{"sections": [{"components": [{"component_name": "heading", "heading": "Lifecycle AI governance: what NIST and the EU AI Act together require", "level": 1}, {"component_name": "paragraph", "paragraph": "The NIST AI RMF and its Playbook treat AI governance as a **full lifecycle control system** spanning govern, map, measure, and manage, with supporting practices such as documentation, testing, monitoring, supplier oversight, and decommissioning.[[cite:1]][[cite:2]][[cite:3]] These are **voluntary best-practice controls** in the NIST materials, while the EU AI Act imposes **binding legal obligations** only for the actors, system types, and risk categories it covers.[[cite:4]]"}, {"component_name": "paragraph", "paragraph": "A useful way to read the two sources together is this: NIST describes the governance architecture an organization should build across the lifecycle, while the EU AI Act specifies the legal minimums for high-risk systems, GPAI models, and certain generative AI uses, especially around documentation, logging, human oversight, monitoring, and incident reporting.[[cite:5]][[cite:6]][[cite:7]][[cite:8]][[cite:9]][[cite:10]]"}]}, {"components": [{"component_name": "heading", "heading": "Lifecycle comparison: voluntary governance controls versus binding EU AI Act duties", "level": 2}, {"component_name": "table", "table": "

Lifecycle area	NIST AI RMF and Playbook: voluntary best-practice governance	EU AI Act: binding legal obligation when applicable
Govern	Set policies, roles, accountability, communication lines, training, risk tolerance, and oversight, and connect AI governance to existing organizational and data governance.[[cite:11]][[cite:12]]	The Act uses a risk-based framework and assigns obligations according to system risk and actor role in the value chain.[[cite:13]]
Map	Define intended purpose and context of use, document limits, and map impacts and third-party, legal, and rights-related risks.[[cite:14]][[cite:15]][[cite:16]]	For high-risk systems, providers must give clear, adequate information for deployers and sufficient documentation for authorities to assess compliance.[[cite:17]][[cite:18]]
Measure	Select metrics and methods; run TEVV and red-teaming; test validity, safety, security, resilience, fairness, privacy, bias, explainability, and environmental impact.[[cite:19]][[cite:20]][[cite:21]]	The source does not set a broad standalone test regime, but high-risk obligations include high-quality datasets, logging, and documentation that support compliance and traceability.[[cite:22]][[cite:23]]
Manage	Prioritize risks, choose mitigation, transfer, avoidance, or acceptance, plan incident response and recovery, monitor deployed systems, and deactivate or retrain systems when needed.[[cite:24]][[cite:25]][[cite:26]]	Providers and deployers must report serious incidents and malfunctioning; providers of high-risk systems must maintain post-market monitoring, and deployers must ensure human oversight and monitoring.[[cite:27]][[cite:28]][[cite:29]][[cite:30]]
Documentation	Keep inventories, system cards, model cards, logs, change histories, benchmark comparisons, monitoring results, incidents, residual risks, and transparency artifacts.[[cite:31]][[cite:32]][[cite:33]]	High-risk systems must have detailed documentation that lets authorities assess compliance and understand the system and its purpose.[[cite:34]][[cite:35]]
Testing	Use pre-deployment testing, internal and external evaluations, structured public feedback, adversarial testing, and review of guardrails and safety features.[[cite:36]][[cite:37]][[cite:38]]	Testing is not described as a separate universal duty in the source summary, beyond the pre-market quality, logging, and documentation obligations for high-risk systems.[[cite:39]]
Monitoring	Continuously monitor risk over time and track changes, incidents, and residual risks.[[cite:40]][[cite:41]]	Post-market monitoring is required for providers of high-risk systems, and deployers must monitor systems once on the market.[[cite:42]][[cite:43]]
Supplier management	Vet suppliers, maintain third-party inventories, use contracts and SLAs, require transparency and auditability, and plan for third-party failures or redundancies.[[cite:44]][[cite:45]][[cite:46]]	The Act\u2019s obligations can depend on role in the value chain, and the Commission\u2019s guidance is meant to help actors understand who must comply with GPAI obligations.[[cite:47]][[cite:48]][[cite:49]]
Decommissioning	Plan safe shutdown, phase-out, or retirement, manage dependencies and leakage risks, and avoid increasing risk during migration or decommissioning.[[cite:50]][[cite:51]][[cite:52]]	The source summary does not frame decommissioning as a standalone legal duty, but it does require post-market monitoring and incident handling while systems remain in use.[[cite:53]][[cite:54]][[cite:55]]

"}]}, {"components": [{"component_name": "heading", "heading": "What the EU AI Act adds beyond the NIST lifecycle model", "level": 2}, {"component_name": "list", "list": ["**Risk-tiered legal triggers:** the Act defines four risk levels and bans certain AI practices outright because they are considered a clear threat to safety, livelihoods, and rights.[[cite:56]][[cite:57]]", "**High-risk pre-market controls:** high-risk systems face strict obligations before market placement, including high-quality datasets, logging, detailed documentation, and clear information for deployers.[[cite:58]][[cite:59]]", "**Role-specific duties:** responsibilities differ for providers, deployers, and other value-chain actors, so compliance is not only about the system but also about the actor\u2019s role.[[cite:60]][[cite:61]][[cite:62]]", "**Generative AI and GPAI:** providers must make AI-generated content identifiable, label certain content such as deep fakes and public-interest text, and for GPAI models provide transparency and copyright-related compliance, plus risk assessment and mitigation for systemic-risk models.[[cite:63]][[cite:64]][[cite:65]][[cite:66]]", "**Human oversight is necessary but not sufficient:** the Act pairs human oversight with monitoring, post-market monitoring, incident reporting, and documentation rather than treating oversight alone as enough.[[cite:67]][[cite:68]][[cite:69]][[cite:70]]"], "ordered": false}, {"component_name": "paragraph", "paragraph": "In practice, the governance stack is strongest when NIST-style lifecycle controls are used to operationalize the EU\u2019s binding duties: pre-market testing and documentation support high-risk compliance, supplier controls support value-chain accountability, and monitoring and incident reporting support post-market obligations.[[cite:71]][[cite:72]][[cite:73]][[cite:74]][[cite:75]]"}, {"component_name": "divider", "divider": "true"}, {"component_name": "heading", "heading": "Bottom line", "level": 2}, {"component_name": "paragraph", "paragraph": "NIST says good AI governance should cover the whole lifecycle, including govern, map, measure, manage, documentation, testing, monitoring, suppliers, and decommissioning, but these are guidance controls, not law.[[cite:76]][[cite:77]][[cite:78]] The EU AI Act turns several of those same lifecycle controls into enforceable obligations only for specific risk categories and actor roles, especially high-risk systems, GPAI providers, and certain generative AI uses.[[cite:79]][[cite:80]][[cite:81]]"}]}]}

What is the name of the ISO standard governing AI risk management published in 2023?

Explorer des sujets liés