Why the law alone is not a program
A leader who has read the Act often asks the same next question: "so what do we actually do on Monday?" The Act is a set of obligations, not a playbook. The frameworks are the playbook. NIST gives your teams a shared way to reason about AI risk. ISO 42001 gives you a management system you can be audited against and certified for - proof, not assertion. And Singapore's Model Framework is the region's voluntary reference, useful even where the Act does not reach. This session is about choosing which one answers which need, so your program has a spine instead of a slogan.
Law, method, proof 9 min live
The three things share a topic but do three different jobs. One is binding, two are voluntary. One tells you the rules, one tells you how to reason, one lets you prove you did. Seen as a stack instead of a menu, they stop competing and start reinforcing each other.
| Framework | Binding? | What it gives you | When to use |
|---|---|---|---|
| EU AI Act | Yes - law | The mandatory rules and fines | When your AI is in scope - the floor |
| NIST AI RMF | No - voluntary | A method to reason about AI risk | To give teams a shared risk language |
| ISO/IEC 42001 | No - but certifiable | An auditable management system | To prove governance to a customer or auditor |
| SG Model Framework | No - voluntary | Principles-based regional guidance | APAC reference, incl. where the Act does not reach |
LiveThe one line that fits them together3 min▶
Say it this way: "NIST shows what good looks like, ISO 42001 lets you prove it, and the EU AI Act makes parts of it mandatory."
- Law - EU AI Act. The only binding item. It sets what you must do; the frameworks help you do it well, but they never replace it.
- Method - NIST AI RMF. A voluntary US-origin framework that gives your organisation a shared vocabulary and process for AI risk, mapping cleanly onto the Act's obligations.
- Proof - ISO/IEC 42001. The first certifiable AI management-system standard. It turns good intentions into an auditable system a third party can verify.
- Regional reference - SG Model Framework. Voluntary and principles-based, the APAC starting point - especially valuable for a Singapore firm operating beyond the Act's reach.
LiveWhy "which framework?" is the wrong question3 min▶
- They answer different needs. Mandatory obligation is the Act. A risk method is NIST. Third-party-verifiable proof is ISO 42001. Asking which to pick is like asking whether to use a map or a receipt - you need both, for different reasons.
- They interlock. NIST's functions map onto the Act's obligations; ISO 42001 gives you the management system to operate them; the SG framework echoes the same principles for the region.
- Maturity decides the order, not the choice. Most firms start with a method (NIST) to get a shared language, then formalise into a management system (ISO 42001) when they need to prove governance to a customer.
NIST and ISO in one look 8 min live
The two workhorse frameworks have a shape worth knowing. NIST is built on four functions that form a cycle of reasoning. ISO 42001 is a management system built on the same Plan-Do-Check-Act loop that runs ISO 27001 for security - familiar territory for anyone who has been through a certification before.
LiveNIST AI RMF - the method3 min▶
Voluntary, US-origin (NIST AI 100-1, published January 2023). It is built on four functions:
- Govern - the culture and accountability that runs across everything else: policies, roles, risk tolerance.
- Map - understand the context and frame the risks of a given AI system.
- Measure - assess, benchmark and monitor those risks with evidence.
- Manage - prioritise the risks and act on them.
It also names seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. A companion GenAI Profile (NIST AI 600-1, July 2024) extends it to generative AI.
LiveISO/IEC 42001 and the SG framework3 min▶
- ISO/IEC 42001:2023 is the first certifiable AI management-system standard (an AIMS). It follows the same Plan-Do-Check-Act structure as ISO 27001 for information security: you implement an AI policy, define roles, run AI risk and impact assessments, apply the Annex A controls, and commit to continual improvement. Because it is auditable, an independent body can certify you - which is how you hand a customer proof rather than a promise.
- Singapore's Model AI Governance Framework (IMDA and PDPC, first issued 2019 and updated 2020) is voluntary and principles-based - the APAC responsible-AI reference. A 2024 Generative AI edition (IMDA with AI Verify) adds nine dimensions: accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research, and AI for the public good.
Vantage picks ISO 42001. When Vantage's German customer asked for evidence of governance, describing its careful process was not enough - the customer wanted proof. Vantage had already used the NIST AI RMF internally to reason about the hiring tool's bias risk, which gave its teams a shared language. But to answer the customer, it set a path to ISO/IEC 42001 certification: an auditable management system a third party could verify. NIST told Vantage what good looked like; ISO 42001 let it prove it; the EU AI Act made the high-risk parts mandatory. One stack, three jobs.
Map need to framework ★ 12 min · pen and paper
Three needs, three frameworks. Match yours and the choice makes itself.
Write your three needs as questions: What must we do by law? How should our teams reason about AI risk? How do we prove our governance to an outsider?
Against the first, write EU AI Act - the mandatory floor. Note which of your systems are in scope from session a2.
Against the second, write NIST AI RMF, and note whether your teams currently share any method or assess risk ad hoc.
Against the third, write ISO/IEC 42001, and note whether any customer or regulator has asked, or is likely to ask, for evidence.
Pick your starting framework ★ 8 min · your next AI review
Four questions that reveal which framework to reach for first.
"Do our teams share a common way to talk about AI risk, or does each project improvise?" If they improvise, start with NIST.
"Has any customer, partner or regulator asked us to evidence our governance?" If yes, start the path to ISO 42001.
"Are any of our AI systems in scope of the EU AI Act?" If yes, the Act is a non-negotiable floor regardless of which framework you start with.
"Do we operate mainly in APAC, beyond the Act's reach?" If so, Singapore's Model Framework is a natural voluntary reference to anchor on.
Before session a6 ◐ 30 min total
- Keep your need-to-framework map - a6 assembles these frameworks into one running program with a single owner.
- Find out whether your teams already use any AI risk method, and whether anyone has raised ISO 42001 certification.
- Ask whether a customer or regulator has requested evidence of your AI governance - that is the trigger for the proof layer.
- Optional: skim the NIST AI RMF's four functions and the seven trustworthy-AI characteristics - they are short and shape the whole method.
- Do our teams share a common AI risk method like the NIST AI RMF, or assess risk ad hoc?
- Has any customer or regulator asked us to evidence our governance - the ISO 42001 trigger?
- Which of our AI systems are in scope of the EU AI Act, our mandatory floor?
- Do we operate in markets where Singapore's Model Framework is the natural reference?
- What is our current maturity - a method, a management system, or neither yet?
Official sources covered
Taught from the primary texts and framework docs. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · "NIST shows what good looks like, ISO 42001 lets you prove it, the EU AI Act makes parts mandatory." This means...
They do three different jobs: a method for reasoning about risk, a certifiable management system for proof, and the binding law that makes parts mandatory.
2 · What is distinctive about ISO/IEC 42001 compared with the NIST AI RMF?
ISO 42001 is voluntary but certifiable: a PDCA management system an independent body can audit, so you can hand a customer proof rather than a promise.
3 · The four functions of the NIST AI Risk Management Framework are...
NIST AI RMF is built on Govern, Map, Measure, Manage. Plan-Do-Check-Act is the ISO management-system loop; the third option is the NIST cybersecurity framework.