Standards Comparison — Unified AI Security & Governance Landscape

Five instruments dominate enterprise AI security and governance in 2024–2025. This page maps their scope, legal status, structure, and cross-references to enable a single control framework.

Primary sources: NIST AI RMF (NIST AI 100-1), NIST AI 600-1, Regulation (EU) 2024/1689, ISO/IEC 42001:2023, OWASP LLM Top 10 (2025), MITRE ATLAS v2.3.

At a Glance

Standard	Type	Legal Status	Scope	Primary Audience
NIST AI RMF	Risk management framework	Voluntary (US); de facto for US federal	All AI systems; lifecycle risk	Risk officers, CISOs, engineers
NIST AI 600-1	Generative AI profile	Voluntary (US); companion to AI RMF	Generative AI specific	GenAI developers, red teams
EU AI Act	Regulation (law)	Mandatory in EU; extraterritorial	Providers/deployers in EU market	Legal, compliance, product
ISO/IEC 42001	Management system standard	Voluntary; certifiable	Organisational AI governance	Management, auditors, procurement
OWASP LLM Top 10	Awareness document	Voluntary; community	LLM application security	AppSec, developers, architects
MITRE ATLAS	Threat knowledge base	Voluntary; open	Adversarial ML threat modelling	Threat analysts, red teams

Scope & Applicability Matrix

Criterion	NIST AI RMF / 600-1	EU AI Act	ISO 42001	OWASP LLM	MITRE ATLAS
Geographic scope	Global (voluntary)	EU + extraterritorial	Global (voluntary)	Global	Global
AI system types	All AI	All AI (risk-tiered)	All AI	LLM applications	ML systems broadly
Lifecycle coverage	Full (design → retire)	Full (conformity assessment)	Full (PDCA)	Development/ops	Attack lifecycle
Mandatory?	No	Yes (phased 2025–2027)	No (certifiable)	No	No
Enforcement	N/A	Market surveillance, fines up to 7% global turnover	Certification bodies	Community	N/A
Certification path	N/A	CE marking + notified body	Accredited CB (ISO 17021)	N/A	N/A

Structural Comparison

NIST AI RMF (AI 100-1) — Four Functions

Function	Sub-functions	Purpose
Govern	1.1–1.6	Culture, policies, accountability, diversity
Map	2.1–2.3	Context, risk identification, stakeholders
Measure	3.1–3.3	Metrics, testing, monitoring, TEVV
Manage	4.1–4.3	Prioritisation, treatment, monitoring

AI 600-1 adds 12 GAI-specific risk areas (§2.1 to §2.12) with 400+ actions mapped to RMF functions.

EU AI Act — Risk Tiers & Obligations

Tier	Examples	Provider Obligations	Deployer Obligations
Prohibited (Art. 5)	Social scoring, real-time biometric ID in public, subliminal manipulation	Ban — cannot place on market	N/A
High-Risk (Art. 6, Annex III)	Recruitment, credit scoring, critical infra, medical devices, law enforcement	Conformity assessment, QMS, technical docs, post-market monitoring, registration	Use per instructions, human oversight, incident reporting, logs
Limited/Transparency (Art. 50)	Chatbots, deepfakes, emotion recognition	Transparency notices, watermarking	Inform users
Minimal	Spam filters, recommender systems	None	None

GPAI (General-Purpose AI) — Chapter V: Systemic risk models (>10²⁵ FLOPs) → additional eval, adversarial testing, incident reporting, cybersecurity.

ISO/IEC 42001 — Annex A Controls (38 controls, 10 domains)

Domain	Controls	Focus
A.1 AI Policy	A.1.1–A.1.4	Policy, objectives, alignment
A.2 Internal Organisation	A.2.1–A.2.3	Roles, responsibilities, committees
A.3 AI Asset Management	A.3.1–A.3.3	Inventory, lifecycle, data assets
A.4 AI Risk Management	A.4.1–A.4.4	Assessment, treatment, acceptance
A.5 AI System Development	A.5.1–A.5.5	Requirements, design, verification, deployment
A.6 AI System Operation	A.6.1–A.6.3	Monitoring, incident response, change mgmt
A.7 AI System Performance	A.7.1–A.7.3	Evaluation, metrics, improvement
A.8 AI Supplier Management	A.8.1–A.8.3	Procurement, monitoring, termination
A.9 AI Data Management	A.9.1–A.9.3	Quality, provenance, privacy
A.10 AI Governance	A.10.1–A.10.3	Policy, roles, communication

OWASP LLM Top 10 — Risk Prioritisation

Rank	ID	Risk	Primary Mitigation Pattern
1	LLM01	Prompt Injection	Input validation, instruction hierarchy, output encoding
2	LLM02	Insecure Output Handling	Output validation, sandboxing, least privilege
3	LLM03	Training Data Poisoning	Data provenance, anomaly detection, signed datasets
4	LLM04	Model DoS	Rate limiting, context limits, complexity budgets
5	LLM05	Supply Chain Vulnerabilities	SBOM, model signing, dependency scanning
6	LLM06	Sensitive Info Disclosure	Data filtering, embedding sanitisation, access control
7	LLM07	Insecure Plugin Design	Capability-based auth, plugin sandboxing
8	LLM08	Excessive Agency	Human-in-the-loop, action confirmation, policy engine
9	LLM09	Overreliance	Uncertainty quantification, human review gates
10	LLM10	Model Theft	Rate limiting, watermarking, API authentication

MITRE ATLAS — Tactics × Techniques

Tactic	Technique Count	Key for LLMs
Reconnaissance	8	Public model/dataset search
Resource Development	7	Acquire compute, craft datasets
Initial Access	5	Supply chain, valid accounts
ML Model Access	6	White/grey/black-box extraction
Execution	4	Code execution via plugins
Persistence	3	Poisoned model registry
Privilege Escalation	3	Escalate via plugin permissions
Defense Evasion	6	Evade detection, obfuscate prompts
Credential Access	3	Steal API keys, registry tokens
Discovery	5	Enumerate models, versions, data
Collection	4	Harvest outputs, embeddings
ML Attack Staging	9	Adversarial examples, poisoning, prompt injection
Exfiltration	5	Model extraction, data exfiltration
Impact	5	Degrade, misclassify, deny service

Cross-Reference: Unified Control Mapping

Control Objective	NIST AI RMF	EU AI Act	ISO 42001	OWASP LLM	MITRE ATLAS
AI Inventory	Govern-1.1, Map-2.1	Art. 11 (Technical docs)	A.3.1	—	Discovery (TA0010)
Risk Assessment	Map-2.2, Measure-3.1	Art. 9 (Risk mgmt)	A.4.1–A.4.3	Threat modelling	Recon (TA0001)
Data Governance	Map-2.3, Measure-3.2	Art. 10 (Data governance)	A.9.1–A.9.3	LLM03, LLM06	Collection (TA0011)
Model Testing/TEVV	Measure-3.1–3.3	Art. 15 (Accuracy/robustness)	A.7.1–A.7.3	LLM01, LLM04	ML Attack Staging (TA0012)
Human Oversight	Govern-1.5, Manage-4.2	Art. 14 (Human oversight)	A.5.4, A.6.2	LLM08, LLM09	—
Incident Response	Manage-4.3	Art. 20 (Post-market), Art. 73 (Incidents)	A.6.2	—	Impact (TA0014)
Supply Chain	Govern-1.6, Map-2.1	Art. 25 (Provider), Art. 28 (Deployer)	A.8.1–A.8.3	LLM05	Resource Dev (TA0002)
Adversarial Robustness	Measure-3.2, Manage-4.1	Art. 15 (Robustness), Art. 55 (GPAI)	A.7.2	LLM01, LLM04	ML Attack Staging (TA0012)
Transparency/Docs	Govern-1.3, Map-2.1	Art. 11, 13, 50	A.10.3	LLM02, LLM09	—
Monitoring/Logging	Measure-3.3, Manage-4.3	Art. 12 (Record-keeping), Art. 20	A.6.1	LLM02, LLM07	Collection (TA0011)

Phased EU AI Act Timeline (Key Dates)

Date	Milestone
1 Aug 2024	Regulation enters into force
2 Feb 2025	Prohibited AI practices ban applies (Art. 5)
2 Aug 2025	GPAI obligations apply (Chapter V)
2 Aug 2026	High-risk AI systems (Annex III) — full conformity assessment
2 Aug 2027	High-risk AI as safety components (Annex II) — medical devices, machinery, etc.
2 Aug 2028	AI systems in large-scale IT systems (Schengen, Eurodac, etc.)

Note: Existing high-risk systems on market before 2 Aug 2026 have until 2 Aug 2027 to comply if not substantially modified.

Recommended Integration Approach

Adopt NIST AI RMF as the master framework — functions map to all others
Layer EU AI Act obligations — mandatory where applicable; use as compliance floor
Implement ISO 42001 Annex A — certifiable management system; covers governance gaps
Apply OWASP LLM Top 10 — tactical controls for LLM-specific attack surface
Use MITRE ATLAS — threat modelling enrichment; red team scenario design
Maintain a single control register — each control tagged with: RMF function, EU AI Act article, ISO 42001 control, OWASP LLM ID, ATLAS technique

Citation Register

Standard	Instrument	Date	URL	Version
NIST AI RMF	NIST AI 100-1	Jan 2023	https://doi.org/10.6028/NIST.AI.100-1	1.0
NIST AI 600-1	Generative AI Profile	July 2024	https://doi.org/10.6028/NIST.AI.600-1	1.0
EU AI Act	Regulation (EU) 2024/1689	12 July 2024	https://eur-lex.europa.eu/eli/reg/2024/1689/oj	Final
ISO 42001	ISO/IEC 42001:2023	Dec 2023	https://www.iso.org/standard/81230.html	2023
OWASP LLM Top 10	OWASP Top 10 for LLM Apps	Oct 2025	https://owasp.org/www-project-top-10-for-large-language-model-applications/	v1.1
MITRE ATLAS	MITRE ATLAS™	2024	https://atlas.mitre.org/	v2.3