0.2 The Standards This Course Uses

Introduction

This course is built on international standards. Two of them form its core: ISO/IEC 42001, which specifies an AI management system, and the NIST AI Risk Management Framework, which gives a method for finding and treating AI risk. Around them sit standards for vocabulary, risk guidance, impact assessment and board-level governance, and two references for generative AI and agents.

This lesson introduces each one: what kind of document it is, what it is used for in the course, which version the course targets and how to get a copy. Later lessons cite them by number and clause, and you will meet them often enough that knowing their shape now saves time.

The course governs against two documents that do different jobs. One says what an organization must have in place to govern AI and can be audited against. The other says how to find, measure and treat the risks AI systems carry.

ISO/IEC 42001 is a management system standard. It specifies requirements: what an organization must establish, implement, maintain and continually improve in order to govern its AI systems.

An organization can be audited against it by an accredited certification body and receive a certificate, which is what makes it useful as evidence to customers and regulators. It is published jointly by ISO and IEC, and like most of their standards it is sold rather than given away.

The NIST AI RMF comes from the US National Institute of Standards and Technology. It is a voluntary framework: it describes outcomes an organization can aim for, grouped into four functions, and it leaves the organization to decide which outcomes matter and how to reach them. It is free, it is used well beyond the United States, and it comes with a Playbook that suggests actions for each outcome.

The two fit together well. 42001 says the organization must assess AI risks, treat them and choose controls; it is less detailed about how to find those risks in the first place.

The RMF is detailed about finding and measuring risk, and says little about the management system around it. A program that uses the RMF as its working method inside a 42001 management system gets both, and NIST publishes a crosswalk between the two.

Neither depends on the organization's country or sector. That is why the course is built on them: a student in any jurisdiction can apply what the course teaches, and add whichever laws apply through the method Module 9 teaches.

A management system is the set of policies, roles, processes and records an organization uses to achieve its objectives in some area, and to check that it is achieving them. ISO/IEC 27001 does this for information security; ISO/IEC 42001 does it for AI. Anyone who has worked with 27001 will find the shape familiar, because both follow the same high-level structure ISO uses for its management system standards.

The requirements are in clauses 4 to 10. Clause 4 asks the organization to understand its context and decide the scope of the management system. Clause 5 covers leadership, the AI policy and roles. Clause 6 covers planning, including how AI risks are assessed and treated and how AI system impact is assessed.

Clause 7 covers support: resources, competence, awareness, communication and documented information. Clause 8 covers operation, where the planned risk treatment and impact assessment are carried out. Clause 9 covers monitoring, internal audit and management review, and clause 10 covers improvement and corrective action.

Annex A lists reference control objectives and controls for AI, and Annex B gives implementation guidance for each. Both are normative, meaning they are part of what the standard requires the organization to consider rather than optional reading. Annexes C and D are informative: C gives examples of AI-related objectives and sources of risk, and D discusses using the management system across different sectors.

How many controls Annex A contains, and how they are grouped, is something the course states only from the standard's own text, in Module 4. Secondary sources disagree on the count, and a course that repeated the wrong number would teach students to cite it in audits.

An auditor certifying an organization tests the clauses. The controls matter because clause 6 requires the organization to choose them in response to its risks and to record that choice, which the next section describes.

ISO/IEC 42001 does not tell an organization to implement every control in Annex A. It tells the organization to assess its AI risks, decide how to treat them, choose the controls the treatment needs, and then compare that choice against Annex A to check that nothing necessary has been missed.

The result is recorded in a Statement of Applicability. For each Annex A control it says whether the control is included, why, and whether it is implemented; for each control excluded, it gives the reason.

An organization may also add controls of its own that Annex A does not list. The statement is one of the documents a certification auditor reads most closely, because it connects the organization's risks to what the organization actually does about them.

The same approach appears in ISO/IEC 27001, and organizations that hold that certification already have the habit. The difference is in what the controls cover: data quality for AI, documentation of AI systems, impact assessment, human oversight, the responsibilities of suppliers and customers in the AI chain, and the use of AI systems for their intended purpose.

The commonest weakness in a Statement of Applicability is the justification column. A justification that says "applicable" or "required by the standard" explains nothing. A useful one names the risk or the obligation the control answers and the systems it applies to, so that a reader can see why it is there and could tell if it stopped being needed.

The statement is also where the course's role decision earns its keep. A control about documenting how a model was trained is the organization's to apply if it built the model; if it bought it, the organization's control is to obtain that documentation from the supplier. Module 4 builds a Statement of Applicability line by line, and Module 8 handles the controls that pass to suppliers.

The AI RMF is organized in a hierarchy that is easy to navigate once seen. It has four functions, each divided into categories, and each category into subcategories that state an outcome.

Govern sets up the culture, policies, accountability and processes for managing AI risk, and it runs across the other three. Map establishes the context of a system: its purpose, the people it affects and the risks its context creates. Measure analyzes, assesses and tracks those risks, using quantitative, qualitative or mixed methods. Manage allocates resources to the mapped and measured risks, treats them, and plans for response and recovery.

In AI 100-1 the four functions divide into 19 categories and 72 subcategories. A subcategory is the level at which work is planned and checked, and the course cites them in the framework's own notation: GOVERN 2.1, for example, is the outcome that roles, responsibilities and lines of communication for mapping, measuring and managing AI risk are documented and clear.

The framework also describes seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. They are the qualities the risk method is trying to protect, and Module 1 used them to show where AI risk differs from IT risk.

Organizations use the framework by building profiles. A current profile records which outcomes the organization achieves today; a target profile records the ones it means to reach; the gap between them is the plan. Module 3 builds one. NIST states that version 1.0 is being revised, with no draft or date published when this lesson was written, and the course will move to the revision when it appears.

The framework's voluntary status is its strength and its limit. It can be adopted in part, in any order, by any organization; it gives no certificate at the end.

The documents this course uses are of three kinds, and confusing them leads to claims an organization cannot support.

A requirements standard uses "shall": the organization shall establish an AI policy, shall assess AI risks. Conformity can be audited, and a third party can certify it. ISO/IEC 42001 is the only requirements standard among the course's core documents.

A guidance standard uses "should": it recommends how something can be done well. ISO/IEC 23894 on risk management, ISO/IEC 42005 on impact assessment and ISO/IEC 38507 on board governance are guidance. An organization can follow them and say so, and an auditor of a 42001 system may look to them to judge whether a process is adequate, but nobody is certified against them.

A voluntary framework describes outcomes and leaves the method to the user. The NIST AI RMF is one. An organization can say it uses or aligns with the framework, and show its profile as evidence.

A common test of the difference arrives in customer questionnaires: "Is your organization certified against the NIST AI Risk Management Framework? If so, attach the certificate." The honest answer is that no such certificate exists, because NIST runs no certification scheme for the framework, and that the organization uses the framework, with its profile available on request. Answering "certified" is a claim a customer can later test, and fail.

The distinction matters most in what an organization tells outsiders. A customer questionnaire, a tender response or a regulator's request may ask about certification, conformity or alignment, and the words carry different weight.

Certified means a third party audited the organization against a requirements standard and issued a certificate with a scope. Aligned means the organization says its practice follows a framework, and the claim is only as good as the evidence behind it.

It also matters inside the program. Requirements are the floor the management system must meet. Guidance is where to look when deciding how to meet a requirement well, and a framework's outcomes are a useful checklist for whether the program covers what it should.

Treating guidance as a requirement makes a program heavier than it needs to be; treating a requirement as guidance fails an audit. When unsure which kind a document is, look at its verbs.

Four more ISO/IEC standards appear often enough to introduce here. Each fills in detail the core documents leave open.

ISO/IEC 22989 defines the concepts and terms the other AI standards use: what an AI system is, the stages of its lifecycle, and the roles of the parties around it, from the producer and provider to the customer and the AI subject affected by a system's output.

ISO and IEC have made it available free of charge, which makes it the one ISO AI standard every student can read in full. Module 1 relied on its definitions and roles.

ISO/IEC 23894 gives guidance on managing AI risk, built on ISO 31000, the general risk management standard. It follows the structure of ISO 31000 and adds AI-specific guidance where it is needed, including the sources of AI risk and how risk management fits each lifecycle stage. An organization that already uses ISO 31000 can extend its existing process rather than build a second one. Module 5 draws on it.

ISO/IEC 42005 gives guidance on assessing the impact of an AI system on individuals, groups and society: who is affected, how, and what the assessment should record. ISO/IEC 42001 requires an AI system impact assessment and 42005 explains how to carry one out. Module 5 builds an impact assessment along its lines.

ISO/IEC 38507 is written for members of governing bodies: boards, trustees and partners. It explains what the use of AI means for their responsibilities and what they should ask of management. Module 1 used it to set out accountability, and Module 10 returns to it for reporting to a board.

All four are paid documents except 22989. The course paraphrases them and cites clause numbers, and it never reproduces their text, so a student who wants the exact wording reads it in their own copy.

Generative AI, which produces text, images, code or other content, and AI agents, which take actions through tools, bring risks that the general documents describe only broadly. The course uses three references for them in Module 7.

NIST AI 600-1 is a profile of the AI RMF for generative AI. It identifies twelve risks that generative AI creates or makes worse, among them confabulation (confident, false output), information security, harmful bias, data privacy and intellectual property, and for each it suggests actions organized by AI RMF subcategory.

Because it uses the framework's own structure, it slots into a profile an organization has already built rather than starting a separate exercise.

The OWASP Top 10 for Large Language Model Applications is a security reference from the Open Worldwide Application Security Project, a nonprofit community that publishes freely licensed security guidance. Its 2026 edition was published on 4 August 2026 under the Creative Commons BY-SA 4.0 license, replacing the 2025 edition. It lists the ten most significant security risks for applications built on large language models, with prompt injection first.

Module 7 uses three of its entries in particular, prompt injection, excessive agency and the exposure of hidden context, as risks a governance program has to control.

The OWASP Top 10 for Agentic Applications covers systems that plan and act, call tools and keep memory. Its risks extend those of language model applications to actions with consequences in the world, which is why human oversight and limits on what an agent may do are governance questions as much as engineering ones.

These references are written for practitioners building systems, and they go into technique the course does not need. The course takes from them what a governance practitioner must decide: which risks apply to a system, which controls answer them, and how to know the controls work.

Taken together, the documents give a program everything it needs, provided each is used for what it is good at.

The vocabulary comes from ISO/IEC 22989. When the course says provider, customer or AI subject, or names a lifecycle stage, it uses 22989's meaning, and where a law uses a word differently, as the EU AI Act does with deployer, the course says so.

The risk method comes from the NIST AI RMF, supplemented by NIST AI 600-1 for generative AI. Its functions and subcategories are the working checklist: has the context been mapped, have the risks been measured, has each been managed, and is all of it governed.

The management system comes from ISO/IEC 42001. It is the frame the rest sits inside: the scope, the policy, the roles, the risk and impact processes, the Statement of Applicability, internal audit and management review. It is also what can be certified, which is why the course treats its control set as the one everything else maps onto.

The detail comes from the guidance standards. When 42001 requires a risk assessment, ISO/IEC 23894 says how to do one well; when it requires an impact assessment, ISO/IEC 42005 does the same. When the board needs to know what to ask, ISO/IEC 38507 says.

The NIST crosswalk between the AI RMF and ISO/IEC 42001 connects the two cores. An organization can use it to show that work done under one counts toward the other, which saves doing the same thing twice under two names. Module 4 uses it.

Laws sit outside this picture on purpose. They are mapped onto the control set through the method in Module 9, which keeps the core stable when a law changes.

A reader who holds this picture can place any new document quickly: a new standard either adds vocabulary, method, system requirements or detail, and a new law adds a mapping. Knowing which tells you where in the program it lands and how much of the existing work it touches.

Standards are revised, and the documents in this course will be too. The course handles that in two ways.

First, every lesson that relies on a standard or a law names it with its version or date. When the AI RMF revision is published, a reader can see which lessons were written against version 1.0 and check whether anything they rely on has changed.

The same applies to the drafts known to be in progress, including an amendment to ISO/IEC 22989 for generative AI and ISO/IEC 27090 on cybersecurity for AI, which the course will cite once they are published.

Second, the course teaches the reasoning a standard asks for rather than its wording. A student who understands why a Statement of Applicability needs a justification for each control, or why an impact assessment names the people affected, can apply that reasoning to a revised edition without relearning it.

You do not need copies of the paid standards to take the course. Every lesson explains what it uses.

If your organization intends to implement or certify an AI management system, it will need ISO/IEC 42001 itself, bought from ISO, from IEC, or from a national standards body, many of which sell the same text under their own designation. ISO/IEC 22989 and the NIST and OWASP documents are free, and each lesson that uses them links to them.

When you do have a standard, read the clauses a lesson cites alongside the lesson. The course paraphrases; the standard's own words are what an auditor will test against. Note in your register any place where your reading of a clause differs from the course's paraphrase, and settle it from the text.

Where the standard is silent or ambiguous, record the interpretation your organization has chosen and who chose it, because an auditor will accept a reasoned interpretation more readily than an unexplained one. The same habit serves when a revised edition arrives: compare the changed clauses against your recorded interpretations, and the work of updating the program is mostly done.

The course governs against ISO/IEC 42001, a certifiable management system standard, and uses the NIST AI RMF, a free voluntary framework, as its risk method.

ISO/IEC 22989 gives the vocabulary, ISO/IEC 23894 and 42005 the detail for risk and impact assessment, ISO/IEC 38507 the board's view, and NIST AI 600-1 and the OWASP lists the references for generative AI and agents. Each is cited with its version, and none of the paid texts is reproduced. The next lesson shows how to read the course for the organization you work in.

Versions this lesson relies on: ISO/IEC 42001:2023; NIST AI 100-1, AI RMF 1.0 (January 2023); NIST AI 600-1, Generative AI Profile (July 2024); ISO/IEC 42005:2025; ISO/IEC 23894:2023; ISO/IEC 22989:2022; ISO/IEC 38507:2022; EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (status as of 5 November 2026); OWASP Top 10 for LLM Applications 2025.