What are the main AI governance standards?

ISO/IEC 42001:2023 is a certifiable AI management system standard. The NIST AI Risk Management Framework 1.0 is a voluntary framework organized around Govern, Map, Measure and Manage. The EU AI Act is a regulation that sets obligations by risk tier for AI systems placed on the market or put into service in the EU, used by deployers in the EU, or whose output is used in the EU. Keel ships all three. The NIST AI RMF is modeled to every subcategory of its Core. ISO/IEC 42001 is modeled across clauses 4 to 10 and every Annex A control, at the depth its framework page states. The EU AI Act is modeled by risk tier, together with the Chapter I provisions that bind every provider and deployer, and its framework page says what that covers. Keel also ships AI Governance Essentials, its own free baseline, for teams that are not ready to pick a standard.

Does the EU AI Act require ISO 42001 certification?

No. An AI management system built to ISO/IEC 42001 can organize much of the same work, such as risk assessment, oversight and record-keeping, but certification does not by itself show that a system meets the Act. You still need to assess your role and use case under the Act itself.

Where should a company with no AI governance program start?

With an inventory of the AI it builds and uses, and then a baseline. In Keel that means the AI services register and AI Governance Essentials, which is free on every plan. When a customer or regulator asks for a named standard, add ISO/IEC 42001, the NIST AI RMF or the EU AI Act, and the crosswalk shows which of your existing controls already count toward it.

Can Keel certify us against ISO 42001?

No. ISO/IEC 42001 certification comes from a certification body. Keel is where you run the program and keep the evidence that body reviews, and your auditor can have a free seat.

AI Governance

Where to start with AI governance standards

AI moved into your product and your customers’ questionnaires faster than any framework did. Keel gives you a free starting point today, and a path to the formal AI governance standards when a customer, a board, or a regulator asks.

Start free with AI Governance Essentials

AI governance in Keel: ISO 42001, the NIST AI RMF, and the EU AI Act

Free on every plan

Start with AI Governance Essentials

A Keel-authored baseline of 25+ plain-language expectations covering governance, risk and impact, data, transparency, human oversight, security, lifecycle, and third parties. Put it in place, evidence it, and you already have a running start on the formal standards below.

See what AI Governance Essentials covers →

The AI governance shelf

One control library underneath all of them, so the work you do for one counts toward the others.

What an AI governance program needs to show

Start with an inventory of the AI systems your organization builds or uses, so you know the program’s scope before you choose a standard. For each system, name an owner and record its purpose, data sources, the people it affects, and where a human reviews consequential outputs.

Assess each system’s risks from design and testing through deployment, monitoring, and retirement. Keep each assessment with the decision it led to and its evidence, so a reviewer can see what changed and why. Each AI ethics principle you adopt needs a specific check and a named person accountable for it.

Use the NIST AI RMF to organize risk work, ISO/IEC 42001 when you need an AI management system, and the EU AI Act when its obligations apply to your role and use case. Keel’s crosswalk shows which work counts toward more than one of them. A mapping does not replace a legal assessment or an independent certification audit.

How they fit together

AI Governance Essentials (free) is the on-ramp: prove you have responsible-AI basics in place, evidence them, and reuse that evidence everywhere.
ISO/IEC 42001 is the certifiable management system when you need an audited program, the AI companion to ISO 27001.
NIST AI RMF is the voluntary US reference: Govern, Map, Measure, Manage, flexible and public-domain.
EU AI Act is the law if you serve the EU: it tells you which risk tier your AI falls into and what that triggers.

See how much these overlap in the crosswalk explorer →

Read the analysis: how much do the three AI regimes actually overlap? →

How Keel supports the work

The AI services register is where the inventory lives. For each AI system or service your organization uses, record the vendor, its purpose, the categories of data it processes, an owner, a risk tier (prohibited, high-risk, limited or minimal) and an approval status of approved, under review, rejected or retired. Filter it by tier to see the high-risk entries first.

Much AI risk arrives through suppliers. Keel’s AI vendor assessment template asks a model or AI service provider whether your data trains shared models, which third-party models the service relies on, how outputs are overseen, how the system is tested for accuracy and bias, and whether data stays in agreed regions. Replies are scored automatically, and a provider that trains shared models on customer data scores as higher risk.

AI risks go in the same risk register as the rest of your program, scored on likelihood and impact with an owner and a treatment, and linked to the controls that reduce them. When a customer sends an AI security questionnaire, Keel can draft the answers from those controls and your policies on any paid plan, and you approve each one before it goes back.

Questions about AI governance standards

What are the main AI governance standards?: ISO/IEC 42001:2023 is a certifiable AI management system standard. The NIST AI Risk Management Framework 1.0 is a voluntary framework organized around Govern, Map, Measure and Manage. The EU AI Act is a regulation that sets obligations by risk tier for AI systems placed on the market or put into service in the EU, used by deployers in the EU, or whose output is used in the EU. Keel ships all three. The NIST AI RMF is modeled to every subcategory of its Core. ISO/IEC 42001 is modeled across clauses 4 to 10 and every Annex A control, at the depth its framework page states. The EU AI Act is modeled by risk tier, together with the Chapter I provisions that bind every provider and deployer, and its framework page says what that covers. Keel also ships AI Governance Essentials, its own free baseline, for teams that are not ready to pick a standard.
Does the EU AI Act require ISO 42001 certification?: No. An AI management system built to ISO/IEC 42001 can organize much of the same work, such as risk assessment, oversight and record-keeping, but certification does not by itself show that a system meets the Act. You still need to assess your role and use case under the Act itself.
Where should a company with no AI governance program start?: With an inventory of the AI it builds and uses, and then a baseline. In Keel that means the AI services register and AI Governance Essentials, which is free on every plan. When a customer or regulator asks for a named standard, add ISO/IEC 42001, the NIST AI RMF or the EU AI Act, and the crosswalk shows which of your existing controls already count toward it.
Can Keel certify us against ISO 42001?: No. ISO/IEC 42001 certification comes from a certification body. Keel is where you run the program and keep the evidence that body reviews, and your auditor can have a free seat.