Module 6: Industry Standards and Frameworks
Introduction to Industry Standards and Frameworks
Capsule description
The EU AI Act (M4) and GDPR (M5) tell you WHAT you have to comply with. The industry standards tell you HOW to implement the controls to comply. That's the point of this module: closing the gap between "the law says you need data quality" and "here's the step-by-step framework for implementing data quality."
The standards most relevant to AI:
- NIST AI RMF (Risk Management Framework): the most practical and widely adopted. Free, US-origin but globally adoptable.
- The IEEE 7000 series: ethics in autonomous systems. Voluntary, conceptual.
- ISO 42001: a certifiable AI Management System. Required in some enterprise RFPs.
By the end of the module you'll be able to:
- Describe the structure of the NIST AI RMF (4 functions: Govern, Map, Measure, Manage)
- Apply the NIST AI RMF to a concrete AI system
- Know IEEE 7000 and ISO 42001 to the level an AI engineer needs
- Map an AI system to the standards' controls
- Distinguish regulation (mandatory) from standards (voluntary but valuable)
Where are we?
Phase 1: Ethics Foundations ✅ (M1-M3)
Phase 2: Regulatory Compliance (M4-M6)
└── M4: EU AI Act ✅
└── M5: GDPR ✅
└── M6: Industry Standards ← YOU ARE HERE
Phase 3: Practical Implementation (M7-M8)
M6 closes Phase 2. The next Phase: practical application of the framework.
Why standards complement (not replace) regulation
| Regulation (EU AI Act, GDPR) | Standards (NIST, IEEE, ISO) |
|---|---|
| Mandatory (legal) | Voluntary (best practices) |
| Defines WHAT | Defines HOW |
| Penalties for violations | Best practices |
| Changes slowly (years) | Updated more frequently |
| Region-specific (EU) | Globally applicable |
| Aspirational/principles | Implementable processes |
The insight: regulation says "high-risk AI requires risk management." Standards say "here's the step-by-step framework for risk management." The two work together.
Why NIST AI RMF is the star of this module
Three reasons:
- The most practical: structured into 4 functions (Govern, Map, Measure, Manage) that an AI engineer can apply directly.
- Free and public: NIST publishes it for free, no licensing fees.
- Adopted by industry: many enterprise RFPs ask for it, even outside the US. The EU AI Act cites it as a compliant approach.
IEEE 7000 and ISO 42001 are important as references, but the NIST AI RMF is where you'll spend the most time applying.
Module map
| Capsule | Topic | Output |
|---|---|---|
| 01 | Introduction (this one) | A mental model + why each standard matters |
| 02 | NIST AI RMF — the Govern function | Governance structure |
| 03 | NIST AI RMF — the Map function | Context and risk identification |
| 04 | NIST AI RMF — the Measure function | Risk analysis and evaluation |
| 05 | NIST AI RMF — the Manage function | Prioritization and response |
| 06 | The IEEE 7000 series | Ethical considerations in design |
| 07 | ISO 42001 — AI Management System | A certifiable framework for enterprise |
| 08 | Project: Standards Mapping for your system | A complete mapping document |
Your system probably already meets many controls
Good news: if you followed the full path, you already implement many controls de facto:
| Path content | It meets controls from... |
|---|---|
| Production Best Practices (#13) | NIST: Manage (operational practices), ISO: documentation |
| Monitoring & Observability (#18) | NIST: Measure (monitoring controls), ISO: monitoring |
| Security Deep Dive (#20) | NIST: Govern + Manage (security), ISO: security controls |
| System Design & Scaling (#21) | NIST: Map (architectural risk), ISO: change management |
| AI Ethics & Compliance (#22 = this path) | NIST: Govern, Map, Measure, Manage; IEEE: ethics |
The message: you aren't starting from zero. You're organizing existing practice under a recognized framework.
Common traps while taking this module
Trap 1 — "Standards are bureaucracy." For some cases, yes (compliance theater). For serious AI, they're useful frameworks. See the practical value before dismissing them.
Trap 2 — Confusing IEEE and ISO with regulation. They're voluntary. You don't get fined for not following them. But they can be contractual requirements with enterprise clients.
Trap 3 — Applying the NIST checklist with no context. The NIST AI RMF is a framework, not a checklist. You adapt it to your system; you don't copy-paste.
Trap 4 — Chasing certification too early. ISO 42001 certification is expensive and serious. If you're a startup, map it mentally but don't certify yet. When a client asks for it, consider it.
Self-assessment question
Before M6-02:
- What's the fundamental difference between regulation and standards?
- Why does the NIST AI RMF have 4 functions instead of 1 set of checks?
- When is it reasonable to pursue ISO 42001 certification?
Guide answers
- Regulation vs. standards: regulation is mandatory (there's a penalty for violation). Standards are voluntary (best practices that improve governance but aren't legally required). Working together: regulation says what to comply with, standards say how to implement it.
- The 4 NIST AI RMF functions:
- Govern: cultural and organizational structure (top-level, ongoing)
- Map: identify context and risks (specific, per-system)
- Measure: analyze and evaluate risks (technical, per-system)
- Manage: prioritize and respond (operational, per-system)
- The framework recognizes that AI risk management is multi-layered: governance + analysis + measurement + action. A checklist is only 1 layer.
- ISO 42001 certification is worth it when:
- You have enterprise clients asking for it (RFPs)
- You're selling into regulated sectors
- You need competitive differentiation
- You have the budget and the team for a serious implementation
- NOT if: you're an early-stage startup, on your first funding round, and nobody has asked for it yet
Evidence of success when you finish M6
You'll know you finished well if:
- ✅ You can describe the 4 functions of the NIST AI RMF
- ✅ You apply each function to your system with specific controls
- ✅ You know IEEE 7000 and ISO 42001 to the level of "I know when to reach for them"
- ✅ Your Standards Mapping connects the path's controls to the NIST functions
- ✅ You can prioritize your implementation gaps
Next capsule
02 — NIST AI RMF: the Govern function. We start with the first and most fundamental function: governance — who makes decisions, what processes, organizational culture.
Resources
- NIST AI Risk Management Framework — the free official site.
- NIST AI RMF Playbook — practical implementation.
- IEEE 7000 series overview — the ethics standards.
- ISO/IEC 42001 (AI Management System) — the official spec.
- Comparison frameworks — Gartner research on AI governance.