Organizations do not need to design their AI governance frameworks from scratch. A set of mature, internationally recognized frameworks and standards provides a solid starting point.
The following is a practical reference guide.
| Framework / Standard | Issuing Body | Type | Primary Use |
| NIST AI RMF 1.0 | NIST (U.S.) | Voluntary | Comprehensive AI risk management across the lifecycle |
| NIST AI 600-1 (GenAI Profile) | NIST (U.S.) | Voluntary | Risk management specific to generative AI |
| ISO/IEC 42001:2023 | ISO/IEC | Certifiable standard | AI management system for organizations |
| ISO/IEC 23894:2023 | ISO/IEC | Guidance | AI-specific risk management process integration |
| IEEE 7000 series | IEEE | Standard | Ethical value-based design of AI and autonomous systems |
| OECD AI Principles | OECD | International principles | Policy baseline for responsible AI across 40+ countries |
| Singapore AI Verify | IMDA / AI Verify Foundation | Voluntary testing toolkit | Technical testing of AI systems against governance principles |
| GPAI (Global Partnership on AI) | OECD-hosted | International initiative | Responsible AI research, working groups, policy guidance |
NIST AI RMF 1.0 and GenAI Profile
The NIST AI Risk Management Framework, released January 26, 2023, organizes AI risk management into four functions: Govern (establishing policies, roles, and culture), Map (categorizing AI systems and their contexts of use), Measure (analyzing and assessing risks), and Manage (prioritizing and treating identified risks). It is non-prescriptive and sector-agnostic, designed to be adapted to any organizational context. The companion NIST AI RMF Playbook provides implementation guidance. The Colorado AI Act creates a safe harbour for organizations that implement the NIST AI RMF.
The NIST AI 600-1 Generative AI Profile (July 2024) extends the framework to address unique risks from large language models and generative AI systems, including confabulation (hallucination), dangerous content generation, intellectual property infringement, and data privacy violations.
ISO/IEC 42001:2023
ISO/IEC 42001 is the world’s first certifiable AI management system standard. It follows the same “Plan-Do-Check-Act” structure as ISO 9001 (quality management) and ISO 27001 (information security management), making it familiar to organizations that already hold management system certifications. It covers AI policy, organizational roles, AI system impact assessment, risk treatment, supplier management, and continual improvement. Organizations that achieve ISO/IEC 42001 certification can demonstrate to regulators, customers, and partners that their AI governance meets an internationally audited standard.
ISO/IEC 23894:2023
ISO/IEC 23894 provides guidance specifically on how organizations can manage risk related to AI, and how to integrate AI risk management into broader organizational risk management processes. It is a companion to ISO/IEC 42001 rather than a standalone certification standard.
IEEE 7000 Series
The IEEE 7000 series addresses the ethical design of autonomous and intelligent systems. IEEE 7000 (approved June 2021) is the first standard guiding developers on how to build products and services that are compatible with the ethical values of the communities in which they operate. It establishes four primary processes: concept of operations and context exploration; value elicitation and prioritization; ethical value requirements identification; and risk-based design. IEEE P2863 specifically addresses organizational governance of AI, specifying criteria including safety, transparency, accountability, responsibility, and bias minimization.
OECD AI Principles
The OECD AI Principles, updated in 2024 and adopted by more than 40 countries, remain the broadest international policy consensus on responsible AI. They call for AI that is inclusive growth-oriented, human-centred and trustworthy, transparent and explainable, robust secure and safe, and accountable. They underpin many national regulatory frameworks, including Canada’s Voluntary Code of Conduct and the EU AI Act.
Global Partnership on AI (GPAI)
The Global Partnership on Artificial Intelligence was proposed by Canada and France at the 2018 G7 Summit, launched in June 2020 with 15 founding members, and merged with the OECD’s AI policy work in 2024. Now integrated into the OECD framework, it brings together 29 member countries – including Canada, the US, the UK, France, Germany, Japan, and Singapore – to advance human-centric, responsible AI through research, working groups, and policy guidance. Canada was the inaugural GPAI president in 2020.
Singapore AI Verify
AI Verify is a voluntary AI governance testing framework developed by Singapore’s IMDA and AI Verify Foundation. It allows organizations to test AI systems against 11 internationally recognized governance principles and produce a standardized governance report. AI Verify is available to organizations globally and is particularly useful for organizations seeking to demonstrate responsible AI practices to clients, regulators, or partners in a structured, auditable format.
