What is AI governance and which frameworks to use: NIST, OECD and ISO/IEC 42001

Who is accountable if an AI tool your team uses makes a bad decision? Governing AI means defining who decides, by what criteria and with what evidence. This guide summarizes three public references for doing it and what leadership has to decide.

A note: what we say about each framework comes from the official pages of NIST, the OECD and the IEC (cited at the end, consulted in November 2026). We could not open the standard’s page on iso.org (it returned a 403 error), so for ISO/IEC 42001 we state only what the IEC publishes; the text of the standard is paid and we did not review it. The recommendations on what to decide are Cyrrus’s judgment.

What is AI governance?

In the sources we reviewed we found no single definition, and we do not invent one. What the three frameworks share is putting management rules around the use of AI: NIST speaks of managing risks to individuals, organizations and society; the OECD, of promoting innovative and trustworthy AI; ISO/IEC 42001, of a management system inside the organization. In this article “AI governance” is used in that broad sense (Cyrrus’s judgment).

Which AI governance framework fits your company?

We design your organization’s AI Governance framework: what can be automated, what needs human oversight, and who is accountable for each decision.

• Risk map by use case, not a generic policy
• Defined roles between business, IT, and legal

Learn about AI Governance

NIST AI RMF: a voluntary risk framework

NIST (the U.S. National Institute of Standards and Technology) released version 1.0 of its AI Risk Management Framework on January 26, 2023 (document NIST.AI.100-1). Its official page says the framework is intended for voluntary use, and the document itself describes it as voluntary, rights-preserving, non-sector-specific and use-case agnostic. The page also notes that version 1.0 is being revised as part of the White House AI Action Plan, so check which version is current.

The framework’s core has four functions, per NIST: govern, map, measure and manage. Govern is a cross-cutting function infused throughout AI risk management; map establishes the context to frame the risks of a system; measure uses tools and methods to analyze, assess, benchmark and monitor AI risk; manage allocates resources to the risks already mapped and measured.

The document lists the characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. NIST also published a Generative AI Profile (NIST AI 600-1, July 26, 2024) and a companion Playbook.

OECD principles: shared values for trustworthy AI

According to the OECD page, the principles were adopted in May 2019 and updated in May 2024. The OECD describes them as the first intergovernmental standard on AI. They are five values-based principles: inclusive growth, sustainable development and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability.

The OECD also lists five recommendations for policymakers: investing in AI research and development, fostering an inclusive AI-enabling ecosystem, shaping an interoperable governance and policy environment, building human capacity and preparing for labour-market transition, and international co-operation. For a company, the practical use of the principles is Cyrrus’s judgment: to set the values that an internal policy and a management system then turn into rules.

Before you scale AI, define your limits

We help your leadership team decide what to delegate, what to supervise, and what to never automate — before adoption outruns control.

• Governance committee with business, IT, legal, and security
• Clear criteria for approving new AI use cases

Schedule a conversation about AI Governance

ISO/IEC 42001: a standard for managing AI as a system

The IEC publishes ISO/IEC 42001:2023, “Information technology — Artificial intelligence — Management system”, edition 1.0, dated December 18, 2023, 51 pages, from technical committee ISO/IEC JTC 1/SC 42. According to its listing, it specifies requirements and gives guidance for establishing, implementing, maintaining and continually improving an AI management system within an organization, and it applies to any organization, regardless of size, type and nature, that provides or uses products or services that use AI systems.

To audit and certify against ISO/IEC 42001 there is a companion standard, ISO/IEC 42006, which according to Estonia’s standards body (citing the IEC) sets additional requirements for bodies that audit and certify AI management systems. We go into more detail in our guide to ISO/IEC 42001.

What leadership needs to decide

Four decisions, from Cyrrus’s judgment and not from the cited sources. First, which framework you will use as a reference and for what: managing risks (NIST), setting values (OECD) or certifying a management system (ISO/IEC 42001); they can be combined. Second, who answers for AI in the company. Third, what evidence you will keep of each decision. Fourth, how often you will review all of this.

Going further: what corporate AI governance is from the CEO’s seat, which regulations already apply and how to evaluate governance tools.