{ "post": { "title": "AI transformation frameworks compared: which one is for what", "url": "https://bardak.ai/posts/ai-transformation-frameworks-compared", "updated": "2026-10-29T18:56:27.872Z" }, "citation": "AI transformation frameworks compared: which one is for what, Ivan Bardak, bardak.ai, https://bardak.ai/posts/ai-transformation-frameworks-compared", "datasets": [ { "key": "which-framework-answers-which-question", "title": "Which framework answers which question", "type": "benchmarkTable", "source": "European Commission; ISO; NIST; Microsoft; Google; Gartner; OECD (all accessed October 2026)", "caption": "Most organisations operating in Europe need the first three in some form, and one roadmap model.", "csv": "https://bardak.ai/data/ai-transformation-frameworks-compared/which-framework-answers-which-question.csv", "header": [ "Framework", "Question it answers", "Mandatory", "Certifiable", "Current status" ], "rows": [ [ "EU AI Act", "What must we do, by law, for each AI system?", "Yes, for AI placed on the market or used in the EU", "No; conformity assessment for some high-risk systems", "In force since August 2024; amended by the AI Omnibus in July 2026" ], [ "ISO/IEC 42001", "How do we run AI governance so it can be audited?", "No", "Yes, by accredited certification bodies", "Published December 2023" ], [ "NIST AI RMF 1.0", "How do we find, measure and manage the risks of a system?", "No", "No", "Published January 2023; Generative AI Profile July 2024; revision in progress" ], [ "Maturity and adoption models (Microsoft, Google, Gartner)", "Where are we, and what should we do next?", "No", "No", "Vendor documents, tied to their products or paid research" ], [ "OECD AI Principles", "Which values should guide AI use?", "No", "No", "Adopted 2019, updated May 2024" ] ] }, { "key": "how-the-frameworks-fit-together", "title": "How the frameworks fit together", "type": "knowledgeGraph", "source": "European Commission (October 2026); ISO; NIST", "caption": "Hover an entity to see what it connects to. The harmonised standard EN 18286 is the formal bridge between ISO-style management systems and the AI Act. Maturity models sit outside this map: they plan the roadmap rather than define obligations or controls.", "csv": "https://bardak.ai/data/ai-transformation-frameworks-compared/how-the-frameworks-fit-together.csv", "header": [ "source", "target", "relation" ], "rows": [ [ "EU AI Act", "Legal obligations", "sets" ], [ "EN 18286", "EU AI Act", "gives presumption of conformity for Article 17" ], [ "EN 18286", "ISO/IEC 42001", "designed to layer on" ], [ "ISO/IEC 42001", "Management system", "defines" ], [ "ISO/IEC 42006", "ISO/IEC 42001", "sets rules for certifying" ], [ "NIST AI RMF", "Risk assessment", "guides" ], [ "NIST AI 600-1", "NIST AI RMF", "profiles for generative AI" ], [ "Risk assessment", "Management system", "feeds" ], [ "Management system", "Legal obligations", "evidences" ] ] }, { "key": "eu-ai-act-what-applies-when", "title": "EU AI Act: what applies when", "type": "benchmarkTable", "source": "European Commission, AI Act Service Desk: Timeline for the implementation of the EU AI Act", "caption": "As amended by the AI Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026.", "csv": "https://bardak.ai/data/ai-transformation-frameworks-compared/eu-ai-act-what-applies-when.csv", "header": [ "Date", "What applies" ], "rows": [ [ "1 August 2024", "The Act enters into force" ], [ "2 February 2025", "Prohibited practices and the AI literacy duty" ], [ "2 August 2025", "Obligations for general-purpose AI models, and governance" ], [ "2 August 2026", "General application: transparency rules (Article 50) and enforcement" ], [ "2 December 2026", "New ban on systems that generate non-consensual intimate images or child sexual abuse material; marking deadline for generative systems already on the market" ], [ "2 December 2027", "High-risk systems in Annex III, such as employment, education, biometrics and critical infrastructure (originally 2 August 2026)" ], [ "2 August 2028", "High-risk AI in regulated products under Annex I, such as medical devices and machinery (originally 2 August 2027)" ] ] }, { "key": "three-maturity-and-adoption-models", "title": "Three maturity and adoption models", "type": "benchmarkTable", "source": "Microsoft Learn; Google Cloud whitepaper (2020); Gartner AI maturity model toolkit", "caption": "", "csv": "https://bardak.ai/data/ai-transformation-frameworks-compared/three-maturity-and-adoption-models.csv", "header": [ "Model", "Stages or phases", "What to keep in mind" ], "rows": [ [ "Microsoft Cloud Adoption Framework for AI", "Plan, Ready, Govern, Secure, Manage", "Practical and current (updated October 2026), but built around Azure" ], [ "Google Cloud AI Adoption Framework", "Tactical, Strategic, Transformational, across six themes: Learn, Lead, Access, Scale, Automate, Secure", "Useful structure, but from 2020, before generative AI" ], [ "Gartner AI Maturity Model", "Foundational, Emerging, Operational, Scaled, Transformational, across seven pillars", "Full model is for paying clients" ] ] }, { "key": "a-practical-combination", "title": "A practical combination", "type": "benchmarkTable", "source": "", "caption": "The last row is the gap: no governance framework tells you whether an AI investment pays off.", "csv": "https://bardak.ai/data/ai-transformation-frameworks-compared/a-practical-combination.csv", "header": [ "Step in the programme", "Framework that does the work", "Output" ], "rows": [ [ "Inventory and classify every AI system", "EU AI Act risk tiers and roles", "A register with tier, role and owner per system" ], [ "Set up accountability and policies", "ISO/IEC 42001, or NIST Govern if certification is not needed", "AI policy, roles, approval and audit process" ], [ "Assess each system before launch", "NIST Map and Measure, with the Generative AI Profile", "Risk assessment and test results per system" ], [ "Design technical controls", "NIST Manage, informed by the architecture", "Identity, logging, approvals and rollback built in" ], [ "Plan the roadmap", "One maturity model, used as a checklist", "Next two quarters of capability work" ], [ "Decide which investments to fund", "None of the above", "A business case with evidence and a pilot threshold" ] ] }, { "key": "appraising-the-evidence", "title": "Appraising the evidence", "type": "benchmarkTable", "source": "", "caption": "", "csv": "https://bardak.ai/data/ai-transformation-frameworks-compared/appraising-the-evidence.csv", "header": [ "Evidence", "Strength", "Main limitation" ], "rows": [ [ "EU AI Act and Commission guidance", "Authoritative: it is the law", "Guidance and standards are still arriving; dates have already moved once" ], [ "ISO/IEC 42001 and NIST AI RMF", "Broad expert consensus on good practice", "Little rigorous evidence that adopting them improves AI outcomes" ], [ "Vendor and analyst maturity models", "Useful structure", "Commercial interests; survey correlations, not causation" ], [ "My programme work", "Direct experience", "One practitioner" ] ] } ] }