Two widely referenced frameworks for managing AI responsibly. ISO/IEC 42001 is a certifiable management system standard, similar in shape to the information security standard many organisations already hold. The framework published by the United States National Institute of Standards and Technology (‘NIST’) is voluntary guidance rather than a certification. Neither tells you whether a particular model is any good; both give you a defensible way of governing how you use them.
Technical view
ISO 42001 specifies requirements for an AI management system covering policy, roles, risk assessment, impact assessment, lifecycle controls and continual improvement, and it maps reasonably onto existing ISO 27001 processes. The NIST framework organises practice into four functions, govern, map, measure and manage, with a companion profile for generative AI. Both are process standards: they evidence that risks were identified and handled, which is increasingly what regulators, insurers and enterprise customers ask to see.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.