There is no single global standard for AI governance. Instead, organisations must navigate a patchwork of frameworks, regulations, and standards, each with different scope, authority, and requirements. For the AIGP exam, you need to know the four most important ones and be able to distinguish between them in scenario-based questions.
This guide covers the NIST AI RMF, EU AI Act, OECD AI Principles, and ISO 42001, with a side-by-side comparison and exam tips for each.
| Framework | Origin | Binding? | Scope | Primary Focus |
|---|---|---|---|---|
| EU AI Act | European Union | Yes (law) | Any AI affecting EU residents | Risk classification and legal compliance |
| NIST AI RMF | United States | Voluntary | Any organisation globally | Risk management process |
| OECD AI Principles | OECD (42 countries) | Voluntary | Governments and organisations | Values-based principles for trustworthy AI |
| ISO 42001 | International (ISO) | Voluntary (certifiable) | Any organisation | AI management system standard |
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law. It classifies AI systems into four risk tiers and imposes legal obligations on providers and deployers based on risk level.
Any organisation placing AI systems on the EU market or using AI in a way that affects EU residents, regardless of where the organisation is headquartered.
Heavily tested. You must know the risk tiers, prohibited practices, high-risk categories, and GPAI model rules. See our full EU AI Act guide.
Published by the US National Institute of Standards and Technology in January 2023, the NIST AI RMF is a voluntary framework that helps organisations identify, assess, and manage AI risks throughout the AI lifecycle. It is widely adopted across sectors globally, not just in the US.
You need to know the four core functions (Govern, Map, Measure, Manage) and the trustworthiness properties. Questions often ask you to identify which function a specific activity belongs to.
Adopted in 2019 and updated in 2024, the OECD AI Principles were the first intergovernmental standard on AI, endorsed by 42 countries. They are values-based principles rather than a compliance framework.
Often tested as a contrast to the EU AI Act. The OECD framework is broader and aspirational; the EU AI Act is specific and legally enforceable. Questions may ask you to identify the primary goal of the OECD framework (balancing harm prevention with fostering innovation).
Published in December 2023, ISO/IEC 42001 is the first international standard for AI management systems (AIMS). Like ISO 27001 for information security, it provides a certifiable framework that organisations can implement and have independently audited.
Know that ISO 42001 is a management system standard (not a technical standard) and that it is certifiable. It is often tested alongside ISO 27001 comparisons and as a contrast to voluntary frameworks.
These frameworks are not mutually exclusive. In practice, a well-governed organisation would typically:
Exam tip: A common question asks which framework a specific activity belongs to. NIST is about process (Govern/Map/Measure/Manage). OECD is about principles. ISO 42001 is about management systems. EU AI Act is about legal compliance and risk classification.
Worth mentioning as a fifth framework that appears in AIGP exam questions. Published by Singapore's IMDA and PDPC, it is a voluntary, practical framework focused on two core principles:
It is most often tested as a contrast to the EU AI Act: Singapore's approach is voluntary and principles-based, while the EU's is mandatory and prescriptive.
Practice with 200 scenario-based AIGP questions covering all governance frameworks. Free, no payment needed.
Start Free Practice Quiz →