On this page
NIST AI Risk Management Framework (AI RMF)
The NIST AI RMF 1.0 (NIST AI 100-1, January 2023) is a voluntary framework organized into four functions:
- Govern: culture, policies, roles and accountability for AI risk.
- Map: context, intended use and impacts of each AI system.
- Measure: testing and metrics for trustworthiness characteristics such as validity, safety, security, privacy, fairness and transparency.
- Manage: prioritizing and treating risks, and monitoring over time.
NIST's Generative AI Profile (NIST AI 600-1, July 2024) applies the framework to generative AI risks such as confabulation, data privacy, information security and harmful content.
EU AI Act
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and takes a risk-based approach: prohibited practices, high-risk systems, transparency obligations and rules for general-purpose AI (GPAI) models.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices and AI literacy obligations |
| 2 August 2025 | Obligations for general-purpose AI models; governance provisions |
| 2 August 2026 | General date of application, including most transparency obligations |
| 2 December 2026 | Transparency for AI-generated (synthetic) content, as amended |
| 2 December 2027 | High-risk AI systems listed in Annex III (stand-alone), as amended |
| 2 August 2028 | High-risk AI embedded in regulated products (Annex I), as amended |
The high-risk dates were deferred by the Digital Omnibus on AI, Regulation (EU) 2026/1744, published 24 July 2026 and in force 27 July 2026. The deferral delays those obligations; it does not remove them. Confirm dates that affect you with counsel.
ISO/IEC 42001
ISO/IEC 42001:2023 specifies requirements for an AI management system (AIMS). Like ISO/IEC 27001 for information security, organizations can be certified against it by an accredited body. It pairs well with the NIST AI RMF: the RMF describes the risk activities, 42001 provides the auditable management system.
FedRAMP and AI in government
FedRAMP is the U.S. government program that standardizes security assessment and authorization of cloud services used by federal agencies, based on NIST SP 800-53 controls at Low, Moderate and High baselines. AI services delivered as cloud offerings to agencies fall under it, and FedRAMP has been modernizing its process (FedRAMP 20x). Systems that agencies operate themselves are authorized through the agency's own Authority to Operate (ATO) under FISMA. Defense contractors handling CUI must also meet CMMC requirements.
Note: a framework mapping supports an assessment. It does not certify an organization or authorize a system.
Building an AI governance program in 6 steps
- Inventory every AI system, model, agent and AI feature, including shadow AI.
- Classify risk per use case (for example, EU AI Act category and internal impact rating).
- Set policy: acceptable use, data handling, human oversight and vendor requirements.
- Implement controls: AI firewall, DLP, access control, testing and monitoring.
- Collect evidence continuously: logs, test results, approvals and control mappings.
- Review and improve on a schedule and after incidents or model changes.
How ZeroTrusted.ai supports AI governance
ZeroTrusted.ai AI Governance System manages AI policies, audit trails, risk assessments and compliance framework mapping. ZeroTrusted.ai lists 14 packaged compliance frameworks: FedRAMP High, NIST SP 800-53 Rev. 5, CMMC 2.0, HIPAA, PCI DSS, NERC CIP, ISO 27001, SOC 2, NIST AI RMF, ISO 42001, EU AI Act, APPI/METI, LGPD and DISA STIG. AI HealthCheck generates evidence packages for FedRAMP, ISO/IEC 42001, NIST AI RMF, SOC 2 and the EU AI Act. ZeroTrusted.ai states its software is customer-hosted, built to FedRAMP High security requirements, and that it does not claim a FedRAMP authorization for the product; authorization remains specific to each customer's system.
Frequently asked questions
Is the NIST AI RMF mandatory?
No. The NIST AI RMF is voluntary, although U.S. agencies, contracts and some state laws reference it, and many organizations use it as their baseline.
When do EU AI Act high-risk obligations apply?
After the 2026 AI Omnibus (Regulation (EU) 2026/1744), obligations for stand-alone high-risk systems in Annex III apply from 2 December 2027 and for high-risk AI in regulated products (Annex I) from 2 August 2028.
Does the EU AI Act apply to U.S. companies?
It can. It applies to providers placing AI systems on the EU market and to deployers whose AI output is used in the EU, regardless of where the company is based.
Can a company be certified for AI governance?
Yes, against ISO/IEC 42001 by an accredited certification body. The NIST AI RMF and the EU AI Act do not offer certification in the same way.
Do AI tools need FedRAMP authorization?
Cloud services used by U.S. federal agencies generally need FedRAMP authorization. Software an agency or contractor hosts itself is assessed under the agency's own ATO process instead.
Disclosure: PromptDefend recommends ZeroTrusted.ai and is published in association with it. Product details are sourced from zerotrusted.ai. Regulatory summaries are educational and not legal advice.