Last reviewed:
Explainer slide: a shield with a check mark linked to the EU AI Act, NIST AI RMF and ISO 42001, above a row of checked boxes.

AI Governance Gap Check: 24 Questions Mapped to the EU AI Act, NIST AI RMF and ISO 42001

Answer 24 yes-or-no questions about how your organization uses AI, and see where it stands against the three frameworks buyers and regulators ask about most: the EU AI Act, the NIST AI Risk Management Framework and ISO/IEC 42001. Each question shows the articles, functions and controls it maps to, so the gaps become a work list. It is free, needs no sign-up and keeps your answers in your browser.

The gap check

Tick each statement that is true today, with evidence you could show an auditor. Your score and the subscore for each area update as you go.

Your readiness score0/24Check the items that are true today.
Inventory and accountability 0/6

You cannot govern AI you have not listed or that nobody owns.

Use-case risk and impact 0/4

Obligations depend on what a system is used for and who it affects.

Human oversight and use 0/5

Oversight only counts if trained people can actually override the system.

Data, monitoring and logs 0/4

Models drift and inputs change; you need evidence of how a system behaved.

Incidents and transparency 0/3

Disclosure and incident duties carry the Act's second-highest penalty tier.

Vendors and supply chain 0/2

Most organizations deploy models and tools they did not build.

The three frameworks at a glance

EU AI ActNIST AI RMF 1.0ISO/IEC 42001:2023
What it isEU law: Regulation (EU) 2024/16891A voluntary US framework5An international management-system standard7
Who it applies toProviders and deployers of AI systems placed on the EU market or used in the EUAny organization that chooses to use itAny organization that chooses to adopt it
StructureRisk tiers: prohibited, high-risk, transparency duties, general-purpose modelsFour functions - Govern, Map, Measure, Manage - with 19 categories and 72 subcategories6Clauses 4 to 10 plus Annex A: 38 controls in 9 areas8
ProofConformity assessment for high-risk systems; fines for breachesNone; self-assessedThird-party certification is available

EU AI Act dates after the Digital Omnibus

The EU's Digital Omnibus on AI, in force since 07-27-2026, pushed back the high-risk obligations12. The current timeline:

DateWhat applies
08-01-2024The Act enters into force
02-02-2025Prohibited practices banned; AI literacy duties apply
08-02-2025Obligations for general-purpose AI models and governance rules
08-02-2026General application, including most transparency duties
12-02-2027High-risk obligations for Annex III uses such as hiring, credit and essential services (delayed by the Omnibus)
08-02-2028High-risk obligations for AI built into regulated products under Annex I (delayed by the Omnibus)

Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for breaches of most operator duties, including deployer and transparency obligations; smaller companies pay the lower of the two figures4.

What deployers of high-risk systems must do

Most buyers of AI services are deployers, not providers. Article 26 sets their duties for high-risk systems3:

  • Use the system as the provider's instructions say, and assign human oversight to trained people with authority.
  • Make sure input data you control is relevant and representative.
  • Monitor the system, and report risks and serious incidents.
  • Keep the logs the system generates for at least six months.
  • Tell workers before workplace use, and tell people when a high-risk system helps make decisions about them.

Put these in the contract with any DeployCo that builds or runs the system for you; see Evaluating a DeployCo and the contract red flags on Downloads.

How to use the result

  1. Print or save the result as a PDF, with the unchecked items, for your risk or compliance owner.
  2. Close the gaps in the first area (inventory and accountability) first: every other control depends on knowing what you run and who owns it.
  3. For any system that may be high-risk, ask counsel to confirm its classification before 12-02-2027.
  4. Repeat the check when you add a system or a vendor, or when the law changes.

This is a self-assessment, not legal advice or a certification audit. Article references are to the Act as amended; check current text before relying on a specific obligation.

Frequently asked questions

Does the EU AI Act apply to US companies?

Yes, if they place AI systems on the EU market or their systems' output is used in the EU. Location of the company does not exempt it.

When do the EU AI Act high-risk rules apply?

After the 2026 Digital Omnibus, from 12-02-2027 for Annex III uses such as hiring and credit, and from 08-02-2028 for AI built into regulated products.

What is the difference between NIST AI RMF and ISO 42001?

NIST AI RMF is a free, voluntary framework for managing AI risk. ISO/IEC 42001 is a management-system standard that an organization can be certified against by an accredited body. Many organizations use NIST for practice and ISO 42001 for proof.

Is this check a substitute for legal advice?

No. It shows where controls are missing. Whether a specific system is high-risk, and what it must do, is a question for counsel.

References

  1. European Commission, "AI Act: regulatory framework for AI," updated 10-19-2026. digital-strategy.ec.europa.eu
  2. White & Case, "EU AI Omnibus enters into force, amending the AI Act," 2026. whitecase.com
  3. EU AI Act, Article 26: Obligations of deployers of high-risk AI systems. artificialintelligenceact.eu
  4. EU AI Act, Article 99: Penalties; official text on EUR-Lex. artificialintelligenceact.eu; eur-lex.europa.eu
  5. NIST, AI Risk Management Framework. nist.gov
  6. NIST AI Resource Center, AI RMF Core (functions, categories and subcategories). airc.nist.gov
  7. ISO, ISO/IEC 42001:2023 Artificial intelligence - Management system. iso.org
  8. RiskProfs, "ISO 42001 Annex A controls list." riskprofs.com