AI Governance, Risk, and Compliance · Topic 3 of 3
AI Compliance Frameworks and Corporate AI Policy
Compare the EU AI Act, OECD principles, ISO/IEC 42001 and the NIST AI RMF, and set corporate AI policy on models, sensitive data and data sovereignty.
- 7 min
- The EU AI Act is binding law with four risk tiers and applies to anyone placing AI on the EU market.
- The OECD AI Principles are non-binding values: growth, human rights, transparency, robustness and accountability.
- ISO/IEC 42001 is the certifiable AI management system standard; ISO/IEC 23894 gives risk guidance.
What it is
Compliance for artificial intelligence (AI) means meeting the laws, standards and internal rules that apply to how AI is built and used. Some are binding law, some voluntary frameworks, and some certifiable standards.
Compliance shapes business decisions directly: whether a use case is allowed, which model may be used, where data may be processed and how much testing is needed.
How it works
The four external frameworks
| Framework | Type | Core idea |
|---|---|---|
| European Union (EU) AI Act | Binding regulation | Obligations scale with the risk an AI system poses |
| Organisation for Economic Co-operation and Development (OECD) AI Principles | Intergovernmental, non-binding values | High-level principles for trustworthy AI adopted by many countries |
| International Organization for Standardization (ISO) AI standards | Voluntary standards, some certifiable | Management systems, risk guidance and shared terminology |
| National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF) | Voluntary United States framework | Four functions to manage AI risk across the life cycle |
EU AI Act
The EU AI Act entered into force in 2024, with obligations applying in phases. It reaches beyond Europe: it applies to providers who place AI systems on the EU market and to deployers using them in the EU, wherever those organisations are based.
| Risk tier | Examples | Obligations |
|---|---|---|
| Unacceptable | Social scoring, manipulative techniques that cause significant harm | Prohibited |
| High | AI used in employment decisions, credit scoring, education, critical infrastructure, law enforcement | Risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity, conformity assessment |
| Limited (transparency) | Chatbots, AI-generated or manipulated content such as deepfakes | Tell people they are interacting with AI; label synthetic content |
| Minimal | Spam filters, AI in video games | No specific obligations beyond general duties such as AI literacy |
General-purpose AI models, such as large language models, carry their own duties, including technical documentation and information for downstream providers. The most serious breaches, for prohibited practices, can bring fines of up to 35 million euros or 7% of worldwide annual turnover, whichever is higher.
OECD AI Principles
The OECD principles, adopted in 2019 and updated in 2024, were the first intergovernmental standard on AI. They set five values-based principles:
- Inclusive growth, sustainable development and well-being.
- Respect for the rule of law, human rights and democratic values, including fairness and privacy.
- Transparency and explainability.
- Robustness, security and safety.
- Accountability.
They also make recommendations to governments, and many national laws echo them.
ISO AI standards
ISO publishes its AI standards jointly with the International Electrotechnical Commission (IEC), so they carry the ISO/IEC prefix.
| Standard | Purpose |
|---|---|
| ISO/IEC 42001 | AI management system (AIMS) requirements; an organisation can be certified against it |
| ISO/IEC 23894 | Guidance on AI risk management, building on general risk management practice |
| ISO/IEC 22989 | AI concepts and terminology |
ISO/IEC 42001 works like ISO/IEC 27001 does for information security: policies, roles, risk assessment, controls and continual improvement, verified by external audit.
NIST AI RMF
The NIST AI RMF is voluntary and sector-neutral. It is organised into four functions.
| Function | What it does |
|---|---|
| Govern | Culture, policies, roles and accountability for AI risk; applies across the other three |
| Map | Establish context: purpose, users, impacts and risks of each system |
| Measure | Assess, test and track identified risks with metrics |
| Manage | Prioritise and act on risks: mitigate, transfer, avoid or accept |
A NIST Generative AI Profile applies it to generative AI. The RMF describes trustworthy AI as valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.
Corporate policies
| Policy area | What it decides |
|---|---|
| Sanctioned vs. unsanctioned | Which AI tools are approved; unapproved tools are blocked or monitored |
| Private vs. public models | Whether data may go to a public, shared model service or must stay in a private model hosted by or for the organisation |
| Sensitive data governance | Which data classifications may be used with which models, and with what safeguards |
| Third-party compliance evaluations | Assessing AI vendors: security evidence, certifications, data retention and use of inputs for training |
| Data sovereignty | Data is subject to the laws of the country where it is stored or processed, so hosting regions must match legal needs |
A private model gives more control over data and logs but costs more to run. A public model service is easier to adopt, but its contract must cover retention, training on inputs and location.
Third-party compliance evaluations
When an organization uses an outside AI model, API or platform, it inherits that provider's risks, so it evaluates the provider before and during use:
| Method | What it gives |
|---|---|
| Security and AI questionnaires | The provider's own answers on data handling, model training on customer data, retention and incident response |
| Independent reports and certifications | Evidence from an auditor, such as a SOC 2 report or ISO/IEC 27001 and ISO/IEC 42001 certification |
| Contract terms | Binding commitments: data use limits, data location, breach notification, audit rights and termination |
| Ongoing review | Re-assessment on a schedule or when the provider changes its models or terms |
A provider that will not say whether customer prompts are used to train its models fails the evaluation for sensitive data.
A worked example
A European insurer plans an AI system to help assess job applicants. Under the EU AI Act this is high risk, so the system must meet the high-risk requirements, such as risk management, data governance, documentation, logging and human oversight, before it is used. The vendor as provider and the insurer as deployer each carry their own duties.
The insurer maps and measures risks with the NIST AI RMF, runs the system inside an ISO/IEC 42001 management system, evaluates the vendor, and hosts the model in an EU region for data sovereignty.
How the exam asks about this
- "A company wants an external certification showing it runs a formal management system for its AI. Which of the following should it pursue?" ISO/IEC 42001 certification.
- "A risk team wants a voluntary framework organised into Govern, Map, Measure and Manage functions. Which of the following should it adopt?" The NIST AI RMF.
- "Customer data must not be processed outside the country where it was collected. Which of the following policy considerations applies?" Data sovereignty.
What to remember for the exam
- The EU AI Act is binding law with four risk tiers and applies to anyone placing AI on the EU market.
- The OECD AI Principles are non-binding values: growth, human rights, transparency, robustness and accountability.
- ISO/IEC 42001 is the certifiable AI management system standard; ISO/IEC 23894 gives risk guidance.
- The NIST AI RMF has four functions: Govern, Map, Measure and Manage.
- Corporate policy covers sanctioned tools, private versus public models, sensitive data, vendor evaluations and data sovereignty.
Using a third-party AI service does not transfer your compliance duties. Under most laws the organisation that deploys the system remains responsible, so vendor evaluations and contracts are required controls.
Common mistakes
Calling the NIST AI RMF a certification. It is voluntary guidance; there is no NIST AI RMF certificate. ISO/IEC 42001 is the certifiable standard.
Assuming the EU AI Act affects only EU companies. It applies to providers placing AI on the EU market and to use within the EU, wherever the company is based.
Treating every AI system as high risk. Most systems fall into the minimal or limited tiers; high-risk duties apply to listed sensitive uses.
Check yourself
What are the four risk tiers of the EU AI Act?
Unacceptable (prohibited), high, limited (transparency obligations) and minimal.
Which NIST AI RMF function applies across all the others?
Govern, which sets the culture, policies and accountability for managing AI risk.
What should a third-party compliance evaluation of an AI vendor check?
Its security evidence and certifications, how long it keeps data, where data is processed and whether inputs are used to train its models.
Topic 3 of 3 in AI Governance, Risk, and Compliance
Test yourself on AI Governance, Risk, and Compliance
The full CompTIA SecAI+ CY0-001 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.