Who this is for: AI governance and compliance leads — Chief AI Compliance Officers, Heads of AI Governance, and risk officers in regulated sectors — mapping regulatory obligations to engineering artifacts. You are choosing between NIST AI RMF and ISO/IEC 42001, working out what your cloud provider's ISO 42001 certification actually covers, and proving compliance posture to auditors and regulators. You need a framework map, not a vendor listicle.
The blueprint
This is a representative framework map, not an audit verdict or certification result. Each row maps a real, documented framework or cloud provider compliance program to the control surfaces it exposes. ✓ = yes, ~ = partial / limited / scoped / via partner, — = no / not applicable. Certification scope, applicability, and current status are intentionally omitted — they change as scopes expand and must be verified with each provider and your own counsel.
| Framework / program | Regulatory force | Third-party attestation | Risk granularity | Management-system overhead | U.S. traction | EU traction | Cloud-native tooling | Notes |
|---|---|---|---|---|---|---|---|---|
| EU AI Act (Reg. 2024/1689) | ✓ | ~ | ✓ | ✓ | ~ | ✓ | — | Binding EU regulation with explicit risk tiers (prohibited, high-risk, limited, minimal). Conformity assessment required for high-risk systems; not a certifiable management standard. |
| NIST AI RMF 1.0 | — | — | ✓ | ~ | ✓ | ~ | — | Voluntary US framework organized into Govern/Map/Measure/Manage with subcategories. Self-attested; no third-party certification. |
| ISO/IEC 42001:2023 | — | ✓ | ✓ | ✓ | ~ | ~ | — | Voluntary but certifiable AI management system standard. Requires documented procedures, internal audits, and continual improvement; certified by accredited bodies. |
| OECD Due Diligence Guidance for Responsible AI | — | — | ~ | ~ | ~ | ~ | — | Voluntary principles-based guidance. Less granular than NIST/ISO; informs policy but carries no certification. |
| AWS (ISO 42001-certified AI services) | — | ✓ | ~ | ~ | ~ | ~ | ✓ | Provider-side ISO/IEC 42001 certification scoped to listed services (e.g. Bedrock, Q Business). Customer inherits partial control coverage; compliance artifacts via Artifact Hub. |
| Google Cloud (ISO 42001-certified AI services) | — | ✓ | ~ | ~ | ~ | ~ | ✓ | Provider-side ISO/IEC 42001 certification scoped to listed services (e.g. Vertex AI, Gemini). Governance features in Model Garden/Vertex; customer remains responsible for use-case obligations. |
| Microsoft Azure (ISO 42001-certified AI services) | — | ✓ | ~ | ~ | ~ | ~ | ✓ | Provider-side ISO/IEC 42001 certification scoped to listed services (e.g. Azure AI Foundry, Security Copilot). Responsible AI dashboard + compliance docs; customer scope still applies. |
This blueprint is a capability and control-surface checklist, not an audit report or certification verdict. We do not publish compliance pass/fail scores, certification status for specific customer organizations, audit findings, or pricing unless we have collected and verified them. Compliance decisions should follow your obligations and a current scope check with each provider and your counsel, not a static ranking.
How to decide
- Start from your obligations, not the frameworks. Identify which regulations bind you (EU AI Act if you place AI on the EU market; sector rules for healthcare, finance, etc.) before choosing a governance framework. A framework that no regulator or customer recognizes adds overhead without proof value.
- Decide attestation vs. internal adoption. If a customer or regulator requires independent attestation, ISO/IEC 42001 certification is the path. If the goal is internal risk practice with no external demand yet, NIST AI RMF is faster and carries no audit overhead. Many enterprises start internal and certify when asked.
- Map inherited controls before relying on them. A cloud provider's ISO 42001 certification covers the provider's management system for listed services — not your use of them. Check the published certification scope, then map inherited controls against your obligations with counsel. Do not assume a certified service certifies your deployment.
- Layer sector rules explicitly. AI governance frameworks do not replace HIPAA, FDA, model-risk, or consumer-protection rules. Map sector obligations first, then add the AI governance layer your regulators and customers recognize. Treat no single framework as sufficient on its own.
Get the deeper compliance framework
We are building a fuller, obligation-driven framework for enterprise AI compliance — EU AI Act article-to-artifact mapping, ISO 42001 control selection, and an inherited-controls checklist for AWS, GCP, and Azure — delivered through the biweekly Gen Alpha AI briefing. No spam, unsubscribe anytime.
Get the framework →Sponsor this coverage
This blueprint sits in high buyer-intent territory — readers are mid-framework-selection on AI governance and compliance. If you build compliance tooling, audit attestation, model-card automation, or AI governance platforms and want to reach these buyers with clearly labeled, editorially independent sponsorship, talk to us. No fabricated audience metrics; we share real analytics with serious sponsors.
View sponsor inventory →Need a compliance decision, not a matrix?
If you are stuck choosing an AI governance framework against real regulatory obligations, sector rules, and customer demands, a focused advisory session can resolve it. Bring your use cases, your regulatory exposure, and your customer attestation demands — we hand you a written, prioritized framework selection and control-mapping recommendation.
Book an advisory session →