What you will be measured against

Binding regulation covering AI systems placed on the EU market. Risk-tiered: prohibited practices, high-risk systems, transparency obligations, and a separate regime for general-purpose AI models.

Why it matters: The only item on this page that is law rather than guidance. Obligations attach to providers and deployers, and apply extraterritorially where output is used in the EU.

• 01 Aug 2024Entered into force
• 02 Feb 2025Prohibited practices and AI literacy obligations apply
• 02 Aug 2025General-purpose AI model obligations apply (Arts. 51–56)
• 02 Aug 2026High-risk system framework applies
• 02 Dec 2026Transparency obligations apply (Art. 50)
• 02 Dec 2027Annex III high-risk systems apply
• 02 Aug 2028Annex I product-embedded systems apply

Voluntary framework organised around four functions — GOVERN, MAP, MEASURE, MANAGE — for identifying and managing risk across the AI lifecycle.

Why it matters: Supplies the vocabulary most enterprise AI risk programmes are assessed against, and the mapping target used throughout this research. Not certifiable, but widely referenced in contracts.

• 26 Jan 2023AI RMF 1.0 released
• 26 Jul 2024Generative AI Profile released (NIST AI 600-1)

Ranked list of the ten risks most commonly seen in production LLM applications, with mitigation guidance per entry.

Why it matters: The de facto shared vocabulary for LLM application risk. The 2025 revision renumbered several entries against the 2023 list, so citations must carry the year to be unambiguous.

• 01 Aug 2023First release (v1.0)
• 18 Nov 2024v2.0 published — entries renumbered

ATT&CK-style matrix of tactics and techniques observed against AI systems, with case studies drawn from real incidents.

Why it matters: The only one of these that describes adversary behaviour rather than controls. Techniques are added as they are seen in the wild, so it moves continuously rather than in releases.

• 01 Jun 2021Initial public release

Management system standard for artificial intelligence (AIMS), structured like ISO 27001 — policy, roles, risk assessment, controls, continual improvement.

Why it matters: Certifiable, which is what distinguishes it from the frameworks above. Where a customer asks for evidence of AI governance rather than a description of it, this is usually the artefact they mean.

• 18 Dec 2023Published

Guidance on AI risk management, aligning ISO 31000 risk practice to AI-specific concerns.

Why it matters: Bridges an existing enterprise risk function into AI without requiring a separate programme. Guidance only — not certifiable.

• 01 Feb 2023Published