AI governance frameworks.
The EU AI Act tells you what to achieve, not how to organise for it. ISO/IEC 42001, the NIST AI RMF and your existing GDPR structures each cover part of the ground, and none maps cleanly onto the Article 17 quality management requirement on its own. These pages set out what each framework does and does not satisfy, where they overlap, and how to build a governance structure — committees, policies, sign-offs — that produces the evidence the Regulation asks for.
39 guides
AI Governance
20 guidesSection overview
AI Governance for EU AI Act Compliance: The SME Guide
Build an EU AI Act governance programme for your SME. Correct article map (Art 9, 14, 43, 72), 2 Dec 2027 deadline, penalties, RACI, and a 90-day plan.
- A RACI Model for EU AI Act Compliance (Worked Example)Map Responsible, Accountable, Consulted, Informed across EU AI Act duties — Art 9, 10, 11, 14, 26, 49, 73 — to real functions. A worked SME RACI.
- AI Act Audit Readiness: The Evidence Pack ExplainedAI Act audit readiness: the evidence a market-surveillance authority can demand under Article 74 — inventory, Annex IV docs, logs, FRIA, registration.
- AI Ethics Board: An AI Governance Committee ExplainedAn AI ethics board is a governance practice, not a statutory body: how a committee screens Article 5 uses and signs off high-risk Annex III deployments.
- AI Governance for Manufacturers Under the EU AI ActA governance model for manufacturers spanning two EU AI Act routes: machinery safety-component AI (Annex I, 2 Aug 2028) and HR uses (Annex III point 4).
- AI Governance KPIs and Metrics for the EU AI ActThe AI governance KPIs that matter under the EU AI Act: inventory coverage, % classified, conformity status, incidents (Art 73), Art 4 literacy, FRIAs.
- AI Governance Maturity Model: 5 Levels, EU AI ActMap your EU AI Act readiness across 5 governance maturity levels. Covers Articles 9, 11, 14, 43, 72, ISO 42001, and the 2 December 2027 high-risk deadline.
- AI Literacy Training Program for Article 4 of the EU AI ActBuild an Article 4 AI literacy program — in force since 2 February 2025 for all AI. Role-based training on capabilities, Article 5 limits and oversight.
- AI Policy Management for EU AI Act ComplianceSix internal AI policies that evidence EU AI Act compliance — mapped to Articles 4, 17, 26 and 73. Control shadow AI, build your QMS. Deadline: 2 Dec 2027.
- AI Vendor Management Under the EU AI ActAs a deployer, AI vendor management means verifying the provider's conformity package — CE marking, documentation, registration — and securing cooperation.
- An AI Governance Operating Model for the EU AI ActAn AI governance operating model is a practice, not a statute: centralised, federated or hub-and-spoke, with roles and EU AI Act duties mapped to named people.
- EU AI Act Board Reporting: What Directors Need to SeeWhat the board needs on EU AI Act compliance: the AI inventory, high-risk exposure, the deadlines, incidents and penalty exposure — on a cadence.
- EU AI Act for Startups: A Lean Compliance PlaybookThe EU AI Act for startups: classify by use, lean on the SME supports, and build the high-risk stack only if an Annex III use actually applies.
- EU AI Act for the Public SectorPublic bodies face the AI Act's heaviest side: a mandatory FRIA (Art 27), heavy Annex III exposure, a registration duty, and prohibited uses to avoid.
- GDPR and the EU AI Act: Two Regimes, One ProgrammeGDPR and EU AI Act apply cumulatively. Map 7 key intersections — FRIA vs DPIA, Art 14 vs GDPR Art 22, dual enforcement — for your compliance programme.
- Multi-Framework AI Governance: EU AI Act, ISO 42001 & NISTMap EU AI Act, ISO 42001, NIST AI RMF, and GDPR onto one control set. Crosswalk table, deadline 2 Dec 2027, and what each framework legally requires.
- Responsible AI Governance and the EU AI ActHow the EU AI Act turns responsible AI principles into binding law for high-risk systems. Art 9, 10, 13, 14, 15, 17 mapped. Deadline: 2 Dec 2027.
- The CISO's Guide to the EU AI Act: 2027 DeadlinesCISOs and EU AI Act: AI inventory, Article 15 cybersecurity, Article 73 incident reporting, NIS2 overlap, board reporting. High-risk deadline: Dec 2027.
- Three Lines of Defence for EU AI Act GovernanceApply the three-lines-of-defence model to EU AI Act governance: ops own the controls, compliance classifies and monitors, internal audit assures.
- Writing an AI Risk Appetite Statement (EU AI Act)An AI risk appetite statement is a practice, not a statute: Article 5 prohibited is the hard floor, and Annex III high-risk needs executive or board sign-off.
ISO 42001
6 guidesSection overview
ISO 42001 Explained: AI Management System & EU AI Act
ISO/IEC 42001:2023 explained: AIMS clause structure, 38 Annex A controls, the certification journey, and how it maps to EU AI Act Articles 9, 11 and 17.
- ISO 42001 Certification: Step-by-Step Process GuideISO/IEC 42001 certification explained: gap analysis to audit, AIMS clauses 4–10, 3-year cycle, and how it supports your EU AI Act Article 17 QMS.
- ISO 42001 Gap Assessment: How to Run One (2026)How to run an ISO/IEC 42001 gap assessment: walk clauses 4–10, score 38 Annex A controls, and produce a remediation plan ahead of the 2 Dec 2027 deadline.
- ISO 42001 vs ISO 27001: AI vs Information SecurityISO 42001 governs AI management; ISO 27001 covers information security. Both share the ISO Harmonised Structure — here is when to pursue each or both.
- ISO/IEC 42001 vs EU AI Act: Overlap, Gaps, and RequirementsISO/IEC 42001 is a voluntary AIMS standard. The EU AI Act is binding law. Where they align, where they diverge, and what Article 43 still demands.
- What ISO 42001 Doesn't Cover for the EU AI Act (2026)An ISO 42001 certificate is not EU AI Act compliance. See the gaps 42001 leaves — Article 43 conformity, Annex IV, CE marking — and the EUR 35M / 7% penalty exposure.
NIST AI RMF
2 guidesSection overview
NIST AI Risk Management Framework Explained (2026)
NIST AI RMF is voluntary guidance from January 2023. Learn the four core functions and how they map to EU AI Act articles in Regulation (EU) 2024/1689.
AI DPIA
1 guideSection overview
DPIA and FRIA for AI Systems: Two Assessments, One Workflow
GDPR Article 35 DPIA and EU AI Act Article 27 FRIA are distinct duties. Learn when each is required, which deployers owe it, and how to run both together.
AI Governance Committee
1 guideSection overview
AI Governance Committee: EU AI Act Setup
How to set up an AI governance committee for EU AI Act compliance: who sits on it, its charter and decision rights, cadence, board reporting, and what it owns.
AI Procurement Policy
1 guideSection overview
AI Procurement Policy for the EU AI Act
Build an AI procurement policy for the EU AI Act: intake questions, risk-tier approval gates, contract clauses, and a named owner — with a worked example.
AI Trust Center
1 guideSection overview
AI Trust Center: What to Publish (EU AI Act)
An AI trust center publishes your EU AI Act posture so buyers self-serve diligence. See the seven building blocks to publish and how it shortens procurement.
AI Use Case Register
1 guideSection overview
AI Use Case Register for the EU AI Act
An AI use case register is step one of EU AI Act compliance: the exact fields it needs, how it maps each use to Article 6, and why it precedes everything else.
AI Vendor Contract Clauses
1 guideSection overview
EU AI Act Vendor Contract Clauses to Demand
The EU AI Act clauses for an AI-supplier contract: Annex IV documentation access, Article 25 role allocation, Article 73 incident cooperation, audit rights.
EU AI Act Board Reporting
1 guideSection overview
EU AI Act Board Reporting: A Dashboard Guide
Report EU AI Act status to your board: exposure by risk tier, the high-risk inventory, top risks, incidents, budget, and a one-page board dashboard template.
FRIA Vs DPIA
1 guideSection overview
FRIA vs DPIA: EU AI Act Art 27 vs GDPR Art 35 (2026)
FRIA vs DPIA: a GDPR Art 35 DPIA covers data risks; an EU AI Act Art 27 FRIA covers fundamental rights. See who, when, and the high-risk date 2 December 2027.
GDPR AI Act Crosswalk
1 guideSection overview
GDPR and EU AI Act Crosswalk: Obligation Mapping Table
Article-by-article mapping: EU AI Act to GDPR. Where Art 27 and Art 35 DPIA combine, where Art 14 and GDPR Art 22 overlap, and where the two diverge.
Classify, document and evidence — in one place
Confir turns Article 6 and Annex III into a decision you can defend, with the technical documentation and audit trail attached.
Start free trial →