The standards you adopt, broken to control level.
ISO/IEC 42001, NIST AI RMF 1.0, the EU AI Act and the India AI Governance Guidelines 2025 against one library of 122 controls in 12 domains. ISO 42001 and NIST are jurisdiction-neutral — they apply to you everywhere, today, whatever your own regulator has or has not yet published.
Four frameworks, one control library.
Each framework is held at clause and control level, not as a summary of itself. Where a framework has been verified against its own primary source, we say against what and when.
ISO/IEC 42001
The clause structure plus Annex A, with the Statement of Applicability an auditor will actually ask to see — generated from the controls you have accepted and the evidence behind each one, not typed up afterwards.
NIST AI RMF 1.0
Held at category level — the nineteen categories of the Core — so a control is tied to the outcome it serves, not to a function name. Useful where a customer or an insurer asks for NIST alignment without asking for certification.
EU AI Act
The Act is binding law, so it is held in the obligation register as an instrument, with the Digital Omnibus dates and role-based applicability rules. It appears here as well, at article level — twenty-three articles, each mapped to the control library — because it maps to the same controls.
India AI Governance Guidelines 2025
MeitY's national guidance, held as the Seven Sutras and the six pillars of Part 2 of the document itself — not a paraphrase of a paraphrase. Advisory today; it points organisations back to existing binding law rather than creating new duties of its own.
One control. Every framework it satisfies. Every jurisdiction it discharges.
This is the question most organisations actually have: we are certifying to ISO 42001 anyway — how much of the rest does that already cover?
| Control | Name | ISO 42001 | NIST AI RMF | Discharges obligations in |
|---|---|---|---|---|
| AIG-01 | AI policy approved at executive level | 5.2 · A.2.2 | GOVERN 1.1 | UAE · Oman · Bahrain · EU |
| AIL-01 | Complete register of AI systems | A.6.2.6 | MAP 1.1 | UAE · EU |
| AIR-05 | Impact assessment for systems affecting individuals | 8.4 · A.5.2 | MAP 3.1 | UAE · DIFC · Saudi Arabia · Bahrain · EU |
| AID-06 | Data lineage traceable | A.7.3 · A.7.5 | MAP 2.1 | EU |
| AIO-01 | Human oversight defined per system | A.9.3 | MANAGE 1.2 | UAE · Bahrain · EU |
| AIN-10 | Regulatory notification of serious incidents | A.8.3 · A.8.4 | MANAGE 4.3 | Qatar · Oman · EU |
| AIT-03 | Vendor AI capability disclosure obtained | A.10.3 | MAP 4.1 | UAE · EU |
A certification is not an answer about your regulator. It is most of one.
Frameworks apply wherever you operate
An ISO 42001 management system is defensible to a regulator that has not yet written its own AI rules, and it is the thing a customer, an insurer or an acquirer asks for by name. It does not expire when you cross a border.
Jurisdictions add what the spine cannot know
No framework tells you that DIFC Regulation 10 reaches your free-zone entity, or that a CBUAE guidance note is examinable. That is what the obligation register is for, and why the two are mapped to each other rather than sold separately.