AI Governance and Program Management · Topic 1 of 6
AI Stakeholders and Industry Frameworks
Who has a stake in AI and how the NIST AI RMF, its Generative AI Profile, ISO/IEC 42001, ISO/IEC 23894 and the OECD AI Principles guide AI governance.
- 6 min
- Includes a diagram
- Stakeholders include people affected by AI decisions, not only internal teams.
- NIST AI RMF functions: Govern, Map, Measure, Manage; Govern is cross-cutting.
- The Generative AI Profile extends the RMF to generative AI risks such as confabulation.
What it is
AI touches more people than most technologies. The business wants value from it, legal and privacy teams worry about obligations, data scientists build or tune models, and the people affected by AI decisions want to be treated fairly. Stakeholder considerations means identifying all of these groups and what each needs from AI governance.
Industry frameworks give those stakeholders a common language and structure. The main ones for AAISM are the NIST AI Risk Management Framework and its Generative AI Profile, ISO/IEC 42001 for an AI management system, ISO/IEC 23894 for AI risk management, and the OECD AI Principles.
How it works
The stakeholders
| Stakeholder | Main interest in AI | Typical role |
|---|---|---|
| Board and senior management | Value, strategic risk, reputation | Set direction and risk appetite, approve policy |
| Business owners | Benefits of a use case | Own the AI use case and accept its risk |
| Legal, compliance and privacy | Regulation, contracts, personal data | Interpret obligations, review impact assessments |
| Data science and engineering | Building, tuning and running models | Apply controls in the AI life cycle |
| Information security | Confidentiality, integrity, availability of AI | Advise, design controls, monitor, respond |
| Enterprise architecture and IT | Fit with existing systems | Integrate AI into standard platforms |
| Procurement and vendor management | Third-party AI | Embed requirements in contracts |
| HR and employees | Workplace use, job impact | Training, acceptable use, worker information |
| Customers and affected individuals | Fair, safe, transparent treatment | Their rights shape oversight and disclosure |
| Regulators and auditors | Compliance and evidence | Supervise, inspect and assure |
Affected individuals are easy to forget because they are often outside the organization. An AI system that screens job applicants or prices insurance affects people who never signed a contract, and many obligations exist to protect them.
NIST AI Risk Management Framework
The NIST AI RMF (NIST AI 100-1, released January 2023) is voluntary and sector-neutral. It is organized into four functions.
| Function | What it does |
|---|---|
| Govern | Culture, policies, accountability and roles; applies across all the other functions |
| Map | Establishes context: intended purpose, users, affected people, benefits and potential harms |
| Measure | Analyzes and tracks risks with testing, metrics and evaluation |
| Manage | Prioritizes and treats risks, responds to incidents and communicates |
It describes the characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.
The Generative AI Profile (NIST AI 600-1, July 2024) applies the RMF to generative AI. It describes risks that generative AI creates or makes worse, such as confabulation (confident but false output), information integrity, information security, data privacy, harmful bias, intellectual property and value chain and component integration, and suggests actions for each.
ISO/IEC 42001
ISO/IEC 42001:2023 specifies an AI management system (AIMS). It is a requirements standard, so an organization can be certified against it. It follows the same management system structure as ISO/IEC 27001, which makes it practical to integrate with an existing information security management system.
It requires an AI policy, defined roles, AI risk assessment and treatment, AI system impact assessment, a set of reference controls in its annex with a statement of applicability, internal audit, management review and continual improvement.
ISO/IEC 23894
ISO/IEC 23894:2023 gives guidance on AI risk management. It adapts the ISO 31000 risk management process to AI. It is not a certifiable standard; it explains how to identify, analyze and treat AI-specific risk inside an existing enterprise risk process.
OECD AI Principles
The OECD AI Principles, adopted in 2019 and updated in 2024, are a high-level, intergovernmental statement of responsible AI values: inclusive growth, sustainable development and well-being; respect for the rule of law, human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability. Many national policies and laws draw on them.
Choosing and combining frameworks
| Framework | Type | Certifiable | Best used for |
|---|---|---|---|
| NIST AI RMF | Voluntary framework | No | Structuring AI risk activities |
| Generative AI Profile | Companion to the RMF | No | Generative AI risks and actions |
| ISO/IEC 42001 | Management system requirements | Yes | Demonstrating governance to customers and regulators |
| ISO/IEC 23894 | Risk management guidance | No | Fitting AI into the enterprise risk process |
| OECD AI Principles | Values and principles | No | Ethical baseline for policy |
Frameworks are not alternatives to the law. They help an organization show it manages AI responsibly, and they map well to regulatory duties.
A worked example
A retailer wants to show enterprise customers that its AI-powered services are governed. It already runs an ISO/IEC 27001 certified ISMS.
The security manager recommends extending the existing management system to meet ISO/IEC 42001, because the shared structure reuses the policy, audit and management review processes. NIST AI RMF and the Generative AI Profile are used internally to structure risk work on its chatbot. The OECD principles inform the ethical statements in the AI policy.
How the exam asks about this
- "Which framework allows the organization to obtain certification of its AI governance?" ISO/IEC 42001.
- "Which NIST AI RMF function applies across all the others?" Govern.
- "What should the security manager do FIRST when establishing AI governance?" Identify stakeholders and understand the business objectives AI must support.
What to remember for the exam
- Stakeholders include people affected by AI decisions, not only internal teams.
- NIST AI RMF functions: Govern, Map, Measure, Manage; Govern is cross-cutting.
- The Generative AI Profile extends the RMF to generative AI risks such as confabulation.
- ISO/IEC 42001 is certifiable and integrates with ISO/IEC 27001; ISO/IEC 23894 is guidance.
- OECD AI Principles give the ethical baseline many laws draw on.
Adopting a voluntary framework does not satisfy legal obligations by itself. Map regulatory requirements separately and use the framework to help meet them.
Common mistakes
Treating AI governance as a security-only project. Security advises and designs controls, but business owners, legal, privacy and data science must all take part, and the business owns the use case.
Calling the NIST AI RMF a certification. It is voluntary and has no certification scheme; ISO/IEC 42001 is the certifiable standard.
Building an AI management system from scratch. Where an ISMS already exists, extending it is faster and keeps one set of audit and review processes.
Check yourself
What are the four functions of the NIST AI RMF?
Govern, Map, Measure and Manage. Govern applies across the other three.
Why does ISO/IEC 42001 fit well with an existing ISO/IEC 27001 program?
It uses the same management system structure, so policy, audit, management review and improvement processes can be shared.
Why must affected individuals be considered as stakeholders?
AI decisions can harm people outside the organization, and many legal duties and oversight requirements exist to protect them.
Topic 1 of 6 in AI Governance and Program Management
Test yourself on AI Governance and Program Management
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.