AI governance frameworks compared

Multiple governance frameworks now apply to AI systems. If you are deploying AI agents, you need to understand which frameworks are relevant and how they overlap. This guide compares the major frameworks.

The frameworks

EU AI Act

• Type: Regulation (legally binding)
• Scope: AI systems placed on the EU market
• Approach: Risk-based classification with mandatory requirements for high-risk systems
• Enforcement: Fines up to 35 million euros or 7% of global turnover

NIST AI Risk Management Framework (AI RMF)

• Type: Voluntary framework
• Scope: All AI systems (US-focused but globally applicable)
• Approach: Four functions: Govern, Map, Measure, Manage
• Enforcement: None (voluntary)

ISO 42001

• Type: International standard (certifiable)
• Scope: AI management systems
• Approach: Management system requirements for organizations that develop or use AI
• Enforcement: Certification audits

OWASP Agentic Top 10

• Type: Industry guidance
• Scope: AI agent applications
• Approach: Top 10 security risks with mitigations
• Enforcement: None (reference material)

Comparison table

| Requirement Area | EU AI Act | NIST AI RMF | ISO 42001 | |-----------------|-----------|-------------|-----------| | Risk assessment | Required (Art. 9) | Map function | Clause 6.1 | | Access controls | Implied (Art. 15) | Manage function | Annex A controls | | Audit logging | Required (Art. 12) | Measure function | Clause 9.1 | | Human oversight | Required (Art. 14) | Govern function | Annex A controls | | Incident response | Required (Art. 72) | Manage function | Clause 10.2 | | Documentation | Required (Art. 11) | All functions | Clause 7.5 |

How they overlap

All four frameworks agree on the fundamentals:

1. Know what risks your AI system poses
2. Implement controls to mitigate those risks
3. Monitor the system in operation
4. Log what the system does
5. Keep humans in the loop for high-stakes decisions
6. Respond to incidents

The differences are in specificity and enforceability. The EU AI Act has specific, mandatory requirements. NIST provides a flexible framework. ISO 42001 adds organizational management requirements. OWASP provides security-specific guidance.

Which to follow

If your AI agent operates in the EU: the EU AI Act is mandatory. Use NIST and ISO 42001 as additional guidance.

If your AI agent operates outside the EU: NIST AI RMF is a good voluntary baseline. ISO 42001 certification signals maturity to customers.

If your agent handles sensitive operations: follow all of them. The overlap means satisfying one framework puts you most of the way toward the others.

Technical implementation

Regardless of which framework you follow, the technical controls are the same: policy enforcement, content scanning, behavioral monitoring, audit trails, approval workflows, and incident response. The frameworks differ in how they organize and document these controls, not in what controls are needed.