International AI standards work is carried out principally by ISO and IEC jointly, through their joint technical committee on AI, by IEEE, and by national bodies including NIST in the United States, with European standards work carried out by CEN and CENELEC through Joint Technical Committee 21 for the AI Act. International standards are voluntary technical documents, not law, unless they are cited as harmonised standards in the Official Journal under the AI Act or are referenced in a contract, a regulation or a conformity procedure. No standard number is asserted in this guide beyond ISO/IEC 42001 and NIST AI RMF 1.0, whose existence and voluntary status were verified, and no standard should be treated as giving a presumption of conformity unless its reference has been published in the Official Journal for the AI Act.
What do ISO and IEC do for AI?
The International Organization for Standardization, or ISO, and the International Electrotechnical Commission, or IEC, develop international standards jointly for artificial intelligence through a joint technical committee, ISO/IEC JTC 1 Subcommittee 42 on Artificial Intelligence. That committee develops standards on AI concepts, governance, risk management, data, trustworthiness, management systems and related topics, through a consensus process with national member bodies. ISO/IEC 42001, on AI management systems, is the management system standard in that family, and it can be certified by an accredited certification body. Other ISO/IEC standards in the family address AI risk management, AI data, AI trustworthiness and AI system life cycle topics, and the full list must be checked on the ISO and IEC sites, because standards are published, revised and withdrawn over time. ISO/IEC standards are voluntary and are paid documents in most cases. They do not, by themselves, give a presumption of conformity under the AI Act, unless a European adoption of the standard is cited as a harmonised standard in the Official Journal. A company that uses an ISO/IEC standard should record the standard, the version, the date and the scope of use, and should map the standard to the AI Act requirement it is used to support, with gaps noted.
What do IEEE and other bodies do?
The Institute of Electrical and Electronics Engineers, or IEEE, develops standards and related material on AI, including on ethical, transparency, bias and system design topics, through its standards association and its industry programmes. Other bodies, including the International Telecommunication Union, the Organisation for Economic Co-operation and Development through its AI principles and policy work, and the Council of Europe through its Framework Convention on AI and Human Rights, Democracy and the Rule of Law, also work on AI governance, principles and, in the Council of Europe case, a treaty framework. Those bodies have different legal status: IEEE standards are voluntary technical standards, OECD principles are non binding policy principles, and the Council of Europe Convention is a treaty that binds only its parties that ratify it and that requires national implementation. A company should therefore distinguish between a voluntary standard, a policy principle and a treaty, and should not treat a principle or a treaty as a standard, or a standard as law. The relevance of each body to a particular system depends on the jurisdiction, the sector, the contract and the customer requirements, and the body material should be checked on its official site, with the version and date recorded.
For the broader regulatory framework, see non-EU and international overview.
What does NIST do internationally?
The National Institute of Standards and Technology, or NIST, in the United States, develops voluntary frameworks and guidance on AI, including the AI Risk Management Framework 1.0, the Generative AI Profile, and measurement and evaluation work. NIST material is voluntary, is freely available in most cases, and is widely referenced internationally, including in crosswalks to ISO/IEC standards and in state and sector guidance. NIST participates in international standards work and in crosswalks, and its material is used by companies outside the United States as a risk management language, even where US law does not apply to them. A company that uses NIST material outside the US should record that it is using a voluntary US framework as a management aid, not as a legal compliance route, and should map it to the legal duties that apply in its own jurisdiction. The NIST framework version must be checked, because NIST has stated that AI RMF 1.0 is being revised, and a mapping made to version 1.0 may need to be updated when a revised version is published. The NIST site is the checking route for the current version and status.
How do international and European standards relate?
European standards work for the AI Act is carried out by CEN and CENELEC through Joint Technical Committee 21, under a Commission standardisation request, with the aim of producing harmonised standards whose references, when published in the Official Journal, give a presumption of conformity under Article 40. International standards can be adopted as European standards, with or without modification, through the Vienna and Frankfurt Agreements between ISO, IEC, CEN and CENELEC, and European standards can be developed in parallel with international work. The relationship is therefore one of adoption and alignment, not of identity. An ISO/IEC standard and a CEN-CENELEC standard with a similar title can differ in scope, in requirements and in legal effect, and a company should check whether the standard it uses is the international version, the European version, or a harmonised version cited in the Official Journal. The standards cluster in this site deals with the European process in detail. For the international comparison, the point is that international standards work informs European work, but it does not replace it, and a presumption of conformity under the AI Act depends on the Official Journal citation, not on the international publication alone.
How should a company choose which standards to use?
A company should choose standards on the basis of the legal duty, the customer requirement and the sector, not on the basis of a general claim that a standard is the AI standard. It should list the AI Act requirements, the sector requirements, the contract requirements and the customer requirements, and should map each requirement to the standard, guidance or internal procedure that supports it, with gaps noted. It should check the standard version, the scope, the certification or assessment route if any, and the cost and availability. It should record the mapping, with the standard, the version and the date, in the conformity file or the governance file, so that a reviewer can test it. It should avoid claiming compliance with a standard where it has only read a summary, where it has applied only part of the standard, or where the standard has been superseded. It should also avoid presenting a voluntary standard as a legal determination, or a certification under a management system standard as a product conformity assessment, because the two are different in scope and in legal effect. A standards map that shows gaps honestly is more useful than a map that claims coverage it does not have.
Continue with codes, standards and sandboxes overview.
What does this guide not decide?
This guide does not list all international AI standards, does not reproduce any standard, and does not decide whether any standard gives a presumption of conformity, a certification, or a legal defence for a specific system. Standard numbers, versions and citations must be checked on the official ISO, IEC, IEEE, NIST and CEN-CENELEC sites on the date of use, and the Official Journal must be checked for harmonised standard citations. A company with a specific standard question should confirm the standard, the version and the legal effect with a standards adviser or legal adviser. This guide gives the bodies and the relationships in outline, not the standards themselves.
Frequently asked questions
Is ISO/IEC 42001 a harmonised standard under the AI Act?
No, not by itself. ISO/IEC 42001 is an international management system standard that can be certified. It gives a presumption of conformity under the AI Act only where a European adoption is cited as a harmonised standard in the Official Journal for the requirement concerned, to the extent the standard covers it. The Official Journal must be checked, and the mapping to the AI Act requirement must be recorded with gaps noted.
Does NIST AI RMF give a presumption of conformity?
No. NIST AI RMF 1.0 is a voluntary framework with no certification and no presumption of conformity under the AI Act. It can support risk management work and can be mapped to AI Act requirements, but the mapping must be evidenced and the legal duties must be met on their own terms.
What is the Council of Europe AI Convention?
A treaty framework on AI and human rights, democracy and the rule of law, adopted by the Council of Europe, which binds only parties that ratify it and requires national implementation. It is not a standard and it is not the AI Act. Its relevance to a particular jurisdiction depends on ratification and implementation, which must be checked on Council of Europe and national sources.
Should a company buy every AI standard?
No. A company should choose standards on the basis of the legal, sector, contract and customer requirements, map each requirement to the standard or procedure that supports it, and record gaps. Buying a standard without mapping it to a requirement, or claiming compliance from a summary, will not support a conformity file.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗NIST AI Risk Management Framework ↗AI Act Service Desk timeline ↗