Skip to content

AI governance regulation and standards mapping (T2)

1. Short scope note

This note maps authoritative, current (2025–2026) official sources relevant to AI governance, separated into binding regulation, voluntary standards, and soft-law / official guidance. It prioritizes primary sources from the EU, U.S. government, OECD, ISO, the UK government, the G7/OECD Hiroshima process, and the Council of Europe. It does not attempt a full survey of academic frameworks or private-sector voluntary commitments except where they are embedded in official public-policy regimes.

2. Numbered source list

  1. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act) (2024) https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
  2. AI Act enters into force (European Commission, 1 Aug 2024) https://commission.europa.eu/news/ai-act-enters-force-2024-08-01_en
  3. Timeline for the Implementation of the EU AI Act (European Commission AI Act Service Desk, accessed 2026) https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline
  4. Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1, Jan 2023) https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf
  5. AI Risk Management Framework – Resources (NIST, updated 7 Feb 2025) https://www.nist.gov/itl/ai-risk-management-framework/ai-risk-management-framework-resources
  6. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1, 26 Jul 2024) https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
  7. M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (White House OMB, 3 Apr 2025) https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf
  8. M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government (White House OMB, 3 Apr 2025) https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf
  9. Recommendation of the Council on Artificial Intelligence (OECD Legal Instrument OECD/LEGAL/0449; adopted 2019, revised 2023 and 2024) https://legalinstruments.oecd.org/en/instruments/oecd-legal-0449
  10. OECD AI Principles (OECD topic page, updated framework) (2024/2025 access point) https://www.oecd.org/en/topics/sub-issues/ai-principles.html
  11. OECD Due Diligence Guidance for Responsible AI (OECD, 19 Feb 2026) https://www.oecd.org/en/publications/oecd-due-diligence-guidance-for-responsible-ai_41671712-en.html
  12. ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system (ISO, published Dec 2023) https://www.iso.org/standard/81230.html
  13. ISO/IEC 23894:2023 — AI — Guidance on risk management (ISO, published Feb 2023) https://www.iso.org/standard/77304.html
  14. ISO/IEC 42005:2025 — Information technology — Artificial intelligence (AI) — AI system impact assessment (ISO, published May 2025) https://www.iso.org/standard/44545.html
  15. Implementing the UK’s AI regulatory principles: initial guidance for regulators (UK DSIT, published Feb 2024; still relevant in 2025–2026 unless superseded) https://www.gov.uk/government/publications/implementing-the-uks-ai-regulatory-principles-initial-guidance-for-regulators/implementing-the-uks-ai-regulatory-principles-initial-guidance-for-regulators
  16. Guidance for using the AI Management Essentials tool: government response (UK DSIT, 2026) https://www.gov.uk/government/consultations/ai-management-essentials-tool/outcome/guidance-for-using-the-ai-management-essentials-tool-government-response
  17. G7 reporting framework – Hiroshima AI Process international code of conduct for organizations developing advanced AI systems (OECD portal, 2025 access point) https://oecd.ai/en/g7-reporting-framework
  18. Reporting Framework (Government of Japan, Hiroshima AI Process, launched 7 Feb 2025) https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html
  19. Council of Europe opens first ever global treaty on AI for signature (Council of Europe, 5 Sep 2024) https://www.coe.int/en/web/portal/-/council-of-europe-opens-first-ever-global-treaty-on-ai-for-signature
  20. Artificial Intelligence, Human Rights, Democracy and the Rule of Law Framework Convention (Council of Europe portal) (2024/2025 access point) https://www.coe.int/en/web/portal/-/artificial-intelligence-human-rights-democracy-and-the-rule-of-law-framework-convention

3. Evidence table

Regime / standard What it requires or recommends Jurisdiction / scope Source refs Confidence
EU AI Act (binding regulation) Establishes a risk-based legal regime for AI in the EU. Unacceptable-risk uses are prohibited; high-risk systems face ex ante and lifecycle obligations; certain AI-generated/synthetic content must be labeled; GPAI providers face transparency, copyright, and (for some models) systemic-risk governance duties. Governance implications include AI literacy obligations, provider/deployer role allocation, conformity assessment, post-market monitoring, incident reporting, and supervision by national authorities plus the EU AI Office for GPAI. EU / EEA-facing market activity with extraterritorial effect where relevant [1][2] High
EU AI Act timeline / phased application (binding implementation schedule) Official Commission timeline indicates: Act entered into force 1 Aug 2024; general provisions and prohibited practices applied from 2 Feb 2025; GPAI rules and governance apply from 2 Aug 2025; high-risk obligations and most remaining rules apply from 2 Aug 2026; full roll-out by 2 Aug 2027. EU [2][3] High
EU AI Act high-risk system obligations (binding regulation) High-risk AI systems must comply with strict governance controls including risk management, data/data-governance requirements, technical documentation, record-keeping/logging, clear instructions for use, human oversight, and accuracy/robustness/cybersecurity requirements before placement on market or use. EU [1][2] High
EU AI Act GPAI obligations (binding regulation) Providers of general-purpose AI models must meet governance obligations around technical documentation, information for downstream providers, copyright-policy compliance, and for some models with systemic risk, more extensive risk evaluation/mitigation, incident reporting, and cybersecurity expectations. EU; providers placing GPAI models on EU market / operating in scope [1][2][3] High
NIST AI RMF 1.0 (voluntary framework) Voluntary framework for organizations to govern, map, measure, and manage AI risks. It is not a binding federal regulation, but a major U.S. reference point for internal AI governance programs, especially around trustworthy-AI characteristics such as validity, safety, security/resilience, transparency/accountability, explainability, privacy, and fairness. U.S.-origin framework with broad global voluntary use [4][5] High
NIST AI RMF Generative AI Profile (voluntary guidance) Companion profile for generative AI. It identifies risks unique to or exacerbated by GAI (e.g. confabulation, information integrity, IP, privacy, information security, harmful bias, CBRN misuse) and maps suggested actions into RMF functions. Useful as a concrete governance overlay for gen-AI systems. Cross-sector; voluntary [5][6] High
OMB M-25-21 federal agency AI governance memo (binding internal federal policy) Rescinds and replaces M-24-10. Requires covered U.S. agencies to designate a Chief AI Officer, establish governance bodies, publish AI strategies and compliance plans, inventory use cases, update internal policies, develop generative-AI policies, and implement minimum risk-management practices for high-impact AI. Also requires testing, impact assessments, monitoring, human oversight, and appeal/remedy mechanisms for high-impact use cases. U.S. federal executive agencies (internal government policy, not general private-sector law) [7] High
OMB M-25-22 federal AI procurement memo (binding internal federal procurement policy) Directs agencies on more efficient procurement of AI, including data rights, performance evaluation, monitoring, competition/interoperability, and protections against vendor lock-in. Material governance relevance because procurement terms become a governance control on federal AI supply chains. U.S. federal procurement [8] Medium-High
OECD AI Recommendation / Principles (soft law) Non-binding intergovernmental standard. Sets five principles for trustworthy AI: inclusive growth; human rights/rule of law; transparency/explainability; robustness/security/safety; accountability. Recommends national policy action on R&D, AI ecosystem, interoperable governance/policy, human capacity/labour transition, and international cooperation. Updated in 2023–2024 to address generative AI, misuse, information integrity, traceability/accountability, override/decommissioning, and environmental sustainability. OECD adherents and global policy baseline [9][10] High
OECD Due Diligence Guidance for Responsible AI (soft law / enterprise guidance) Practical enterprise guidance for implementing OECD AI Principles and OECD responsible business conduct expectations. Organizes governance around due diligence steps: embed policy/management systems; identify/assess impacts; cease/prevent/mitigate; track results; communicate; remediate/cooperate in remediation. Especially relevant for board/governance integration beyond technical controls. Multinational enterprises / AI value chain; global voluntary guidance [11] High
ISO/IEC 42001:2023 AI management system (voluntary standard) Specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS). Governance relevance: organization-wide policy/process control, traceability, transparency, reliability, continual improvement, and structured management of AI risks/opportunities. International voluntary standard; certifiable management-system standard [12] High
ISO/IEC 23894:2023 AI risk management (voluntary standard) Provides guidance on how organizations developing, producing, deploying, or using AI can manage AI-specific risk. Useful as a risk-management companion to governance frameworks and management systems. International voluntary standard [13] High
ISO/IEC 42005:2025 AI system impact assessment (voluntary standard) Provides guidance for organizations conducting AI system impact assessments. Material governance relevance because impact assessment is a recurring requirement across public policy regimes and internal governance programs. International voluntary standard [14] Medium-High
UK AI regulatory principles guidance (soft law / regulator guidance) UK maintains a sectoral, principles-based approach rather than a single cross-economy AI statute. Guidance tells regulators the five principles to operationalize: safety/security/robustness; transparency/explainability; fairness; accountability/governance; contestability/redress. It is explicitly voluntary and non-prescriptive for regulators, intended to guide sector-specific implementation. UK regulators; indirect effect on firms through sector regulators [15] High
UK AI Management Essentials / AIME response (soft law / implementation support) UK government response indicates AIME was intended as a self-assessment tool distilling AI governance baselines, especially for SMEs, but DSIT decided not to publish AIME in the proposed form and not to make it a procurement requirement. Governance relevance lies in the UK’s support model: practical adoption guidance rather than broad new binding AI regulation. UK businesses, especially SMEs; voluntary support tooling [16] High
G7 Hiroshima AI Process reporting framework (soft law / transparency mechanism) Launched 7 Feb 2025. Voluntary reporting framework built on the Hiroshima Code of Conduct for organizations developing advanced AI systems. Promotes transparency, accountability, benchmarking, and publication of organizational reports; first company responses were published in 2025. G7-origin but open/global participation for advanced AI developers [17][18] High
Council of Europe Framework Convention on AI (binding treaty for ratifying parties; status-dependent) First international legally binding AI treaty focused on ensuring AI-system lifecycle activities are consistent with human rights, democracy, and rule of law. Technology-neutral and lifecycle-wide. Governance significance is high, but legal force depends on signature/ratification and entry into force. Council of Europe members, EU, and eligible non-members that sign/ratify [19][20] Medium-High

4. Notes on status uncertainty or implementation ambiguity

  1. EU AI Act timing remains phased and some implementation detail is still moving. The Commission’s service-desk timeline is clear on the main application dates, but the same page also notes a Digital Omnibus proposal linking some high-risk-system application timing to the availability of support tools and harmonised standards. That means the 2026 high-risk compliance picture should be treated as authoritative but still operationally developing.

  2. EU AI Act obligations depend heavily on role and system classification. Provider, deployer, importer, distributor, product manufacturer, and GPAI-provider roles carry different duties. “AI governance implications” therefore vary materially by organizational position in the value chain.

  3. NIST AI RMF is highly influential but not itself binding law. It should be treated as a leading governance framework and as an input into U.S. procurement / federal governance practice, not as a legal compliance regime by itself.

  4. U.S. federal guidance changed in 2025. OMB M-25-21 explicitly rescinds M-24-10. For current federal-agency governance claims, M-25-21 is the operative source. M-24-10 is now mainly historical background.

  5. U.S. federal guidance is mostly internal to government, not economy-wide regulation. It is still governance-relevant because it shapes agency use, procurement, documentation, inventories, testing, and oversight expectations.

  6. OECD instruments are soft law. Their significance comes from interoperability, policy convergence, and adoption by governments and enterprises, not direct legal enforceability.

  7. ISO standards are voluntary unless incorporated by contract, certification program, procurement rule, sector rule, or legislation. They are governance infrastructure, not generally binding public law.

  8. UK position remains deliberately non-statute-centric in the sources reviewed here. The UK material supports regulator-led implementation and SME guidance rather than an EU-style omnibus AI act. That could change, but this source set does not support claiming a broad, binding UK AI-governance statute in force in 2025–2026.

  9. G7 Hiroshima reporting is voluntary. It is materially relevant as a cross-border official transparency mechanism for advanced-AI developers, but not a binding regulatory regime.

  10. Council of Europe Framework Convention status must be checked before making in-force claims. The official source says it was opened for signature on 5 Sep 2024 and enters into force only after the required ratifications. It should therefore be cited as a binding treaty framework for ratifying parties once in force, not assumed to be universally operative today without a fresh ratification check.

5. Explicit ledger update note for T2

T2 (ai-governance): completed.

This file captures the regulation / standards / official-guidance track requested for ledger task T2 only and is saved at:

outputs/ai-governance-research-regulation.md