Building With AI? Here Are the Frameworks You Need to Know

For the last few years, the question for AI teams has mostly been: What can we build? Increasingly, customers, regulators and enterprise buyers are asking a different question: How are you governing what you built?

If you’re building with AI, you’ve probably started hearing the acronyms: EU AI Act, ISO 42001, NIST AI RMF, AIUC-1, SOC 2. They aren’t competing versions of the same thing. Some are laws, some help manage risk, some establish governance systems, while others provide assurance that controls actually work. Here’s the landscape companies building with AI should understand.

EU AI Act: The Law

The EU AI Act is not a framework but rather a law that went into effect across the EU on August 2, 2026. The European Commission and national authorities can now enforce applicable provisions.

Being a US company doesn’t automatically put you outside its reach. The Act can apply to companies inside and outside the EU when AI systems or general-purpose AI models are placed on the EU market, used there, or affect people in the EU.

ISO 42001: The AI Management System

ISO/IEC 42001 is the first international standard for AI management systems and gives organizations a structured way to govern AI through policies, accountability, risk management, processes and continuous improvement. Think of it less as a technical checklist and more as the operating system for how an organization manages AI responsibly. Responsible AI isn’t only about model performance and organizations increasingly need repeatable processes around how AI is developed, deployed, monitored and governed.

NIST AI RMF: The Risk Framework

The NIST AI Risk Management Framework helps organizations identify and manage AI risks throughout the AI lifecycle. It’s voluntary, flexible and designed to turn broad concepts like “trustworthy AI” into structured risk-management practices. NIST also publishes a dedicated Generative AI Profile for risks specific to GenAI. Ultimately, it gives teams a practical way to ask what could go wrong, how significant that risk is, and what should be done about it.

AIUC-1: The Emerging Agentic AI Standard

AIUC-1 is an emerging assurance standard designed specifically for AI agents, combining governance requirements with technical testing. Think of it as a best-practices standard for building and deploying agentic AI responsibly. For companies deploying agentic AI, AIUC-1 represents a shift from documenting how AI should be governed to testing whether safeguards continue to work as the systems themselves change.

SOC 2: Still Relevant, But Not an AI Framework

SOC 2 isn’t specific to AI, but it remains an important foundation for companies building with it. It provides independent assurance that controls around security, availability, confidentiality, processing integrity and privacy are designed and operating effectively. AI-specific governance may introduce new risks and requirements, but it doesn’t replace the fundamentals. If your AI product handles customer data or is sold into enterprise environments, customers will still want evidence that the systems around it are secure and well controlled.

Other frameworks and standards may become relevant depending on your technology and market. OWASP’s GenAI Security Project provides practical guidance on vulnerabilities affecting LLMs, generative AI and agentic applications, while ISO 27001 provides an established framework for information security management. CMMC and NIST 800-171 become relevant for companies entering parts of the US defense ecosystem and handling certain government information.

You Probably Don’t Need All of Them

Before choosing a framework, start by understanding your own AI footprint. Know which models, agents and third-party AI systems your organization uses, what data they can access, what actions they can take, and where they are deployed. Then ask which requirements follow from that footprint.

A SaaS company adding an AI feature has a different risk profile from a company building autonomous coding agents. A startup selling primarily to small US businesses may face different requirements from one selling into European enterprises or the US defense supply chain.

That is why there probably will not be one universal AI compliance framework. What is emerging instead is an AI compliance stack in which laws, security standards, governance systems, risk frameworks, and technical assurance requirements overlap. The relevant combination will depend on what you build, where it operates, what it can do, and who you sell it to.

For companies building with AI, understanding that stack is becoming part of building the product itself. Trustworthy AI increasingly requires more than saying a system is safe, secure, or responsibly governed. Companies need to be able to demonstrate the controls behind those claims and provide evidence that those controls continue to work.