Free tools Windows power users keep installed
One-click scans. No signup required.
Regulation creates binding legal duties; standards and frameworks generally offer voluntary ways to organize AI risk and governance. They are not interchangeable. A standard can still matter commercially—and, in the EU, a harmonised standard cited in the Official Journal can provide a presumption of conformity for the specific legal requirements it covers. Businesses should first work out which laws, systems and organizational roles apply, then choose frameworks and standards that help manage those obligations.
This guide compares the EU AI Act, NIST AI RMF 1.0 and ISO/IEC 42001:2023. It is current as of 7 October 2026 and is a general business explainer, not a legal determination for a particular company.
As an Amazon Associate I earn from qualifying purchases.
AI regulation, standards and frameworks: the difference
Regulation is law: it establishes duties for covered people, organizations, systems or activities, and can be enforced by public authorities. Standards specify agreed requirements, processes or technical approaches. Frameworks organize concepts and practices to help an organization manage a problem. Standards and frameworks are usually voluntary unless a law, contract, procurement requirement or other binding arrangement makes them relevant.
The EU AI Act, NIST AI RMF and ISO/IEC 42001 serve different purposes. The Act sets legal obligations within its scope. NIST AI RMF offers a voluntary risk-management approach. ISO/IEC 42001 specifies requirements and guidance for an organizational AI management system. Adopting the latter two does not, by itself, establish that a business has complied with every law that applies to it.
#1 Best Overall
| Instrument | What it is | Main question it helps answer | Legal status and principal caution |
|---|---|---|---|
| EU AI Act, Regulation (EU) 2024/1689 | Binding EU regulation. | What legal duties apply to covered AI systems and actors? | Enforceable within its scope. Duties depend on such factors as the system, risk category, actor and applicable exceptions; there is no single checklist for every AI use. European Commission overview |
| NIST AI RMF 1.0 | Voluntary risk-management framework from the U.S. National Institute of Standards and Technology. | How can an organization structure risk management through AI design, development, use and evaluation? | Voluntary guidance, not a regulation or certification. NIST says the framework is being revised. NIST AI Risk Management Framework |
| ISO/IEC 42001:2023 | International standard for an organizational AI management system. | What management-system requirements and guidance can an organization use to establish, maintain and improve AI governance? | Implementation is not proof that every applicable law has been satisfied. ISO/IEC 42001:2023 |
What businesses should know about the EU AI Act
Regulation (EU) 2024/1689 establishes a risk-based legal framework for specified AI uses. The European Commission’s overview describes requirements that can include risk assessment and mitigation, data quality, logging and traceability, technical documentation, information to deployers, human oversight, and accuracy, robustness and cybersecurity for high-risk systems. The Act distinguishes provider and deployer responsibilities: for example, providers of high-risk systems have conformity-assessment responsibilities and must take corrective action when they identify nonconformity, while deployers have operating, monitoring and recordkeeping duties in the circumstances set out in the law. Consult the official legal text and the Commission’s overview for the details.
Before assigning duties, establish the system’s intended purpose, classification, your organization’s role and any applicable exceptions. A business may have different roles for different systems—or across an AI supply chain—so role mapping and classification need to precede a compliance checklist.
Rank #2
Application dates as of 7 October 2026
The Commission’s timeline reflects the AI Omnibus changes that entered into force on 27 July 2026. The dates below distinguish provisions already applicable from high-risk rules scheduled for later application:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| Date | What the Commission says applies |
|---|---|
| 2 February 2025 | Prohibitions and AI literacy provisions began applying. |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models began applying. |
| 2 August 2026 | The Act became generally applicable, subject to exceptions and extended high-risk transition periods. |
| 2 December 2027 | Rules for high-risk AI systems in specified sensitive areas, including Annex III use cases, are scheduled to apply. |
| 2 August 2028 | High-risk AI systems embedded in regulated products are scheduled to be covered under the extended transition. |
These dates come from the European Commission’s AI Act overview and AI Act FAQ, checked on 7 October 2026. They supersede older timelines for the affected provisions; check the Commission or EUR-Lex for subsequent changes before relying on them.
Penalty ceilings are not typical fines
The Commission’s FAQ describes statutory maximums of up to €35 million or 7% of preceding-year worldwide annual turnover for specified prohibited-practice or data-related infringements; €15 million or 3% for other obligations; and €7.5 million or 1% for specified incorrect, incomplete or misleading information provided to authorities or notified bodies. The applicable ceiling depends on the infringement category and company type. For each category, the FAQ says the lower threshold applies to SMEs and the higher to other companies. These are legal ceilings, not observed or typical fines. European Commission AI Act FAQ
When harmonised standards affect conformity
Standards are generally voluntary, but a specific harmonised standard can have legal significance under the EU AI Act. The Commission says providers that follow applicable harmonised standards can benefit from a presumption of conformity for the requirements those standards cover. That is not a blanket exemption from the Act or a substitute for determining applicable duties. The Commission also reported that CEN and CENELEC’s standardisation work was ongoing and connected delayed standards availability with the extended high-risk dates. Before relying on a presumption, verify the standard’s exact title and version, its final status and coverage, and its reference in the Official Journal. European Commission AI Act FAQ
What NIST AI RMF contributes
NIST describes AI RMF 1.0 as voluntary guidance intended to help organizations incorporate trustworthiness considerations into AI design, development, use and evaluation. Its core functions are Govern, Map, Measure and Manage. Together, they offer a way to organize responsibilities and risk work across the AI lifecycle; they are not legal categories that replace the EU Act’s scope or actor analysis.
The companion NIST AI RMF Playbook suggests actions for those functions. NIST says the suggestions are voluntary and the Playbook is neither a checklist nor a set of steps every organization must follow. NIST’s framework page states that AI RMF 1.0 is being revised, so check its current materials and version status when building or updating a program.
NIST released AI RMF 1.0 on 26 January 2023 and its Generative AI Profile on 26 July 2024. It posted a concept note for a critical-infrastructure AI RMF profile on 7 April 2026. These are publication dates, not performance statistics. NIST AI Risk Management Framework
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What ISO/IEC 42001 contributes
ISO describes ISO/IEC 42001:2023 as requirements and guidance for establishing, implementing, maintaining and continually improving an AI management system. It addresses responsible development, provision or use of AI systems through an integrated, organization-level approach to risks and opportunities. It can help organize policy, accountability, processes and ongoing improvement, rather than dictate every technical detail for every AI application.
Using the standard—or obtaining a certification, where applicable—does not by itself determine whether the organization is legally in scope or satisfy all applicable legal duties. Run the law-specific analysis separately. ISO identifies other related standards with distinct purposes: ISO/IEC 22989 covers terminology and concepts, ISO/IEC 23053 sets out a general framework for AI and machine-learning systems, and ISO/IEC 23894 provides AI-related risk-management guidance. These are not substitutes for ISO/IEC 42001’s management-system role. ISO/IEC 42001:2023
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to choose and apply them in a business
Start with legal scope and the organization’s actual AI uses, not with a preferred certification or framework. Then select standards and guidance that help assign work, build evidence and manage ongoing risk. A practical sequence is:
- Inventory AI systems and intended uses. Record what each system does, where it is used, its purpose and the relevant business process. Revisit the inventory when a use or system changes.
- Map jurisdictions and organizational roles. Identify where systems are developed, supplied and used, and whether the business acts as a provider, deployer, importer, distributor or another covered actor. Roles can differ across the supply chain.
- Assess which legal duties may apply. For the EU AI Act, examine the system’s classification, prohibited or high-risk status, transparency requirements and relevant exceptions against the current law and timeline. Seek instrument-specific legal analysis for company-specific conclusions.
- Assign owners and evidence to legal requirements. Track who is responsible for each applicable obligation and what records, controls, monitoring or other evidence support it.
- Use frameworks and standards to support the work. NIST AI RMF can structure lifecycle risk management; ISO/IEC 42001 can support an organization-wide management system. Neither removes the need to meet binding law.
- Check conformity routes and keep assumptions dated. If relying on an EU harmonised standard, verify its final version, coverage and Official Journal reference. Record classification assumptions and review them when the use, system, jurisdiction, law or standards status changes.
When comparing options, ask about legal force and consequences; scope, geography and sector; organizational role; required or recommended evidence and controls; conformity assessment, audit or certification objectives; and whether the applicable dates or standard versions are current.
Quick Recap
Which approach is right for your organization?
- Use legal analysis to identify obligations. Regulation answers what covered actors must do. Applicability depends on facts about systems, uses, roles, locations and other relevant circumstances.
- Use a framework to organize risk practice. NIST AI RMF provides voluntary functions for structuring risk work, but it is not a regulation or certification and is under revision.
- Use a management-system standard to organize governance. ISO/IEC 42001 provides requirements and guidance for an organization-level AI management system, but does not independently establish compliance with every law.
- Treat standards as potentially consequential, not automatically binding. Contracts and procurement can make them commercially important; under the EU Act, the conformity presumption depends on the relevant harmonised standard and its Official Journal status.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
