Global standards
Global standards
Global standards are not law, but they give you a shared language and evidence that carries across regions. Pick one as the backbone of your program (NIST AI RMF or ISO/IEC 42001), use the crosswalk to reuse one piece of work across frameworks, and use the security references for testing.
For reference purposes only. Not legal advice.
Snapshot
Snapshot
AI-specific binding law?
No (voluntary or non-binding)
Overall approach
Voluntary frameworks, certifiable standards and intergovernmental principles you can use as a backbone for any region.
Main instruments
- NIST AI RMF 1.0 and Generative AI Profile
- ISO/IEC 42001
- OECD AI Principles
- Council of Europe Framework Convention on AI
Main regulators
None. Standards bodies and intergovernmental organizations.
Next key date
Watch: NIST AI RMF revision
Last reviewed 2 Oct 2026.
How to read this page
In plain terms.
Global standards: AI-specific binding law is "No (voluntary or non-binding)". Voluntary frameworks, certifiable standards and intergovernmental principles you can use as a backbone for any region. This page lists 8 main instruments, names the regulators to watch, and ends with questions to put to counsel. Each record carries a certainty label and a review date; treat anything marked Verify or Unsettled as a prompt to check the primary source.
Instruments
What applies, and how firmly.
| Instrument | Type | Status | Applies to | Key duties | Dates |
|---|---|---|---|---|---|
NIST AI RMF 1.0 and Generative AI Profile (NIST AI 600-1)Primary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryFour functions: Govern, Map, Measure, Manage. Voluntary, but customers and regulators often ask about alignment. Not settledNIST AI RMF is being revised; categories may change. Revision status was not checked. | Voluntary framework | Voluntary guidance | Any organization, in any sector | Structuring a risk program (Govern, Map, Measure, Manage). | 1.0 published Jan 2023, being revised; profile published Jul 2024 |
ISO/IEC 42001Primary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryA management system standard you can be audited against. Certification shows a management system is in place; it does not prove any single system is lawful. SimplifiedThis is a short summary. Standards are revised over time and ISO texts are paid; read the source and use your licensed copy. | Management system standard | Voluntary guidance | Organizations that build or use AI | An auditable AI management system. | Published 2023; certifiable |
ISO/IEC 23894Primary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryGuidance on managing risk for AI. SimplifiedThis is a short summary. Standards are revised over time and ISO texts are paid; read the source and use your licensed copy. | Guidance standard | Voluntary guidance | Organizations managing AI risk | AI risk management guidance. | Published 2023 |
ISO/IEC 42005Primary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryGuidance on structuring an AI system impact assessment. Check publication details and edition. Not settledPublication details were not checked. | Guidance standard | Voluntary guidance | Organizations assessing AI system impact | AI system impact assessment. | Published 2025 |
OECD AI PrinciplesPrimary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryA shared baseline of trustworthy-AI values. Non-binding. SimplifiedThis is a short summary. Standards are revised over time and ISO texts are paid; read the source and use your licensed copy. | Intergovernmental principles | Voluntary guidance | Governments and organizations | Values baseline for policy. | Updated 2024 |
Council of Europe Framework Convention on AIPrimary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryA treaty binding on states that ratify it. Check ratification and entry-into-force status. Not settledRatification and entry-into-force status were not checked. | International treaty | Enacted, not yet in force | Signatory states | Human rights, democracy and rule of law baseline for signatory states. | Opened for signature Sept 2024 |
UNESCO Recommendation on the Ethics of AIPrimary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryA non-binding ethics baseline. SimplifiedThis is a short summary. Standards are revised over time and ISO texts are paid; read the source and use your licensed copy. | International recommendation | Voluntary guidance | Member states | Ethics baseline. | Adopted 2021 |
OWASP Top 10 for LLM Applications; MITRE ATLASPrimary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryLiving security references. Check the current versions. Not settledThese are living documents; current versions were not checked. | Security references | Voluntary guidance | Teams building or testing AI systems | Security testing and threat modelling for AI. | Living documents |
Frameworks
Four references, compared.
| Framework | Kind | Binding? | Applies to | Core idea | Where to start |
|---|---|---|---|---|---|
| EU AI ActRegulation (EU) 2024/1689. Amended by the Digital Omnibus on AI.Primary source ↗ SimplifiedA short comparison. Each framework has detail this table leaves out; read the source. | Regulation | Binding in the EU | Providers and deployers placing AI on the EU market, or whose outputs are used in the EU | Risk tiers, with duties that grow as risk rises | Classify each system, then confirm your role |
| NIST AI RMFVersion 1.0 (Jan 2023), being revised. Generative AI Profile published July 2024.Primary source ↗ Not settledNIST AI RMF is being revised; categories may change. | Guidance framework | Voluntary | Any organization, in any sector | Four functions: Govern, Map, Measure, Manage | Govern: policy, roles and accountability |
| ISO/IEC 42001Published 2023.Primary source ↗ SimplifiedA short comparison. Each framework has detail this table leaves out; read the source. | Management system standard | Voluntary, certifiable | Organizations that build or use AI | An AI management system you can be audited against | Run a gap assessment against the standard's clauses |
| OECD AI PrinciplesUpdated 2024.Primary source ↗ SimplifiedA short comparison. Each framework has detail this table leaves out; read the source. | Intergovernmental principles | Non-binding | Governments and organizations | A shared baseline of trustworthy-AI values | Use it as the values section of your AI policy |
Illustrative summaries. See the crosswalk to reuse one piece of evidence across frameworks. Do not rely on this table instead of the standards themselves.
Enforcement
Who enforces what.
NIST (US)
Publishes the AI RMF. Not a regulator.
ISO and IEC
Publish standards. Certification is by accredited certification bodies.
OECD
Intergovernmental principles and the AI Policy Observatory.
Penalty amounts are not stated here because they have not been verified from the primary source.
Actions
What to do now.
Not settled
Watch this.
- NIST AI RMF revision: categories may change. (as of 2 Oct 2026)
- Council of Europe Framework Convention: ratifications and entry into force. (as of 2 Oct 2026)
Official answers
Ask officially.
- NIST AI Resource Center ↗: Official home for the AI RMF.
- OECD.AI Policy Observatory ↗: Policies and principles across countries.
These bodies can give official guidance. ClearPath is for reference only.
Sources
Check the original text.
- NIST AI Risk Management Framework ↗ (NIST)
- ISO/IEC 42001 standard page ↗ (ISO)
- ISO/IEC 23894 standard page ↗ (ISO)
- ISO/IEC 42005 (AI system impact assessment) ↗ (ISO)
- OECD AI Principles ↗ (OECD)
- Council of Europe Framework Convention on AI ↗ (Council of Europe)
- UNESCO Recommendation on the Ethics of AI ↗ (UNESCO)
- OWASP Top 10 for LLM Applications ↗ (OWASP)
- MITRE ATLAS ↗ (MITRE)
- OECD.AI Policy Observatory ↗ (OECD)
- IAPP Global AI Law and Policy Tracker ↗ (IAPP)
FAQ
Do we need ISO/IEC 42001 certification?
No. It is optional, but it gives independent evidence of a working AI management system.
Reviewed 2 Oct 2026.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction