CAIN-42 CAIN StudioCAGA · Module 1 of 5 · 16 min
The frameworks: EU AI Act, ISO/IEC 42001, NIST AI RMF
The EU AI Act (Regulation 2024/1689) sets obligations by risk class. For high-risk systems it requires record-keeping (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy, robustness and cybersecurity (Art. 15), and post-market monitoring (Art. 72). Application dates have shifted; check the current official timeline.
ISO/IEC 42001:2023 specifies an AI management system. Organisations are certified against it; individuals earn auditor or implementer credentials. Its Annex A groups controls into areas such as AI policies, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems and third-party relationships.
The NIST AI Risk Management Framework organises the work into four functions: Govern, Map, Measure and Manage.
Key points
- EU AI Act high-risk duties include Arts. 12, 13, 14, 15, 72.
- ISO/IEC 42001 certifies organisations, not people.
- NIST AI RMF: Govern, Map, Measure, Manage.
- Check current timelines; they move.
In the CAIN-42 codebase
cain/compliance.py— evidence-derived evaluation mapped to EU AI Act articles and ISO/IEC 42001 areas
Practice check
Practice 1 · choose one
Which EU AI Act article covers human oversight?
Practice 2 · true or false