ISO 42001 vs NIST AI RMF vs the EU AI Act — which one is your customer actually asking for?

Boards and buyers use "AI governance" as a single word, but they mean three different things. This lesson walks the differences between ISO 42001, NIST AI RMF and the EU AI Act, so you can identify which one your customer, your regulator or your board actually wants — and design your programme so it satisfies all three.

Free preview 13 min read Under review

Legal basis

ISO/IEC 42001 primary-source stack current to 19 September 2026. Core: ISO/IEC 42001:2023 first edition December 2023 (ten clauses 0-10 plus Annex A with 38 controls across groups A.2 Policies related to AI, A.3 Internal organisation, A.4 Resources for AI systems, A.5 Assessing impacts of AI systems on individuals or groups and societies, A.6 AI system lifecycle, A.7 Data for AI systems, A.8 Information for interested parties of AI systems, A.9 Use of AI systems, A.10 Third-party and customer relationships, plus Annex B implementation guidance, Annex C AI-related organisational objectives, Annex D use of AIMS across domains). Companion standards: ISO/IEC 23894:2023 (guidance on AI risk management), ISO/IEC 23053:2022 (framework for AI systems using machine learning), ISO/IEC 42005:2025 (AI system impact assessment), ISO/IEC 22989:2022 (AI concepts and terminology), ISO/IEC TR 24028:2020 (trustworthiness in AI). Integration standards: ISO/IEC 27001:2022 for the AIMS-on-top-of-ISMS pattern, ISO/IEC 27701:2025 for the PIMS integration. India-specific stack: India AI Governance Guidelines released by MeitY in November 2025 (seven sutras Trust / People-first / Innovation over restraint / Fairness and equity / Accountability / Understandability by design / Safety resilience sustainability, across six pillars Infrastructure / Capacity building / Policy and regulation / Risk mitigation / Accountability / Institutions, with Annexure 6 recommending ISO/IEC 42001), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 notified 10 February 2026 effective 20 February 2026 introducing Synthetically Generated Information as a due-diligence category with visual labelling audio disclosure metadata embedding and 2 to 3 hour takedown for deepfake harm, MeitY AI Advisory dated March 2024 on labelling AI-generated content operative until superseded on labelling by the 2026 Rules, SEBI Circular No. HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated 5 May 2026 (Advisory on emerging advanced AI tools for vulnerability detection, Cyber-suraksha.ai task force, applies to every regulated entity in the Indian securities market), Report of the RBI Committee on FREE-AI (Framework for Responsible and Ethical Enablement of Artificial Intelligence) chaired by Professor Pushpak Bhattacharyya of IIT Bombay released 13 August 2025 (seven sutras 26 recommendations six pillars Infrastructure Policy Capacity Governance Protection Assurance), DPDP Act 2023 and DPDP Rules 2025 notified November 2025 with phased commencement (no equivalent to GDPR Article 22, no right to explanation), BIS adoption as IS/ISO/IEC 42001:2023 identical to ISO text, IndiaAI Mission approved March 2024 with ₹10,371 crore outlay over five years across seven pillars including Safe & Trusted AI (13 projects funded as of July 2026 on deepfake and bias), IndiaAI Safety Institute announced January 2025. Global adjacent regulation for extraterritorial reach and crosswalk: EU AI Act Regulation (EU) 2024/1689 phased application 2 February 2025 prohibited practices and AI literacy live, 2 August 2025 GPAI transparency for new models, 2 August 2026 general application and Article 50 transparency, 2 December 2026 new prohibited practices on synthetic intimate content and CSAM, 2 December 2027 Annex III high-risk (pushed back from August 2026 by Digital Omnibus), 2 August 2028 Annex I product-embedded high-risk. NIST AI Risk Management Framework 1.0 (January 2023) four functions Govern Map Measure Manage with official crosswalk to ISO/IEC 42001 published by NIST AIRC. OECD AI Principles (2019 updated 2024). UNESCO Recommendation on the Ethics of AI (2021). Council of Europe AI Framework Convention (opened for signature September 2024). Certification body landscape referenced: A-LIGN, BSI India, Bureau Veritas India, DNV Business Assurance India, Schellman, SGS India, TÜV SÜD South Asia, TÜV Nord India, Intertek India (accredited under ANAB, UKAS, RvA pending NABCB scheme extension). Personal certification schemes referenced (not primary): PECB Lead Implementer and Lead Auditor for ISO 42001, BSI ISO 42001 Lead Implementer, operating under ISO/IEC 17024. India first-mover organisational certifications referenced: Mphasis (first Indian IT services company to certify, 2025) and KPMG India (certified by SGS December 2025). Items requiring ongoing verification and flagged inside the relevant lessons: NABCB scheme extension timeline for ISO 42001; any ISO/IEC 42001 amendment beyond first edition; Digital India Act draft status and eventual enactment; RBI conversion of FREE-AI Report recommendations into binding master directions; DPDP Board of India Chairperson appointment status; new India AI-specific legislation.

One of the most common mistakes I see teams make is to treat "AI governance" as a single word. It is not. Right now, in September 2026, there are three different things that people mean when they say those two words. Which one your customer is asking for, which one your regulator is enforcing, which one your board is worried about — these are three separate questions and they usually have three separate answers. Let me walk each one, and then show you how they connect. The three things people…

Free The rest of Module 1 is free with your email

Keep reading, free

Add your name and email. We send a one-click link that brings you straight back to this lesson, signed in. No password, no payment.

We use your name and email only to send your access link and course emails. Unsubscribe from any email at any time. Privacy notice.

Already signed up? Get a fresh link.

Every claim in this lesson is cited. Yellow markers like [L1-C1] are clickable. Click any to see the verbatim text of the Section, Rule or judgment we're relying on. Learn how we verify content ›

Citations

ISO/IEC 42001:2023, ISO/IEC 42001:2023 (Dec 2023 first edition) (AI management systems Requirements) L3-C1

ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system. First edition published 18 December 2023 by ISO/IEC JTC 1/SC 42 (AI subcommittee). The worlds first international management-system standard specifically for artificial intelligence. Structure: ten main clauses (0 Introduction through 10 Improvement) following the Annex SL harmonised structure shared with ISO 27001 and ISO 9001, plus Annex A (38 controls across 9 control groups A.2 through A.10), Annex B (implementation guidance for Annex A controls), Annex C (potential AI-related organisational objectives and risk sources), and Annex D (using an AIMS in specific domains).

MeitY AI Governance Guidelines, India AI Governance Guidelines Nov 2025 (Seven sutras and six pillars) L3-C3

MeitY released the Guidelines on 5 November 2025. Seven sutras: Trust, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, Safety Resilience and Sustainability. Six pillars. Voluntary; no separate AI law proposed now.

IT Amendment Rules 2026, IT Rules Amendment 2026 SGI (SGI due-diligence obligations) L3-C4

G.S.R. 120(E) of 10 February 2026 amended the IT Rules 2021 (effective 20 February 2026). Rule 2(1)(wa) defines SGI (audio, visual, audio-visual). Rule 3(3): technical measures, labels, metadata. Rule 3(1)(d): 3-hour takedown. Rule 3(2)(b): 2 hours. Source: MeitY consolidated rules.

SEBI Circular 5-May-2026, SEBI Advisory 5-May-2026 Mythos (AI vulnerability detection advisory) L3-C5

SEBI circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 of 5 May 2026 to regulated entities on AI tools for vulnerability detection. Covers vulnerability management, patching, API security, SOC and Market SOC onboarding; sets up the Cyber-suraksha.ai task force. It does not refer to ISO/IEC 42001.

RBI FREE-AI Report, RBI FREE-AI Report 13-Aug-2025 (RBI committee framework) L3-C6

Report of the RBI Committee on FREE-AI (Framework for Responsible and Ethical Enablement of Artificial Intelligence), released 13 August 2025. It makes 26 recommendations across six pillars. It is a committee report and not a binding direction; no timeline for directions is committed.

NIST AI RMF 1.0, NIST AI RMF 1.0 four functions (Govern Map Measure Manage) L3-C7

Voluntary framework published 26 January 2023 with four functions (GOVERN, MAP, MEASURE, MANAGE), 19 categories and 72 subcategories. A third-party crosswalk to the draft ISO/IEC 42001 text is hosted on NIST AIRC without NIST endorsement.

EU AI Act 2024/1689, EU AI Act Article 5 prohibited practices (Prohibited practices and AI literacy) L3-C8

Chapters I and II apply from 2 February 2025. Regulation (EU) 2026/1744 adds new Article 5 bans from 2 December 2026 and replaces Article 4 with a duty to take AI literacy measures. Territorial scope is Article 2. Indian exporters can be within reach.

EU AI Act 2024/1689, EU AI Act general application 2-Aug-2026 (General application and Article 50) L3-C9

Article 50 transparency applies from 2 August 2026; for generative systems already on the market, Article 50(2) applies by 2 December 2026. Annex III high-risk obligations apply from 2 December 2027 and Annex I from 2 August 2028 (Regulation (EU) 2026/1744).

Free preview

The first lesson is open. Add your email to read the rest of Module 1 free.

Module 1: What ISO/IEC 42001 actually is, and why it turned into a procurement gate in 2026

Module 2: Reading Clauses 4, 5 and 6: Context, Leadership and Planning

Clauses 4.1 and 4.2: understanding your context and identifying interested parties
Clause 4.3: writing an AIMS Scope Statement that a certification body will accept
Clause 5: Leadership, AI Policy and Roles — where an AIMS becomes real
Clause 6.1: the AI risk assessment methodology — the beating heart of the AIMS
Clauses 6.2 and 6.3: AI objectives and planning of changes

Module 3: Reading Clauses 7, 8, 9 and 10: Support, Operation, Performance evaluation, Improvement

Clauses 7.1 to 7.4: Resources, Competence, Awareness, Communication
Clause 7.5: Documented information — what must be in writing, and how it is controlled
Clause 8: Operation — executing the risk methodology and running the AIIA
Clause 9: Performance evaluation — monitoring, internal audit, management review
Clause 10: Continual improvement, nonconformity and the CAPA process

Module 4: Annex A controls Part 1: A.2 Policies, A.3 Internal organisation, A.4 Resources, A.5 Impact assessment

Annex A.2 — Policies related to AI: three controls that anchor the AIMS
Annex A.3 — Internal organisation: AI roles and the concerns-reporting channel
Annex A.4 Part 1 — Resource documentation, data and tooling resources (A.4.2 to A.4.4)
Annex A.4 Part 2 — System and computing, and human resources (A.4.5 and A.4.6)
Annex A.5 — AI Impact Assessment: the four controls that decide whether an AIMS is real

Module 5: Annex A controls Part 2: A.6 AI lifecycle, A.7 Data, A.8 Information, A.9 Use, A.10 Third-party

Annex A.6 Part 1 — AI lifecycle: requirements, design and development
Annex A.6 Part 2 — Verification, deployment, operation, monitoring and event logs
Annex A.7 — Data for AI systems: five controls with the DPDP overlay
Annex A.8 — Information for interested parties: where the IT Rules 2026 SGI obligations land
Annex A.9 and A.10 — Responsible use of AI systems and third-party relationships

Module 6: Building the AIMS end-to-end: inventory, impact assessment, risk assessment, Statement of Applicability, tooling

Building the AI system inventory — the foundation everything else hangs on
Running an AI Impact Assessment per ISO/IEC 42005:2025 — the operational template
Running the AI risk assessment methodology per ISO/IEC 23894:2023
Building the Statement of Applicability — the single most-audited document
GRC tooling landscape — buy versus build for an AIMS

Module 7: Certification body selection, Stage 1 audit, Stage 2 audit, certificate issuance

The accreditation chain — why the certificate means anything, and where NABCB stands on ISO 42001
CB selection — the RFP process, scoring criteria and negotiation
Stage 1 — the documentation review: what the auditor tests and how to pass first time
Stage 2 — the operating-effectiveness audit: sampling, interviews, evidence
The three-year sustain cycle — surveillance, recertification and living with the certificate

Module 8: The India overlay + the next five years: AI Governance Guidelines, IT Rules 2026, SEBI, RBI FREE-AI, DPDP, EU AI Act, NIST AI RMF

The India AI Governance Guidelines in operational depth — the seven sutras and six pillars, clause by clause
IT Amendment Rules 2026 SGI obligations in operational depth — the first binding AI law in India
Sector-specific overlays — SEBI 5-May-2026, RBI FREE-AI, and the wider sectoral picture
DPDP intersection with AI, and EU AI Act extraterritorial reach on Indian exporters
NIST AI RMF crosswalk and the next five years — closing the course