We built this starter kit for technology and health care teams that build or use AI and have a customer, an auditor, or a regulator asking how they govern it. It compares the three frameworks people mean when they say AI governance, tells you which ones apply, and ends with an inventory you can fill in this week.

What's inside

• The three frameworks compared. ISO/IEC 42001:2023, NIST AI RMF, and the EU AI Act, with what each one asks of you.
• Who the EU AI Act applies to. Providers, deployers, and the other roles in Article 2.
• Which frameworks you need. Six questions with yes and no answers, and the combinations we'd start with.
• EU AI Act risk tiers. Prohibited practices, high-risk systems, systems with transparency obligations, and five steps to classify your own.
• The current EU AI Act schedule, as amended in 2026.
• An AI policy outline in ten parts.
• Five common mistakes.
• Your inventory and next steps. Owners, triage, controls, and the systems that need legal review.

How to use it

Read the comparison and answer the six questions. Then fill in the inventory for every AI system you develop, deploy, or buy, including third-party tools with AI features. Give each system an owner, tag its risk tier, note which controls exist, and mark the ones that need legal review. If you already run a GRC platform, load the finished inventory into it. Download the PDF.