AI governance on one page: the four anchors
Carry the AI-governance landscape in one mental model — and see why they're complementary, not competing.
Four instruments dominate AI governance. Hold these and you can speak credibly to any board.
EU AI Act — the law
A risk-tiered regulation: prohibited, high-risk (heavy obligations), limited-risk (transparency), minimal-risk. Binding, with extraterritorial reach.
NIST AI RMF — the playbook
Voluntary US framework: Govern, Map, Measure, Manage across the AI lifecycle. Govern is the cross-cutting accountability function.
ISO/IEC 42001 — the certificate
The first certifiable AI management system standard — what 27001 is to security, 42001 is to AI.
COBIT — the backbone
The enterprise governance system (EDM + management objectives) that AI obligations integrate into — so AI governance is embedded, not bolted on.
This is exactly the discipline the 2024 CGEIT refresh expects — and it's the full AI track waiting for you inside.
Key concepts to lock in
- EU AI Act = risk-tiered law
- NIST AI RMF = Govern, Map, Measure, Manage
- ISO/IEC 42001 = certifiable AI management system
- COBIT = the backbone AI obligations integrate into