Standards & frameworks
AI governance & digital trust: standards and frameworks, from AI governance standards to AI regulation
AI governance standards give boards, customers and regulators a way to judge whether the AI an organisation builds, buys or uses is controlled. This family covers the certifiable ISO/IEC 42001 management system, the EU AI Act, the NIST AI Risk Management Framework and the supporting ISO/IEC guidance on risk, impact assessment, life cycle and board oversight.
AI governance and digital trust
Who asks for AI governance, and how the pieces connect
Requests in this family rarely start with the technology team. They start with a customer's security questionnaire that now asks how AI features are approved and monitored, a board that wants to know where AI is already making decisions about people, or a product launch into the European market that brings the EU AI Act into scope. Software and SaaS providers, BPO and contact centres using AI in service delivery, financial services firms using models in credit or fraud decisions and healthcare organisations adopting AI tools are the most frequent buyers.
The records here play different roles. ISO/IEC 42001 is the management system standard, and the only one in the family against which an accredited body certifies. The EU AI Act is law: it classifies AI systems by risk and sets duties for providers, deployers and others, with its own conformity procedures and no general certificate. The NIST AI RMF is a voluntary framework organised around Govern, Map, Measure and Manage. ISO/IEC 23894 on AI risk management, ISO/IEC 42005 on AI system impact assessment, ISO/IEC 5338 on AI life cycle processes and ISO/IEC 38507 on governing bodies are guidance that feeds a management system rather than standing alone, while ISO/IEC 42006 sets requirements for the bodies that audit and certify AI management systems. Singapore's Model AI Governance Framework is voluntary guidance from its regulators. A sound approach is one AI inventory, one risk and impact method and one set of controls, with the law and the frameworks mapped onto them. Sterling's consultants build that with your product, data, legal and risk teams through Design™, where we develop and you implement under our advice and supervision, or Drive™, where we design and build under your approval. Effivity, used in 50+ countries, is included at no additional cost. Sterling does not give legal advice on the EU AI Act; classification decisions with legal consequences stay with your counsel.
The catalogue
9 standards, frameworks and schemes in this family
The certifiable standard, the regulation, the voluntary frameworks and the supporting ISO/IEC guidance. Each card opens the page for that record.
- ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
- EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
- NIST AI RMFNIST AI RMF implementation consulting: AI risks governed, mapped, measured and managed across your organisation. NIST certifies no one against the framework.
- ISO/IEC 42005ISO 42005 guidance on AI system impact assessment: what ISO/IEC 42005:2025 covers, its structure, how to put it into practice and how Sterling helps.
- ISO/IEC 23894ISO 23894 AI risk management made practical: the ISO 31000-based guidance, its structure, no certificate, and how Sterling builds it, with a route to ISO 42001.
- ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.
- ISO/IEC 5338ISO/IEC 5338 AI life cycle processes explained: the 2023 process groups, what they ask of AI teams, why there is no certificate and how Sterling helps.
- ISO/IEC 38507ISO 38507 AI governance and requirements explained: the 2022 guidance for boards on AI use, why no certificate exists and how Sterling puts it into practice.
- Singapore Model AI Governance FrameworkSingapore Model AI Governance Framework implementation: IMDA and PDPC guidance, its four areas, GenAI and agentic AI dimensions, AI Verify and Sterling support.
ISO/IEC 42006 also appears in the laboratories, inspection and accreditation family, because it governs certification bodies rather than the organisations they audit. Where a record is a law, the page describes it for orientation; applicability to your systems is a question for your legal counsel.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions buyers ask about AI governance standards
Short answers on where to start, combining requirements and who checks what.
Which AI governance standard or framework should we start with?
If the EU AI Act reaches your systems, its obligations come first because they are law and apply on fixed dates; your legal counsel should confirm your role and each system's risk class. If customers or tenders ask for a certificate, ISO/IEC 42001 is the certifiable route. If you want a structured programme without a certificate, the NIST AI RMF is a practical starting point, and its outcomes carry over into an ISO/IEC 42001 system later.
Can ISO/IEC 42001 be combined with ISO/IEC 27001 or ISO/IEC 27701?
Yes. ISO/IEC 42001 follows the common structure ISO uses for management system standards, so context, leadership, risk, internal audit and management review can be shared with an existing information security or privacy system. The AI-specific parts, such as the AI inventory, impact assessments and AI controls, are added to it. A combined audit is possible where the certification body offers it.
What does a certification body, assessor or regulator check for AI?
For ISO/IEC 42001, an accredited certification body audits the AI management system in two stages and decides on the certificate. Under the EU AI Act, a high-risk system goes through the conformity assessment the Act sets, usually the provider's own internal control, and market surveillance authorities enforce; there is no general AI Act certificate. The NIST AI RMF and the Singapore framework have no certification at all. Sterling prepares the system and the evidence; it does not certify or assess conformity.
Talk to a consultant
Building AI governance customers can check? Talk to a Sterling consultant.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice