AI transformation frameworks compared: which one is for what

Early in almost every AI transformation programme someone asks which framework we are following. The candidates arrive in a pile: the EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework, a maturity model from a consultancy, the cloud provider's adoption framework. Teams then spend weeks comparing them as if they had to pick one.

They do not. These documents answer different questions, and most organisations need two or three of them, each for its own job. This post sets out what each one is for, what is mandatory and what is not, and how I combine them.

The short answer: the EU AI Act tells you what you must do, by law, depending on the risk of each system and your role. ISO/IEC 42001 tells you how to run AI governance as a management system that an auditor can certify. The NIST AI RMF gives you a method for finding, measuring and managing the risks of a particular system. Maturity and adoption models help you decide what to do next. None of them tells you whether a given AI investment pays off; that needs its own evidence.

The frameworks at a glance

They also depend on each other, which is easier to see as a map:

EU AI Act: obligations by risk and role

The AI Act is law, and it applies to providers, deployers, importers and distributors, including companies outside the EU whose AI is used inside it (European Commission). Obligations depend on the risk tier of each system and on your role. In July 2026 the AI Omnibus amended it, most visibly by moving the high-risk deadlines (legislative record). The dates as they stand now, also kept up to date in EU AI Act dates and guidance, tracked:

Two details matter for planning. The AI literacy duty survived the Omnibus in a softer form: providers and deployers must take measures to support their staff's AI literacy, without having to guarantee any particular level (Article 4). And the fines are large enough to put the Act on a board agenda: up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for most other obligations, with lower caps for small companies (Article 99).

What the Act does not give you is a way of working. It says what must be true, for example a quality management system for high-risk providers, not how to organise the people and processes that make it true. That is where the next two come in.

ISO/IEC 42001: governance you can audit

ISO/IEC 42001, published in December 2023, is a management system standard for AI, built the same way as ISO 27001 for information security: policies, objectives, roles, risk treatment, internal audit and continual improvement (ISO). It is not mandatory: the AI Act does not require it, and certification is voluntary and done by independent certification bodies, not by ISO itself (ISO), and a companion standard, ISO/IEC 42006 from July 2025, sets the rules for those bodies (ISO/IEC 42006).

Its value is that it turns good intentions into a repeatable, evidenced process, which is what customers and procurement teams increasingly ask for. AWS, Google Cloud, Microsoft and Anthropic have all announced certifications for their AI services. In October 2026 the first harmonised standard under the AI Act, EN 18286 for quality management, was published in the Official Journal; the Commission describes it as designed to be layered on top of standards such as ISO/IEC 42001 (European Commission). A 42001 certificate on its own does not give the legal presumption of conformity that the harmonised standard does, but it is a natural starting point.

NIST AI RMF: a method for risk

The NIST AI Risk Management Framework is voluntary, not tied to any sector or use case, and not certifiable (NIST). It organises risk work into four functions: Govern sets the culture, policies and accountability and runs through everything else; Map establishes the context of a system and its risks; Measure analyses, tests and monitors them; Manage allocates resources to the risks found and responds to incidents. Its Generative AI Profile (NIST AI 600-1, July 2024) lists twelve risks that generative AI creates or makes worse, from confabulation and data privacy to information security and value chain integrity, each with suggested actions.

I use it as the working method for assessing individual systems, because it is free, practical and maps cleanly onto both ISO and the AI Act. ISO/IEC 42001 against the NIST AI RMF, in one line: 42001 is the management system an auditor certifies, the RMF is the method for assessing each system inside it. One caveat: following the US AI Action Plan of July 2025, NIST is revising the framework, and as of October 2026 it says a revised version is in progress without having published one (NIST). The four functions are unlikely to change, but check for the new version before you build templates around specific subcategories.

Maturity and adoption models: where to go next

The roadmap layer comes mostly from vendors and analysts, and each names its stages differently:

Gartner reports that 45% of organisations with high AI maturity keep AI projects in production for at least three years, against 20% of those with low maturity (Gartner, June 2025). That is a correlation from a survey of 432 organisations, not proof that climbing the model causes success, but it fits what I see: mature organisations are better at stopping weak projects early and keeping good ones running.

How I combine them

The technical controls row is where governance meets architecture: delegated identity, drafts by default, tested rollback and measured reliability, as described in Agentic AI from demo to production. The funding row needs evidence of effect, which is thinner than most plans assume; see Does AI make developers faster? What the controlled studies say, what the MIT NANDA report's 95% actually measured, and Klarna's AI customer service; for the decision itself, A GraphRAG business case, done the evidence-based way, whose structure works for any AI investment.

How much weight this evidence deserves

Sources

• European Commission. AI Act: regulatory framework for AI.
• European Commission, AI Act Service Desk. Timeline for the implementation of the EU AI Act.
• AI Act Service Desk. Article 4: AI literacy (consolidated).
• AI Act Service Desk. Article 99: Penalties (consolidated).
• European Parliament Legislative Observatory. Procedure 2025/0359(COD): Digital Omnibus on AI.
• European Commission (October 2026). First harmonised standard supporting the AI Act published in the Official Journal.
• ISO. ISO/IEC 42001:2023 Artificial intelligence: Management system.
• ISO. ISO/IEC 42001 explained.
• ISO. ISO/IEC 42006:2025.
• NIST (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1.
• NIST (2024). Generative Artificial Intelligence Profile, NIST AI 600-1.
• NIST. AI Risk Management Framework page.
• Microsoft. Cloud Adoption Framework: AI adoption.
• Google Cloud (2020). AI Adoption Framework.
• Gartner. AI Maturity Model toolkit.
• Gartner (June 2025). Survey on AI maturity and how long AI projects stay operational.
• OECD. AI Principles.