIST AI RMF for technical risk measurement.

UAE regulated enterprise

Begin with ISO/IEC 42001 and your sector regulator's requirements, then add the UAE data protection rules and any contractual duties. If you serve EU customers or your AI output is used in the EU, map the EU AI Act as well. The NIST AI RMF supplies a common language for boards and regulators, and a management system standard fits the assurance expectations of regulated sectors well.

Deployer only

If you buy and use AI rather than build it, you still carry duties for how it is used, overseen and monitored. Focus on inventory, vendor due diligence, acceptable use, human oversight, data controls and logging. The NIST AI RMF is a light way to begin, with ISO/IEC 42001 as a later step if customers or regulators ask for certification.

Common mistakes to avoid

Teams most often stumble in four ways. They write policy before building an inventory, so rules miss the systems that matter. They treat a standard as a project that ends at certification rather than a cycle that continues. They rely on policy alone with no technical enforcement, so staff keep using unapproved tools, a pattern explained in our guide to shadow AI. And they gather evidence only when an audit is announced, instead of producing it as a by-product of normal operation.

How Krasper helps

Our AI governance consulting helps you choose and combine the right references, build the inventory and risk classification, and write policies your teams can follow.

Krasper Raigate is a self-hosted AI governance firewall that enforces policy on AI traffic, redacts PII and keeps audit logs of governed requests, giving you operational evidence for the controls and evidence components above. Raigate supports your evidence; it does not certify compliance or make an organisation compliant.