Appearance
AI Governance Frameworks Comparison — EU AI Act, ISO 42001, NIST AI RMF, OWASP LLM
This page compares the AI governance frameworks, standards, and laws that Modulos documents. For each one, it gives the legal status, the persons and activities that it applies to, and the certification or conformity assessment that it has. At the end of this page, you find the pages that compare two frameworks and the frequently asked questions.
What is AI governance?
AI governance is how an organization makes decisions about AI: who is accountable, how the organization assesses risks, and what it approves and monitors. An AI governance framework is a structured set of principles, roles, processes, and controls for this work.
AI compliance is the work to comply with the legal rules that apply to the organization. AI risk management identifies, assesses, treats, and monitors AI risks.
The AI governance frameworks, standards, and laws that Modulos documents are of different kinds:
- Laws — the EU AI Act gives rules for AI systems and general-purpose AI models. Colorado SB 26-189 gives rules for automated decision-making technology (ADMT) in some decisions. The CCPA ADMT Regulations give rules for automated decisionmaking technology (ADMT) in some decisions. NYC Local Law 144 gives rules for automated employment decision tools. The GDPR and the UAE PDPL give rules for the processing of personal data. NIS2 gives rules for cybersecurity, DORA for the digital operational resilience of financial entities, and the Cyber Resilience Act for products with digital elements.
- Standards — ISO/IEC 42001, ISO/IEC 27001, and ISO/IEC 27701 are management system standards. EN 18286 is the harmonized standard for the quality management system of the EU AI Act. IEEE 7003 is a standard on algorithmic bias.
- Frameworks, principles, and guidance — NIST AI RMF, the Singapore MGF for Agentic AI, and MAS FEAT. Also UAE AI Ethics, the CBUAE Guidance Note on AI, FINMA Guidance 08/2024, and the Saudi SDAIA-P145 framework.
- Top 10 security risks — the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications.
- Contractual requirements — the Microsoft Supplier DPR.
A law applies to the persons and activities in its own scope rules. Examples are Article 2 of the EU AI Act and Article 3 of the GDPR. An organization does not select a law by jurisdiction or sector. An organization can add a management system standard, a risk management framework, and an OWASP Top 10 to the laws that apply to it.
Legal status and scope of each framework
The table below gives one row for each framework that Modulos documents. The framework page gives the full rules.
| Framework | Instrument | Legal status | Applies to | Certification or conformity |
|---|---|---|---|---|
| EU AI Act | Regulation (EU) 2024/1689 | EU Regulation that applies directly in all Member States. Its parts apply from different dates (Article 113). | AI systems and general-purpose AI models (Article 1(2)). The persons in Article 2(1), for example providers and deployers, with the exclusions of Article 2. This includes providers and deployers in a third country where the output of the AI system is used in the Union. | Providers make sure that each high-risk AI system undergoes conformity assessment "prior to its being placed on the market or put into service" (Article 16(f)), from 2 December 2027 or 2 August 2028, as applicable. Notified bodies issue certificates in the Annex VII procedure (Article 44(1)). |
| GDPR | Regulation (EU) 2016/679 | EU Regulation that applies directly in all Member States. | The processing of personal data in the material scope of Article 2, with its exclusions, and in the territorial scope of Article 3. See GDPR scope and applicability. | Voluntary certification of processing operations by controllers and processors is available from certification bodies or the competent supervisory authority (Article 42). |
| NIS2 | Directive (EU) 2022/2555 | EU Directive, addressed to the Member States (Article 46). Entities are bound by the national law that transposes it (Article 41(1)). | Essential entities and important entities of a type in Annex I or Annex II, with the scope rules of Articles 2 and 3. NIS2 sets cybersecurity risk-management measures and reporting obligations (Article 1(2)). | NIS2 sets no certification procedure of its own. To show compliance with parts of Article 21, Member States can make entities use ICT products, ICT services, and ICT processes that are certified in European cybersecurity certification schemes (Article 24(1)). |
| DORA | Regulation (EU) 2022/2554 | EU Regulation that applies directly in all Member States, from 17 January 2025 (Article 64). | The digital operational resilience (Article 3(1)) of the financial entities of Article 2(1), points (a) to (t). DORA also sets rules for ICT third-party service providers (Article 2(1)(u)). DORA has no provision on AI as such: see DORA and the EU AI Act. | DORA has no certification of the financial entity. |
| Cyber Resilience Act | Regulation (EU) 2024/2847 | EU Regulation that applies from 11 December 2027, with earlier dates for Article 14 and Chapter IV (Article 71(2)). | Products with digital elements that are made available on the market, when their intended purpose or reasonably foreseeable use includes a data connection to a device or network (Article 2(1)). | The manufacturer does a conformity assessment (Article 32(1)). In the EU-type examination procedure, a notified body issues an EU-type examination certificate (Annex VIII, Part II). |
| EN 18286 | EN 18286:2026, quality management system for EU AI Act regulatory purposes | Voluntary harmonized standard of CEN and CENELEC. The Commission published its reference in the Official Journal on 14 October 2026 (Implementing Decision (EU) 2026/2274). | Providers of AI systems, for their quality management system. | The standard sets no certification procedure. From 14 October 2026, conformity with the standard gives a presumption of conformity (Article 40(1) of the EU AI Act). This presumption applies only to Article 17(1) and the first sentence of Article 11(1), on the conditions of Annex ZA. It applies only while the Official Journal keeps the reference. See Annex ZA and the EU AI Act. |
| ISO/IEC 42001 | ISO/IEC 42001:2023 | Voluntary international standard. | An organization that provides or uses products or services with AI systems, for its AI management system (Clause 1). | The standard sets no certification procedure. Certification by a certification body is optional. Conformity with ISO/IEC 42001 gives no presumption of conformity in the EU AI Act (Article 40(1)). See Certification. |
| ISO/IEC 27001 | ISO/IEC 27001:2022 | Voluntary international standard. | An organization, for its information security management system. | The standard sets no certification procedure. Certification by a certification body is optional. See Certification. |
| ISO/IEC 27701 | ISO/IEC 27701:2025 | Voluntary international standard. Since the 2025 edition, it is a stand-alone management system standard. | An organization, for its privacy information management system (PIMS). | The standard does not refer to certification. Certification by a certification body is optional. |
| IEEE 7003 | IEEE Std 7003-2024, Standard for Algorithmic Bias Considerations | Voluntary standard. Its use is fully voluntary. | Persons and organizations that make an AI system, to address bias in its algorithms and models (1.1, 1.2). | IEEE 7003 does not include tracking and certification in its scope (1.5). |
| NIST AI RMF | NIST AI 100-1, AI RMF 1.0 (January 2023) | Voluntary guidance of NIST. It sets no obligation. | Organizations in all sectors that are "designing, developing, deploying, or using AI systems". | No certification. |
| OWASP Top 10 for LLM Applications | OWASP Top 10 for LLM Applications | Guidance on security risks from the OWASP GenAI Security Project. It is not law. | Applications that use large language models. As of October 2026, OWASP’s 2026 edition (4 August 2026) is available, while the Modulos Framework maps the 2025 edition. | No certification. |
| OWASP Top 10 for Agentic Applications | OWASP Top 10 for Agentic Applications, Version 2026 (9 December 2025) | Guidance on security risks from the OWASP GenAI Security Project. It is not law. | Agentic applications. It gives ten risks, ASI01 to ASI10. | No certification. |
| Singapore MGF for Agentic AI | IMDA Model AI Governance Framework for Agentic AI, Version 1.5 (20 May 2026, updated 5 June 2026) | Voluntary guidance of the Infocomm Media Development Authority (IMDA). It is not law. | Organizations that deploy agentic AI. It has four dimensions. | No certification. |
| MAS FEAT | MAS FEAT Principles of the Monetary Authority of Singapore | "Principles for firms to consider" (§ 2.1). MAS does not intend them to be prescriptive (§ 2.2). | In the financial sector of Singapore, "firms that use AIDA to provide financial products and services" (§ 3.3). AIDA is artificial intelligence or data analytics. | No certification. |
| UAE AI Ethics | UAE AI Ethics: Principles & Guidelines (DEC 2022) | Non-mandatory guidelines of the UAE AI Office. | In the public and private sectors, "AI systems which make or inform ‘significant decisions’" (§ 1.2). | No certification. |
| UAE Consumer AI | CBUAE Guidance Note on the Consumer Protection and Responsible Adoption and Use of AI and ML | Guidance Note of the Central Bank of the UAE. It supplements, and does not replace, laws, regulations, and directives. | "Licensed financial institutions, including insurance providers (LFIs)" in the UAE, for their use of AI and machine learning. | No certification. |
| FINMA Guidance 08/2024 | FINMA Guidance 08/2024, Governance and risk management when using artificial intelligence (18 December 2024) | Supervisory guidance of FINMA. FINMA tells readers that its guidance "does not have legal impact". | Institutions that FINMA supervises and that use AI. | No certification. |
| Saudi SDAIA-P145 | SDAIA National Artificial Intelligence Risk Management Framework, SDAIA-P145, version 1.0 (April 2026) | Advisory framework of the Saudi Data and Artificial Intelligence Authority (SDAIA). The Arabic text is authoritative. | Government and private-sector entities. | No certification. |
| UAE PDPL | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data | UAE federal law. | The processing of Personal Data in Article 2(1), with the exclusions in Article 2(2). See UAE PDPL scope. | No certification. |
| Colorado SB 26-189 | Colorado Senate Bill 26-189 (C.R.S. §§ 6-1-1701 to 6-1-1709) | Colorado law that takes effect January 1, 2027, with specified provisions that "take effect upon passage" (Section 5(1) and (2)). It applies to consequential decisions made on or after January 1, 2027 (Section 5(3)). | Developers and deployers of covered ADMT that is used to materially influence consequential decisions. A developer or deployer is a person "doing business in Colorado". Section 6-1-1708 provisions include conditional compliance and exemption rules, plus notice and disclosure duties, for insurers and HIPAA covered entities. | No certification. |
| CCPA ADMT Regulations | California Consumer Privacy Act Regulations, Article 11 (Cal. Code Regs. tit. 11) | Regulations of the California Privacy Protection Agency, in effect from January 1, 2026. Article 11 has different compliance rules for a business that uses ADMT for a significant decision before January 1, 2027, and for one that uses it on or after that date (§ 7200(b)). See When Article 11 applies. | A business that uses ADMT to make a significant decision about a consumer (§ 7200(a)). Consumers include, for example, a "job applicant" and an "independent contractor". | Article 11 has no certification. |
| NYC Local Law 144 | Local Law 144 of 2021 (N.Y.C. Admin. Code §§ 20-870 to 20-874) and the DCWP rules | New York City local law and agency rules. | Employers and employment agencies that use an automated employment decision tool to screen candidates for employment or employees for promotion in the city (§ 20-871(a)). | A bias audit, not more than one year before the use of the tool (§ 20-871(a)). A bias audit is "an impartial evaluation by an independent auditor" (§ 20-870). It is not a certification. |
| Microsoft Supplier DPR | Microsoft Supplier Data Protection Requirements, Version 10 (October 2024) | Contractual requirements of Microsoft for its suppliers. They are not law. | Microsoft suppliers that Process Microsoft Personal Data or Microsoft Confidential Data in connection with their Performance of their contract with Microsoft. Microsoft published Version 12 in March 2026. | No certification. |
The EU AI Act, ISO/IEC 42001, and NIST AI RMF side by side
The table below compares three instruments: the EU AI Act (a Regulation), ISO/IEC 42001 (a voluntary management system standard), and NIST AI RMF 1.0 (voluntary guidance).
| Item | EU AI Act | ISO/IEC 42001:2023 | NIST AI RMF 1.0 |
|---|---|---|---|
| Publisher | European Union | ISO and IEC | NIST (U.S.) |
| Date | Regulation of 13 June 2024. Its parts apply from different dates (Article 113). Chapter III, Sections 1 to 3, but not Article 6(5), apply from 2 December 2027 (Article 6(2) and Annex III) or 2 August 2028 (Article 6(1) and Annex I). | First edition, December 2023 | January 2023 |
| Legal status | EU Regulation that applies directly in all Member States | Voluntary international standard | Voluntary guidance |
| Scope | The persons in Article 2(1), with the exclusions of Article 2. This includes providers and deployers in a third country where the output of the AI system is used in the Union. See Scope and exclusions. | An organization that provides or uses products or services with AI systems (Clause 1) | NIST AI 100-1 gives no geographic scope |
| Content | Harmonized rules for the placing on the market, the putting into service, and the use of AI systems in the Union (Article 1(2)). Also prohibitions, requirements for high-risk AI systems, transparency rules, and rules for general-purpose AI models. | Requirements for an AI management system | The management of AI risks |
| Structure | Prohibited AI practices (Article 5), high-risk AI systems (Article 6, Annexes I and III), transparency obligations (Article 50), general-purpose AI models (Chapter V), and obligations for each operator role (Article 3(8)) | Clauses 4 to 10, Annex A (control objectives and controls), and Annex B (implementation guidance) | The Core with four functions (GOVERN, MAP, MEASURE, MANAGE), with categories and subcategories |
| Certification | In the Annex VII procedure, a notified body issues a certificate (Article 44(1)) | Optional, by a certification body. The standard sets no certification procedure. | None |
| Documentation | For providers of high-risk AI systems: technical documentation (Article 11), the quality management system (Article 17), and post-market monitoring (Article 72) | The AI policy (5.2) and the results of the AI risk assessment and the AI system impact assessment. Also the internal audit (9.2) and the management review (9.3). | Profiles (Current Profile and Target Profile), categories, and subcategories |
| Applies or is used when | The operations of a person are in the scope of Article 2(1) | An organization sets up an AI management system | An organization gives a structure to its AI risk management |
When to use which framework
Each item below gives a condition and the framework page to start with:
- Operations in the scope of Article 2(1) of the EU AI Act → the EU AI Act. Find your operator role (Article 3(8)): provider, deployer, importer, distributor, product manufacturer, or authorized representative. Then examine the prohibited AI practices (Article 5), the transparency obligations (Article 50), the duties for high-risk AI systems, and the duties for general-purpose AI models (Chapter V).
- An AI management system → ISO/IEC 42001. Certification by a certification body is optional.
- Internal AI risk management → NIST AI RMF 1.0. NIST AI 100-1 applies GOVERN to all stages of the AI risk management processes of an organization. It applies MAP, MEASURE, and MANAGE to each AI system and to stages of its lifecycle.
- Applications that use large language models → the OWASP Top 10 for LLM Applications.
- Agentic applications → the OWASP Top 10 for Agentic Applications.
- Processing of personal data in the scope of Article 3 of the GDPR → the GDPR. ISO/IEC 27701 is a voluntary standard for a privacy information management system.
- Financial entities in the scope of Article 2 of DORA → DORA. The EU AI Act also applies when its own scope includes the AI system.
- Essential entities or important entities of NIS2 → NIS2, through national law. ISO/IEC 27001 is a voluntary standard for an information security management system.
One Control for many Frameworks
In Modulos, Requirements of more than one Framework can link the same Control. Other Controls are linked only by the Requirements of one Framework. Modulos sets these links between Requirements and Controls, and Modulos can change them.
A shared Control does not make the Requirements of the other Frameworks Fulfilled. Each Requirement belongs to one Framework. When two Frameworks have different numbers of Controls, the shared Controls can be a different percentage of each Framework. For the figures of each pair of Frameworks at each level, see Control overlap across AI governance frameworks.
AI governance frameworks in Modulos
In Modulos, each Framework holds Requirements that Modulos takes from the source instrument, which is a law, a standard, or guidance:
- Requirements — a Requirement from a law gives a duty. A Requirement from a voluntary source, for example NIST AI RMF or an OWASP Top 10, gives what the source expects or recommends. See Requirements.
- Controls — each Requirement links one or more Controls. A Control changes status directly, with a logged comment. See Controls.
- Evidence — you attach Evidence in the Control. See Evidence.
- Review — when all linked Controls of a Requirement have a final status, the Requirement Owner reviews the Requirement and marks it Fulfilled. See Reviews & Statuses.
Frameworks at the Organization level attach to the organization AI System. If your organization has no organization AI System, contact Modulos Support. See Frameworks in Modulos.
Pages that compare two frameworks
Modulos documents these comparisons of two frameworks, and the Control overlap between Modulos Frameworks:
NIST AI RMF vs EU AI Act
Voluntary NIST guidance and an EU Regulation: the four functions of the Core and the Articles of the EU AI Act
ISO 42001 vs NIST AI RMF
A standard for an AI management system and voluntary NIST guidance: the clauses and the four functions
ISO/IEC 42001 vs EU AI Act
A voluntary standard and an EU Regulation: risk management, the quality management system, EN 18286, and the presumption of conformity
ISO 42001 vs ISO 27001
The AI management system and the information security management system: Clauses 4 to 10 and use together
EU AI Act vs GDPR
The EU AI Act and the GDPR for AI systems and the processing of personal data: roles, duties, and GDPR Article 22
NIS2 vs DORA
The EU cybersecurity Directive and the digital operational resilience Regulation for financial entities: DORA Article 1(2) and NIS2 Article 4
Control overlap
The number of Controls that two Modulos Frameworks share, at the AI System level and at the Organization level
Frequently asked questions
Answers to questions that compare two or more frameworks, with a link to the section that gives the rules
Where to go next
Frameworks overview
The frameworks that Modulos supports and that this site documents
EU AI Act guide
Scope, dates, high-risk AI systems, conformity assessment, and post-market monitoring
ISO/IEC 42001 guide
AI management system, Clauses 4 to 10, Annex A, and certification
NIST AI RMF guide
GOVERN, MAP, MEASURE, MANAGE, Profiles, and the Generative AI Profile
Frequently asked questions about AI governance frameworks
For answers to frequent questions that compare AI governance frameworks, see Frequently asked questions about comparing AI governance frameworks.
Disclaimer
This page gives general information. It is not legal advice.