The Standards Landscape Explained

There is no single AI rulebook. What exists is a patchwork of two different kinds of instrument: voluntary standards and frameworks you choose to adopt, and binding regulations you must obey where they apply. The difference matters. A standard such as ISO/IEC 42001 is something you opt into and can be certified against; a regulation such as the EU AI Act applies whether you opt in or not, with penalties attached. The practical task is not to memorize all of them but to know which actually bite where you operate, and how they line up.

That patchwork is exactly what an assurance program has to satisfy and what insurance underwriting maps to, which is why it sits in the Learn section rather than buried in a directory. This page explains the major instruments; the Landscape maps the full set by region.

The certifiable standard: ISO/IEC 42001

Published in December 2023, ISO/IEC 42001 is the first certifiable international standard for managing AI. It specifies an AI management system, the organizational machinery for governing AI across its lifecycle, in the same way ISO 27001 specifies one for information security. Because it can be independently audited and certified, it is often compared to SOC 2 for security: a credential that can stand as shorthand for “this organization governs its AI properly.” Early certified organizations include IBM, Anthropic, Microsoft, KPMG, and Changi Airport. A companion standard, ISO/IEC 42006, published in July 2025, sets the requirements for the bodies that audit and certify against it. For most organizations, this is the natural anchor for an assurance program. One limit to note: in the EU, ISO/IEC 42001 certification does not by itself give a presumption of conformity with the AI Act; that role falls to harmonized European standards such as EN 18286 (below).

The dominant framework: NIST AI RMF

The NIST AI Risk Management Framework, released in the United States in January 2023, is voluntary but widely used as the shared vocabulary for AI risk. Its functions, govern, map, measure, and manage, give teams a common language, and a Generative AI Profile added in 2024 extended it to generative systems. Version 1.0 is still current, but NIST says it is being revised under the White House AI Action Plan, and in April 2026 it released a concept note for a profile on trustworthy AI in critical infrastructure. It carries no penalties of its own, but state law has started to lean on it: under Texas’s Responsible Artificial Intelligence Governance Act, substantial compliance with the NIST Generative AI Profile or another recognized framework supports a defense.

The binding regulation: the EU AI Act

The EU AI Act is the world’s first binding, horizontal AI law, in force since August 2024 and applying in stages by risk level. Its early milestones have already landed: prohibited practices and AI literacy obligations from February 2025, obligations for general-purpose AI models from August 2025, and the Article 50 transparency obligations (telling people they are dealing with an AI system, marking synthetic content in machine-readable form, and disclosing deep fakes) from 2 August 2026.

The later and more demanding milestones were reshaped by a reform package known as the Digital Omnibus on AI. After the European Parliament’s final vote on 16 June 2026 and adoption by the Council, it was signed on 8 July 2026 as Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. It defers the high-risk obligations for Annex III stand-alone systems to 2 December 2027 and those for AI in regulated products (Annex I) to 2 August 2028. It gives generative systems already on the market before 2 August 2026 until 2 December 2026 to meet the duty to mark AI-generated content, and it adds new prohibitions on AI systems that generate non-consensual intimate material or child sexual abuse material, applying from 2 December 2026.

The Act also now has a layer of supporting instruments. The Commission has published a voluntary General-Purpose AI Code of Practice (July 2025), a voluntary Code of Practice on marking and labelling AI-generated content (June 2026), and guidelines on the Article 50 transparency obligations (July 2026). On the standards side, EN 18286 on quality management systems, which the European Commission describes as the first harmonized standard supporting the Act, developed by CEN-CENELEC’s joint technical committee JTC 21, was cited in the Official Journal by Commission Implementing Decision (EU) 2026/2274 of 12 October 2026. Providers of high-risk systems that follow it get a presumption of conformity with the Act’s quality management requirement; the other requested standards, covering areas such as risk management, data governance, logging and cybersecurity, were still being drafted.

Editor’s note: EU AI Act dates verified 3 November 2026 against the text of the Digital Omnibus on AI adopted by the European Parliament on 16 June 2026 (Council document 10599/26), which corresponds to the final act, Regulation (EU) 2026/1744, and against EUR-Lex metadata and Commission guidance. The Official Journal text itself was not checked. Further implementing acts, guidelines and harmonized standards are expected; check the Commission’s AI Act pages for the latest.

The gap: the withdrawn AI Liability Directive

Alongside the Act, the EU had proposed an AI Liability Directive that would have eased the burden of proving causation when a high-risk AI system caused harm, through a rebuttable presumption of causation. The Commission withdrew that proposal in October 2025, and the European Parliament’s Legislative Train page (last updated September 2026) lists no replacement proposal. The practical effect is that, even as the EU regulates how AI may be built and deployed, the question of who is liable when it causes harm remains governed by existing national law rather than a harmonized AI-specific regime.

The regional patchwork

Outside the EU the picture is mixed. Most jurisdictions still prefer guidance and frameworks to binding AI statutes, but binding AI laws are now in force in South Korea and in several US states.

• United States, federal. There is no comprehensive federal AI statute. Executive Order 14365 of 11 December 2025, “Ensuring a National Policy Framework for Artificial Intelligence,” pursues a single national approach and sets up an AI Litigation Task Force under the Attorney General to challenge state AI laws the administration considers inconsistent with it.
• United States, states. California’s Transparency in Frontier Artificial Intelligence Act (SB 53), signed in September 2025 and in force since 1 January 2026, requires large frontier developers to publish safety frameworks and report critical safety incidents. Texas’s Responsible Artificial Intelligence Governance Act took effect on 1 January 2026, with exclusive Attorney General enforcement. New York’s RAISE Act, signed in December 2025 and amended by a chapter amendment signed in March 2026, adds frontier-model safety frameworks, 72-hour reporting of critical safety incidents and a new oversight office in the Department of Financial Services, and takes effect on 1 January 2027. Colorado repealed and reenacted its 2024 AI Act in May 2026 as an automated decision-making technology law (SB 26-189) that takes effect on 1 January 2027; the Attorney General held its rulemaking hearing in October 2026.
• United Kingdom. A principles-led, regulator-by-regulator “pro-innovation” approach rather than a single AI Act. In October 2025 the government published a regulation blueprint centered on an AI Growth Lab of supervised sandboxes, and the King’s Speech of 13 May 2026 announced a Regulating for Growth Bill with sandboxing powers, including for AI, but no standalone AI bill. There is no binding AI law as of November 2026.
• Singapore. AI Verify, a voluntary governance testing framework and open-source toolkit combining technical tests and process checks, extended to generative AI in 2025. In January 2026 IMDA added a Model AI Governance Framework for Agentic AI, updated in May 2026, covering risk assessment, human accountability and technical controls for AI agents.
• South Korea. The AI Basic Act (Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust) took effect with its Enforcement Decree on 22 January 2026, imposing risk management and oversight duties for “high-impact” AI, notice and labeling duties for generative AI, and a local-representative requirement for large foreign operators. According to the US International Trade Administration, fines are generally deferred during a grace period of at least a year.
• Japan. The AI Promotion Act, fully in force since 1 September 2025, is a promotion-focused framework law without monetary penalties. It created an AI Strategic Headquarters chaired by the Prime Minister, and the first AI Basic Plan was adopted by Cabinet on 23 December 2025.
• China. Alongside its other AI rules, the Measures for Labeling AI-Generated and Synthetic Content, in force since 1 September 2025 with a companion mandatory national standard, require visible and metadata labels on AI-generated content.
• Australia. The National AI Centre’s Guidance for AI Adoption, released in October 2025 with six essential practices (the “AI6”), replaced the earlier Voluntary AI Safety Standard. The 2024 mandatory-guardrails proposal was not legislated. On 15 July 2026 the Prime Minister announced Australian Standards for AI, expected to be legislated in early 2027, and a new Office of AI in the Department of the Prime Minister and Cabinet. The standards announced so far focus on large data centers (energy, water and location), AI training and creative works rather than on how organizations govern AI. On 26 August 2026 First Ministers agreed that AI is a generational opportunity and that large data centers have energy, water and land-use impacts that need managing; the national AI laws and standards remain the Commonwealth’s own undertaking, which it intends to legislate in early 2027. The Guidance for AI Adoption remains voluntary.
• Australia, prudential. APRA’s CPS 230 operational risk standard, effective 1 July 2025, does not name AI but captures it as operational and material service-provider risk. APRA’s April 2026 letter to industry on AI spells out its expectations under existing standards: board AI literacy, AI inventories, controls over agentic workflows, mapping of AI supply chains, and continuous assurance.
• New Zealand. The Privacy Act 2020 governs AI that handles personal data, the voluntary Algorithm Charter covers public-sector use, and the national AI strategy “Investing with Confidence” (July 2025) sets an adoption-focused, light-touch and principles-based direction that relies on existing law rather than a new prescriptive regime.

At a glance

Instrument	Type	Where	Status
ISO/IEC 42001	Certifiable standard	Global	Published Dec 2023
NIST AI RMF	Voluntary framework	US	Active; GenAI Profile 2024; revision under way
EU AI Act	Binding regulation	EU	In force; transparency from Aug 2026; high-risk Dec 2027 and Aug 2028
Digital Omnibus on AI	Amending regulation	EU	In force 27 Jul 2026
EN 18286	Harmonized standard	EU	Cited in Official Journal Oct 2026
EU AI Liability Directive	Proposed regulation	EU	Withdrawn Oct 2025
California SB 53	Binding state law	US	In force 1 Jan 2026
Texas TRAIGA	Binding state law	US	In force 1 Jan 2026
New York RAISE Act	Binding state law	US	Effective 1 Jan 2027
Colorado SB 26-189	Binding state law	US	Effective 1 Jan 2027
UK approach	Non-statutory guidance	UK	Active; no binding Act
AI Verify	Voluntary framework	Singapore	Active
Korea AI Basic Act	Binding regulation	South Korea	In force 22 Jan 2026
Japan AI Promotion Act	Framework law, no penalties	Japan	In force Sep 2025
AI content labeling measures	Binding regulation	China	In force 1 Sep 2025
Guidance for AI Adoption (AI6)	Voluntary guidance	Australia	Released Oct 2025; voluntary
APRA CPS 230	Binding prudential standard	Australia	Effective 1 Jul 2025
NZ AI Strategy	Non-prescriptive strategy	New Zealand	Released Jul 2025

How to use them

The instruments are not alternatives to choose between; they layer. A workable approach for most organizations is to anchor on ISO/IEC 42001 because it is certifiable and globally recognized, use the NIST AI RMF for shared vocabulary and structure, and then, for each market you operate in, add the binding rule that applies: the EU AI Act (and its harmonized standards) in Europe, the AI Basic Act in South Korea, the relevant state laws in the United States, APRA’s standards and expectations for Australian prudential entities, and so on. Doing that well also bears on insurability: the same evidence that demonstrates compliance is the kind of evidence underwriters can use when assessing AI risk.

Standards and regulation set the baseline that the rest of this reference builds on. The controls that satisfy them are covered in What Is AI Assurance?, the cover that sits on top in What Is AI Insurance?, and the way regulatory exposure fits the broader picture in The AI Risk Stack.