---
title: Standards at a glance
description: "A side-by-side comparison of the AI governance standards tracked here — NIST AI RMF, EU AI Act, ISO/IEC 42001 & 23894, DORA, the UK approach, Switzerland (DSG/EDÖB), the Council of Europe AI Convention (CETS 225), CSA Agentic Profile and Berkeley CLTC: type, binding vs voluntary, jurisdiction, status and what each governs."
keywords: "AI governance standards comparison, EU AI Act vs NIST AI RMF, ISO 42001 vs 23894, binding vs voluntary AI standards, DORA, AI compliance overview"
---

# Standards at a glance

A one-screen comparison of everything tracked in this library. Use it to decide
*which* standard applies to a given concern, then open the standard's page for
detail. Plain-language explanations and audit checklists live on each page.

| Standard | Type | Binding? | Body / jurisdiction | Current status | What it governs |
| -------- | ---- | -------- | ------------------- | -------------- | --------------- |
| [NIST AI RMF](reference_nist_ai_rmf.md "NIST's voluntary AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1, Jan 2023). Organises AI risk into four continuous functions — GOVERN, MAP, MEASURE, MANAGE — around a set of trustworthy-AI characteristics. Its Generative AI Profile (NIST AI 600-1, 2024) adds twelve GenAI-specific risks. The shared vocabulary most other AI-risk frameworks borrow; voluntary and not certifiable.") | Voluntary framework | No | NIST · USA | RMF 1.0 (2023) + GenAI Profile (2024) | AI risk across the lifecycle (GOVERN · MAP · MEASURE · MANAGE) |
| [ISO/IEC 42001](reference_iso_42001.md "ISO/IEC 42001:2023 — the world's first certifiable AI Management System (AIMS) standard. Like ISO 27001/9001 it uses the Annex SL structure (clauses 4–10) and certifies how your organisation governs AI — policy, roles, risk assessment, Annex A controls and a Statement of Applicability — not a single model. Certification is voluntary, typically valid three years with annual surveillance audits, and maps cleanly to the EU AI Act's Art. 17 quality-management expectation.") | Management-system standard | Voluntary, **certifiable** | ISO/IEC · international | 2023, current | How your *organisation* runs AI responsibly (an AIMS) |
| [ISO/IEC 23894](reference_iso_23894.md "ISO/IEC 23894:2023 — guidance (not certifiable) on managing AI-specific risk across the whole lifecycle. It reuses the general ISO 31000 risk process — establish context, identify, analyse, evaluate, treat, monitor and communicate — and adds AI-specific risk sources such as bias, model opacity, drift, autonomy and adversarial attack. The 'how-to' companion to ISO/IEC 42001's requirement that you manage AI risk.") | Guidance standard | No (guidance) | ISO/IEC · international | 2023, current | *How* to manage AI risk (companion to ISO 31000) |
| [EU AI Act](reference_eu_ai_act.md "Regulation (EU) 2024/1689 — the first comprehensive, binding AI law. It classifies AI systems by risk — unacceptable (prohibited), high-risk, limited-risk (transparency) and minimal — with obligations scaled to each tier, plus separate rules for general-purpose AI (GPAI) models. In force since 1 Aug 2024 and applying in phases; the Digital Omnibus (Reg. (EU) 2026/1744, in force since 27 Jul 2026) deferred the high-risk regime to Dec 2027 / Aug 2028. Carries hard legal obligations and penalties.") | Regulation (law) | **Yes** | EU | Reg. 2024/1689, amended by Reg. 2026/1744 — high-risk deferred to 2027/28 | Risk-tiered obligations on AI systems + GPAI models |
| [DORA](reference_dora.md "Digital Operational Resilience Act (Regulation (EU) 2022/2554) — binding on the EU financial sector since 17 Jan 2025. Five pillars: ICT risk management, incident reporting, digital operational resilience testing (incl. threat-led penetration testing), ICT third-party risk with direct EU oversight of providers deemed critical, and information sharing. For AI it is the operational-resilience anchor for model-provider outages, breaches and vendor-concentration risk in regulated finance.") | Regulation (law) | **Yes** | EU · financial sector | Reg. 2022/2554; applies since 2025-01-17 | Digital operational resilience; ICT & third-party risk |
| [Switzerland — DSG / EDÖB / CETS 225](reference_ch_ai_data_protection.md "Switzerland has no AI act. The technology-neutral Federal Act on Data Protection (DSG, in force since 1 Sep 2023) is applied directly to AI by the EDÖB (notice of 9 Nov 2023, updated 8 May 2025): transparency, automated individual decisions, DPIA for high-risk processing, privacy by design. The Federal Council decided on 12 Feb 2025 on a sectoral approach and the ratification of the Council of Europe AI Convention (CETS 225, signed 27 Mar 2025, not in force); a consultation draft is due by the end of 2026.") | Data-protection statute (binding) + political mandate (CETS 225 path) | **DSG: yes** · Convention: not yet | Switzerland (federal) · Council of Europe | DSG consolidated 2025-07-07; CETS 225 signed, not in force; consultation draft due end 2026 | Personal data in AI processing today; AI-specific rules in preparation |
| [Council of Europe AI Convention (CETS 225)](reference_coe_ai_convention.md "The Council of Europe Framework Convention on AI and Human Rights, Democracy and the Rule of Law — the first binding international AI treaty, adopted 17 May 2024 and opened for signature in Vilnius on 5 Sep 2024. A framework convention: it obliges states to adopt or maintain measures (transparency, accountability, non-discrimination, remedies, risk and impact management, independent oversight); it does not regulate companies directly. Entry into force needs five ratifications incl. three CoE member states — as of 5 Sep 2026 there is one (the EU, 15 May 2026). The EU implements it through the AI Act; Switzerland via sector laws; the UK has signed only.") | International treaty (framework convention) | **Not yet** — not in force; binds states once ratified | Council of Europe (46 member states + EU + drafting non-member states) | 21 signatures, 1 ratification as of 2026-09-05; not in force | State duties on AI and human rights, democracy, rule of law; implemented through domestic law |
| [UK AI White Paper](reference_uk_ai_white_paper.md "The UK's 'pro-innovation', principles-based, sector-led model (2023 White Paper CP 815 + Feb 2024 response). There is no single UK AI law: existing regulators (ICO, FCA, CMA, Ofcom, MHRA) apply five cross-cutting principles — safety/security/robustness; transparency & explainability; fairness; accountability & governance; contestability & redress — within their own remits. Evolving toward experimentation via the DSIT AI Growth Lab sandboxes (2025–26).") | Policy framework | No (principles, sector-led) | United Kingdom | 2023 White Paper + 2024 response | Five cross-cutting principles applied by existing regulators |
| [CSA Agentic Profile](reference_csa_agentic_profile.md "Cloud Security Alliance's draft profile extending the NIST AI RMF's four functions to agentic AI — systems that plan, call tools, hold memory and act autonomously. Its agentic codes AG-GV / AG-MP / AG-MS / AG-MG address failure modes ordinary model controls miss: goal drift, tool misuse, privilege escalation, memory/context poisoning and cascading multi-agent effects. Plugs into CSA's AI Controls Matrix (AICM); a draft (v1), so identifiers may still change.") | Profile (draft) | No (voluntary) | Cloud Security Alliance | Lab Space draft v1 (early 2026) | Agentic-AI extension of the NIST AI RMF |
| [Berkeley CLTC](reference_berkeley_cltc.md "UC Berkeley Center for Long-Term Cybersecurity (AI Security Initiative) — the 'red lines' research layer of AI governance. It defines concrete intolerable-risk thresholds and, in its 2026 cyber-threat work, a Bayesian-network method to judge when an AI model's 'cyber uplift' (how much it lowers the cost/skill of an attack) crosses a dangerous line. Policy- and research-facing, not a compliance standard — useful for testing a deployer's risk appetite and ad-hoc risk acceptance.") | Research / thresholds | No (research) | UC Berkeley | White papers 2025–2026 | "Intolerable-risk" and AI-enabled cyber-threat thresholds |
| [NIST ITL Standards Landscape](reference_nist_itl_landscape.md "Not a standard but NIST's Information Technology Laboratory map of the whole AI-standards field — which bodies (ISO/IEC JTC 1/SC 42, IEEE, CEN-CENELEC, NIST) are publishing what, how the pieces relate, and where the gaps are. Tracked here as an early-warning radar: new standards, profiles and evaluation methods usually surface in this landscape view before they are widely known, signalling what to add to the library next.") | Meta-source / inventory | — | NIST | Ongoing (2026 briefing) | A map of the global AI standards landscape |

## How to read this

- **Binding law** (EU AI Act, DORA) carries hard obligations and penalties. The
  others are **voluntary** — but they are how you *demonstrate* you meet the law,
  and clients and regulators increasingly expect them.
- **Management system vs framework vs guidance:** ISO/IEC 42001 certifies the
  *organisation*; NIST AI RMF gives the risk *vocabulary*; ISO/IEC 23894 gives
  the *how-to*. Most programmes use all three together.
- **One control set, many standards:** in practice you map a single set of
  controls (risk classification, model cards, oversight, monitoring) onto
  whichever standards apply — see each page's *Cross-Framework Mapping*.

!!! note "Scope & disclaimer"
    This comparison tracks **metadata and structure**, not the standards' full
    text. It is general information, **not legal advice**; confirm against each
    primary source (linked on every page).