One is a law, one is a voluntary framework, one is a certifiable management system. The EU moved its high-risk deadline, Colorado rewrote its AI law, and the first harmonised AI Act standard just landed. What US security and GRC leaders actually owe, and how to build one evidence base for all three.
These are three different kinds of instrument. The EU AI Act is law: it reaches US companies that place AI systems on the EU market or whose AI output is used in the EU, with fines up to €35 million or 7% of worldwide turnover. NIST AI RMF (AI 100-1) and its Generative AI Profile (AI 600-1) are voluntary, but they are the yardstick US states and buyers reach for. ISO/IEC 42001 is a certifiable management system. The high-risk date most teams planned around, August 2, 2026, moved: the EU's AI Omnibus pushed it to December 2, 2027 for stand-alone high-risk systems and August 2, 2028 for AI embedded in regulated products. Build one inventory and one evidence base, and treat the three as reporting views of it.
The question now arrives in security questionnaires, RFPs and board decks: are you compliant with the EU AI Act, do you follow the NIST AI RMF, are you ISO 42001 certified? Running three programs to answer it is the expensive mistake.
| EU AI Act | NIST AI RMF + AI 600-1 | ISO/IEC 42001 | |
|---|---|---|---|
| What it is | Regulation (EU) 2024/1689, as amended by the AI Omnibus (Regulation (EU) 2026/1744) | Voluntary risk framework (Govern, Map, Measure, Manage) plus a generative AI companion profile | International management-system standard, published December 2023 |
| Who it binds | Providers placing AI on the EU market from anywhere; deployers in the EU; non-EU providers and deployers whose output is used in the EU | No one directly; referenced by state law, contracts and federal buyers | Organizations that choose certification, or whose customers require it |
| How it's tested | National market-surveillance authorities and the EU AI Office; conformity assessment for high-risk systems | Self-attestation, customer diligence, and as a defense in state enforcement | Accredited third-party certification audit and surveillance audits |
| What you produce | Risk classification, technical documentation, QMS, transparency notices, registration, post-market monitoring | A documented, defensible risk methodology and profiles of your AI uses | A certificate, backed by an AI management system that runs like your ISMS |
The AI Omnibus entered into force July 27, 2026, days before the original high-risk date. The current timeline:
Deferred is not cancelled. The extra time exists because the technical standards weren't ready, and they are now arriving: on October 14, 2026 the Commission cited EN 18286, a quality-management standard, as the first harmonised standard under the Act. That matters for a reason many teams miss: ISO 42001 certification does not by itself give you a presumption of conformity with the AI Act. EN 18286 is built to layer on top of 42001, not to be replaced by it.
Two scope notes for US readers. Extraterritorial reach follows the output: if your system's results are used in the EU, you can be in scope with no EU entity at all. And for defense-adjacent firms, the military and national-security exclusion covers systems used exclusively for those purposes. A dual-use product sold commercially in Europe is not exempt. Penalties are tiered: up to €35 million or 7% for prohibited practices, €15 million or 3% for most operator obligations including transparency, and €7.5 million or 1% for misleading information to authorities.
There is no federal AI statute, but NIST's framework keeps acquiring legal weight. AI RMF 1.0 was released in January 2023, and NIST says it is now being revised under the White House AI Action Plan. The Generative AI Profile added 12 risk categories in July 2024, including confabulation, data privacy and information security. A Cyber AI Profile (NIST IR 8596) is in preliminary draft, and a critical-infrastructure profile is at concept stage.
The states are where it bites. Texas's TRAIGA, in effect since January 1, 2026, gives developers and deployers an affirmative defense for substantially complying with the NIST AI RMF, including the Generative AI Profile, or a comparable framework. Colorado went the other way: SB 24-205 never took effect. It was repealed and replaced by SB 26-189, signed May 14, 2026, which drops the risk-management mandate and its NIST-based presumption in favor of notice, explanation and human-review rights for automated consequential decisions, effective January 1, 2027. Federally, a December 2025 executive order set up challenges to "onerous" state AI laws, but it does not preempt anything on its own. Plan for a patchwork that persists.
At the control level the three converge: an inventory of AI systems, risk assessment tied to intended use, named accountability, data governance, human oversight, monitoring and incident handling. ISO 42001 shares the management-system structure of ISO 27001, so it extends an existing ISMS rather than standing up a new one (the same dynamic as SOC 2 versus ISO 27001). NIST supplies the vocabulary and the methodology US regulators recognize.
The divergence is the AI Act's product-law layer: risk classification, technical documentation, conformity assessment, EU database registration and post-market monitoring. Neither NIST nor ISO produces those artifacts for you. That is the real gap list, and it is narrower than three programs would suggest.
PRISM's AI Governance module inventories AI systems (generative, predictive, RAG and classification), classifies them under the EU AI Act, and assesses AI-specific threats from MITRE ATLAS, including prompt injection, model poisoning and training-data attacks. Supported AI frameworks include the EU AI Act, NIST AI RMF, ISO 42001 and OWASP AI Security, within one evidence base mapped across 29 frameworks and 2,623 requirements; custom frameworks can be imported by CSV or JSON. Iris, PRISM's AI engine, runs on self-hosted GPU infrastructure, so customer data doesn't go to third-party AI APIs.
PRISM inventories and classifies your AI systems, assesses AI-specific threats, and maps the evidence to the EU AI Act, NIST AI RMF and ISO 42001 at once, with AI analysis on self-hosted infrastructure instead of third-party AI APIs.