AI Governance Frameworks: Standards and Voluntary Codes
Voluntary standards and reference frameworks organizations use to structure an AI governance program, from NIST AI RMF to ISO/IEC 42001.
Singapore's AI Verify Testing Framework
Singapore's Infocomm Media Development Authority developed this voluntary AI governance framework and toolkit. Organizations use its standardized technical tests and process checks to demonstrate responsible AI practices.
America's AI Action Plan
America's AI Action Plan is the White House's AI policy agenda, released on 23 July 2025. It sets out more than 90 federal actions under three pillars: accelerating AI innovation, building American AI infrastructure, and leading in international AI diplomacy and security. It favors removing regulatory barriers over adding new rules.
Australia AI Ethics Framework
Australia's 2019 AI Ethics Principles set eight voluntary principles for designing, developing, and using AI. Since October 2025 the government's main guidance has been the Guidance for AI Adoption, which builds on them.
EU Action Plan on Cybersecurity and Artificial Intelligence
The European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence on 7 July 2026. It aims to promote safe use of advanced AI, strengthen EU cybersecurity, and build European AI capabilities for cybersecurity. It creates no new obligations and relies on existing laws such as NIS2, DORA, and the Cyber Resilience Act.
EN 18286:2026, Quality Management System for EU AI Act Regulatory Purposes
EN 18286:2026 sets quality management system requirements for AI providers under the EU AI Act. CEN and CENELEC published it in July 2026, the first European standard supporting the Act. It gives a presumption of conformity only once cited in the Official Journal.
AI Act Governance and Enforcement Framework
EU AI Act supervision is shared across Union bodies and national authorities. Responsibilities involve the AI Office, European Data Protection Supervisor, and national competent authorities. Developers and deployers must identify the authority responsible for their systems and prepare compliance evidence.
EU Code of Practice on Transparency of AI-Generated Content
The European Commission published this voluntary Code of Practice to support Article 50 compliance under the EU AI Act. It addresses generative AI providers and deployers serving the EU. The Code covers content labeling, controls that record where content came from, and disclosure workflows.
U.S. General Services Administration AI Strategies and Compliance Plan
The GSA AI Strategies and Compliance Plan from the US General Services Administration (GSA) establishes governance for internal agency AI use. An AI Governance Board and oversight committee review and approve use requests. Requirements cover privacy controls, security reviews, use-case intake, and compliance evidence.
Singapore Model AI Governance Framework for Agentic AI
Singapore's IMDA launched the Model AI Governance Framework for Agentic AI in January 2026. It is the first government framework written for AI agents that plan and act on their own. It is voluntary, but organizations remain legally accountable for their agents' actions.
IMDA Model AI Governance Framework
Singapore’s media and data regulators, IMDA and PDPC, issued this voluntary AI governance framework. It guides responsible deployment through human oversight, decision accountability, and operational transparency.
ISO/IEC 42001:2023 - Artificial Intelligence Management System
ISO and IEC published ISO/IEC 42001:2023 in December 2023 as the first international AI management system standard. It sets requirements for establishing, maintaining, and improving an AI Management System. Organizations developing or using AI products and services can seek independent certification.
ISO/IEC 23894 AI Risk Management
ISO/IEC 23894 explains how to integrate AI risks into enterprise risk management. It adapts ISO 31000 risk terms and processes to traits specific to AI. These include unexpected behavior, reliance on data, hard-to-explain decisions, and complex effects on people and organizations.
ISO/IEC TR 24028:2020, Overview of Trustworthiness in Artificial Intelligence
ISO/IEC 24028:2020 explains AI trustworthiness concepts, characteristics, and threats. It provides technical and organizational approaches for assessing and improving trustworthiness throughout an AI system's life.
ISO/IEC 24029 Robustness of Neural Networks (TR 24029-1:2021 and 24029-2:2023)
ISO/IEC 24029 covers mathematical proof methods and practical assessments of artificial neural network robustness (how reliably a network performs when its inputs are unusual or manipulated). Its parts address deliberately misleading inputs, shifts in real-world data, and other failure modes relevant to trustworthy deployment.
ITU Focus Group on Trust and Identity for Humans and Agentic AI
The International Telecommunication Union (ITU) launched a Focus Group on trusted digital identity and accountable behavior throughout the lifecycles of AI agents. It addresses agent identification, credentials, authorization, and agent-to-agent interactions. The work concerns organizations developing or deploying agents with delegated authority or external system access.
Japan AI Basic Plan (second plan, July 2026)
Japan's Cabinet adopted its second AI Basic Plan on 14 July 2026, replacing the first plan of December 2025. It responds to the rapid rise of agentic AI and puts domain-specific 'vertical AI' and physical AI at the centre of Japan's strategy. It directs government policy and places no direct duties on companies.
Japan Principles-Code for Protection of Intellectual Property and Transparency for the Appropriate Use of Generative AI
Japan's Intellectual Property Strategy Headquarters adopted this code on 25 August 2026, after a draft in December 2025. It asks generative AI developers and providers, including overseas businesses serving Japan, to protect IP and be transparent on a comply-or-explain basis. Notifications open on 26 October 2026.
NIST AI 600-1 Generative AI Profile
This companion to NIST AI RMF 1.0 addresses generative AI risks. It covers large language models and multimodal foundation models (general-purpose models that handle text, images, and audio).
NIST AI Risk Management Framework (AI RMF 1.0) and Playbook
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework for managing the risks of AI systems. It organizes the work into four functions: Govern, Map, Measure, and Manage. Its companion Playbook suggests concrete actions for each part. Any organization that builds or uses AI can adopt it, and some laws and contracts point to it.
NIST Artificial Intelligence Technology Evaluation Program
NIST's AI Technology Evaluation (AITE) program, launched in July 2026, is a voluntary testing program. Data providers submit non-public datasets and tasks, model providers submit models, and NIST scores them in a sequestered testbed. It sets no requirements for organizations.
OECD AI Principles
The OECD AI Principles were the first intergovernmental AI standard. They set five values-based principles and five government recommendations supporting trustworthy AI, human rights, and democratic values.
OECD Report: Governing with Artificial Intelligence
This OECD report examines government AI use across member and partner countries. Public-service improvements account for 57% of documented applications, while 45% support administrative decisions. Identified risks include biased data used to train systems, limited transparency, and overreliance on automated outputs.
OWASP Top 10 for Large Language Model Applications
OWASP's Top 10 for LLM Applications lists the most critical security risks in applications built on large language models. The current 2026 edition, published in August 2026, puts prompt injection, sensitive information disclosure, and excessive agency at the top. Development and security teams use it to prioritize safeguards.
The Role of Investors in AI Governance
This April 2026 research paper from Oxford's AI Governance Initiative reports how institutional investors approach AI governance. It draws on six roundtables with 62 investors and 60 interviews, mostly about public equities. It describes current practice and the support investors want, rather than setting requirements.
Singapore Consensus on Global AI Safety Research Priorities
The Singapore Consensus is a research agenda for AI safety, written by an expert committee after a scientific exchange Singapore hosted in April 2025. It groups research priorities into development, assessment, and control. It is not a government declaration, has no signatories, and was updated by a 2026 edition.
Singapore Global AI Assurance Sandbox
IMDA and the AI Verify Foundation launched the Global AI Assurance Sandbox on 7 July 2025. It matches builders and deployers of generative and agentic AI applications with specialist technical testing firms. It offers no regulatory relief, and test results stay confidential to the participants.
Singapore National AI Strategy 2.0
Singapore's National AI Strategy 2.0, launched on 4 December 2023, sets out 15 actions over three to five years. A May 2026 update added 10 refreshed priorities, building on it rather than replacing it.
UK AI Opportunities Action Plan
The UK published its AI Opportunities Action Plan in January 2025. It sets the Labour government’s adoption and infrastructure agenda for public bodies, developers, and AI enterprises. Commitments include AI Growth Zones, expanded computing infrastructure, and a National Data Library giving developers access to public data.
UK AI Regulation Framework
The UK AI Regulation Framework assigns primary oversight to existing sector regulators using shared principles. Following January 2025’s AI Opportunities Action Plan, the approach is moving toward a more structured legislative basis.
UK-Canada Memorandum of Understanding on AI Compute
The UK and Canada signed a Memorandum of Understanding on compute in Ottawa on 31 January 2024. It sets out joint intent to collaborate, including exploring how to give researchers and industry secure, affordable access to computing capacity. It creates no binding commitments or private-sector duties.
ICO Guidance on AI and Data Protection
The UK Information Commissioner's Office (ICO) secured commitments from ten major AI developers to strengthen data protection practices covering transparency, individuals' rights, lawful grounds for processing personal data, and safeguards for AI training and deployment. The ten companies named are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. Alongside this, the ICO opened a six-week call for evidence on agentic AI, which refers to AI systems that act autonomously on behalf of users, completing tasks with little or no human input at each step.
Global Dialogue on AI Governance (UN General Assembly Resolution A/RES/79/325)
UN Resolution A/RES/79/325 established the Global Dialogue on AI Governance, open to states and other stakeholders. The first Dialogue met in Geneva on 6 and 7 July 2026, informed by 1,532 written submissions. The second is set for New York on 3 and 4 May 2027.
UN Independent International Scientific Panel on AI: Preliminary Report and AI Agents Thematic Brief
The UN's Independent International Scientific Panel on AI released its preliminary report on AI opportunities, risks, and impacts on 1 July 2026. Its first thematic brief, on AI agents and the risk of losing human control, followed on 21 September 2026. The Panel provides scientific assessment and does not set rules.
Financial Services AI Risk Management Framework (FS AI RMF)
The US Treasury released the Financial Services AI Risk Management Framework on 19 February 2026, with the Cyber Risk Institute. It adapts the NIST AI RMF into 230 control objectives for financial institutions, organized by AI adoption stage. It is voluntary guidance, released alongside a shared AI lexicon.
Verifiable Semiconductor Manufacturing
An April 2026 research paper from Oxford's AI Governance Initiative on verifying the integrity of AI chips from design through manufacturing. It argues for defense in depth, tiered by chip criticality, with neutral third-party verifiers. It sets no requirements for anyone.
Veritas Consortium AI Fairness Testing Methodology
Singapore's financial regulator (MAS) and a financial-sector consortium developed this assessment method for responsible AI. It applies fairness, ethics, accountability, and transparency principles to financial services.
White House Artificial Intelligence Oversight Framework
The White House finalized a voluntary framework for testing the most advanced AI models' cyber capabilities before release, under the June 2026 executive order. It presented the framework to AI companies on 4 August 2026 and has not published the text.