Home / Practices / AI Governance
NIST AI RMF, ISO/IEC 42001, the EU AI Act, CDAO Responsible AI and the COSAiS overlays ask overlapping questions in different vocabularies. We answer them once, against the control baseline you already hold.
Which models are in production. What data trains them. Who approved the deployment. Until those have answers, an AI policy is a document nobody can enforce, and an AI risk register is a guess.
The frameworks converging on this problem ask overlapping questions in different vocabularies. NIST AI RMF wants governance, mapping, measurement and management. ISO/IEC 42001 wants a management system with owners and review cycles. The EU AI Act wants risk classification by use case. CDAO Responsible AI wants testing and operational governance for defense components. AIUC-1 wants evidence an auditor can inspect. Answer the underlying questions once and most of the mapping falls out.
This is the part organizations miss. An AI capability added to an authorized system is not a greenfield governance problem, it is a change inside an existing boundary. NIST COSAiS layers AI-specific security and testing requirements onto the SP 800-53 control families already in your baseline. OMB M-25-21 creates obligations for agency use cases. A model added to a system under a DoD Impact Level inherits that system's accreditation constraints.
Governance that ignores the compliance program you already run produces a second set of artifacts nobody reconciles. We build the AI program so it lands inside the one you have.
Frameworks
Which one governs you is a function of your market and your customers, not of what a consultancy prefers to sell. Most organizations need more than one, and the overlap is larger than it looks.
The common foundation
Commercial and international
Agencies and their suppliers
Agentic systems facing audit
Overlap
The frameworks disagree on vocabulary far more than they disagree on substance. Evidence gathered once can satisfy several of them, if it is gathered with that in mind.
| What you produce | What it satisfies |
|---|---|
| AI inventory | AI RMF Map, ISO/IEC 42001 scope definition, EU AI Act risk classification, and the system component list your assessor already expects. |
| Model risk assessment | AI RMF Measure, CDAO Responsible AI testing requirements, and the risk assessment control family in your existing baseline. |
| Approval and oversight records | AI RMF Govern, ISO/IEC 42001 management review, AIUC-1 accountability evidence, and change control inside your authorization boundary. |
| Adversarial test results | COSAiS testing expectations, AIUC-1 safety and security evidence, and the assessment artifacts required at your impact level. |
| Supply chain records | Third-party model and training data provenance for AI RMF, ISO/IEC 42001 supplier controls, and SP 800-161 supply chain requirements. |
Next step
It starts with a gap analysis at no cost, and a scoped proposal follows.
