Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →AI regulation creates binding legal duties for organizations and activities within its scope; AI standards and frameworks usually offer voluntary ways to manage risk and organize governance. They are not interchangeable. A standard can still affect compliance: under the EU AI Act, a harmonised standard cited in the Official Journal can create a presumption of conformity for the requirements it covers. Businesses should first identify the law, systems, jurisdictions, and organizational roles that apply, then use relevant standards and frameworks to support the work.
How regulation, frameworks, and standards differ
Regulations establish legal requirements for covered actors and activities. Frameworks and standards generally provide methods or management processes that organizations can adopt voluntarily. Customers, contracts, procurement requirements, regulators, or legal recognition can make voluntary instruments important in practice, but adopting one does not automatically satisfy every applicable law.
| Instrument | What it is | Main focus | Legal status and caution |
|---|---|---|---|
| EU AI Act, Regulation (EU) 2024/1689 | Binding EU regulation | Risk-based legal duties for covered systems, providers, deployers, and other actors | Enforceable within its scope. Duties depend on factors such as system, role, use, and applicable exceptions. |
| NIST AI RMF 1.0 | Voluntary risk-management framework from the U.S. National Institute of Standards and Technology (NIST) | Organizing AI risk management across design, development, use, and evaluation | Voluntary guidance, not a regulation or certification. NIST says the framework is being revised. |
| ISO/IEC 42001:2023 | Organizational AI management-system standard published by ISO/IEC | Establishing, maintaining, and improving organization-wide AI governance processes | Implementation does not itself establish that every applicable law has been met. Procurement or contracts may make it commercially relevant. |
Sources: EU AI Act, European Commission AI Act FAQ, NIST AI Risk Management Framework, and ISO/IEC 42001.
What businesses need to know about the EU AI Act
The EU AI Act is a risk-based legal framework for specified AI uses. The European Commission describes requirements that can include risk assessment and mitigation, data quality, logging and traceability, technical documentation, information for deployers, human oversight, and accuracy, robustness, and cybersecurity for high-risk systems. The legal text distinguishes provider and deployer responsibilities. For example, providers of high-risk systems have conformity-assessment responsibilities and must take corrective action when they identify nonconformity; deployers have operating, monitoring, and recordkeeping duties in the circumstances that apply to them.
#1 Best Overall
Do not assume that every AI system triggers the same checklist. Start by examining the system’s intended purpose, classification, your organization’s role, and any applicable exceptions. An organization can occupy different roles across its AI supply chain. See the regulation and the Commission’s AI Act overview and FAQ.
EU AI Act application dates
As of 7 October 2026, the Commission’s timeline is phased. These dates reflect changes that entered into force on 27 July 2026; earlier explainers may show superseded high-risk dates.
Rank #2
| Date | What began applying or is scheduled to apply |
|---|---|
| 2 February 2025 | Prohibitions and AI literacy provisions began applying. |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models began applying. |
| 2 August 2026 | The Act became generally applicable, subject to exceptions and extended high-risk transition periods. |
| 2 December 2027 | Rules for high-risk AI systems in specified sensitive areas, including Annex III use cases, are scheduled to apply. |
| 2 August 2028 | High-risk AI systems embedded in regulated products are scheduled to be covered under the extended transition. |
Check the Commission’s current timeline and FAQ and the official legal text for updates and details about exceptions.
Penalty ceilings are not typical fines
The Commission describes statutory maximum penalties of up to €35 million or 7% of preceding-year worldwide annual turnover for specified prohibited-practice or data-related infringements; €15 million or 3% for other obligations; and €7.5 million or 1% for specified incorrect, incomplete, or misleading information provided to authorities or notified bodies. The applicable category and company type matter: according to the Commission FAQ, the lower threshold in each pair applies to SMEs and the higher to other companies. These are legal ceilings, not typical or observed fines. See the Commission FAQ.
When harmonised standards matter
The Commission says harmonised standards can provide detailed specifications for implementing high-risk requirements. Providers that follow an applicable standard can receive a presumption of conformity for the requirements that standard covers. Standards remain voluntary, and standardisation work was still ongoing according to the Commission material checked on 7 October 2026. Before relying on a conformity presumption, verify the standard’s exact title, version, coverage, final status, and reference in the Official Journal. A standard is not a substitute for determining which law and duties apply. The Commission puts it this way: “Standards are voluntary, but decisive for legal certainty.” See Navigating the AI Act.
What NIST AI RMF contributes
NIST describes AI RMF 1.0 as voluntary guidance intended to help organizations incorporate trustworthiness considerations into AI design, development, use, and evaluation. Its core functions are Govern, Map, Measure, and Manage. The companion Playbook suggests actions for those functions, but NIST says the suggestions are voluntary: the Playbook is neither a checklist nor a set of steps every organization must follow.
NIST says AI RMF 1.0 is being revised, so check its current materials before basing a long-term program on a specific version or Playbook. NIST released AI RMF 1.0 on 26 January 2023 and its Generative AI Profile on 26 July 2024; it posted a concept note for a critical-infrastructure AI RMF profile on 7 April 2026. These are publication dates, not performance statistics. See the NIST framework page and NIST AI RMF Playbook.
What ISO/IEC 42001 contributes
ISO/IEC 42001:2023 provides requirements and guidance for establishing, implementing, maintaining, and continually improving an AI management system. It addresses responsible development, provision, or use of AI systems through an organization-level approach to managing risks and opportunities. That makes it useful for organizing policies, accountability, processes, and improvement; it does not specify every detail of every AI application.
Free tools Windows power users keep installed
One-click scans. No signup required.
Using the standard does not by itself determine whether a company is legally in scope or prove that it meets all applicable laws. Conduct the law-specific analysis separately. ISO identifies other related standards with distinct purposes: ISO/IEC 22989 covers terminology and concepts; ISO/IEC 23053 provides a general framework for AI and machine-learning systems; and ISO/IEC 23894 offers AI-related risk-management guidance. See ISO’s ISO/IEC 42001 page.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to choose what to use
Compare each instrument against the problem your organization needs to solve, rather than treating law, a framework, and a standard as rival compliance badges.
- Legal force and consequences: Is it binding law, voluntary guidance, or a standard? What enforcement or other consequences follow?
- Scope and geography: Which jurisdictions, systems, sectors, and activities are covered?
- Your role: Are you a provider, deployer, importer, distributor, or another covered actor?
- Evidence and controls: What documentation, risk management, testing, monitoring, transparency, human oversight, or records are required or recommended?
- Conformity and assurance: Is there a legal conformity-assessment route, a management-system audit or certification objective, or voluntary internal adoption? Has a harmonised standard been officially referenced?
- Currency: Which dates and versions apply, and which are still being updated?
A practical starting sequence for businesses
- Inventory AI systems and intended uses. Record what each system does, where it is used, and the purpose for which it is deployed.
- Map jurisdictions and organizational roles. Identify where relevant activities occur and whether your organization acts as a provider, deployer, or another actor for each system.
- Assess possible legal categories and duties. Determine whether prohibited-use, high-risk, transparency, or other requirements could apply, including relevant exceptions and dates.
- Assign owners and evidence to legal requirements. Organize accountable people, controls, and records around the duties that apply to your situation.
- Select supporting frameworks and standards. Use NIST AI RMF, ISO/IEC 42001, or other relevant instruments to support governance processes; verify any claimed legal conformity effect against the current Official Journal status.
- Keep decisions current. Preserve dated classification assumptions and revisit them when a system’s use, model, jurisdiction, law, or standards status changes.
This sequence is a practical approach, not a universal legal test. The EU AI Act is only one jurisdiction’s framework; this comparison does not inventory every country’s laws, sector rules, contracts, or evolving standards. Whether a particular business is in scope depends on its systems, uses, roles, locations, and sector.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
