What an AI governance framework is
The OECD AI Principles
The major frameworks compared
The five OECD principles in practice
Inclusive growth, sustainable development and well-being
AI should benefit people and the planet. In practice: impact assessments that identify distributional effects, access considerations for underserved populations, and energy and environmental impact disclosure. The EU AI Act operationalises this through the fundamental rights impact assessment (Article 27) for public-sector deployers and through Annex III’s coverage of essential services (credit, housing, education) as high-risk use cases.
Human-centred values, fairness and non-discrimination
AI should respect human rights, democratic values and diversity. In practice: bias testing and fairness metrics, protected characteristic analysis, contestability mechanisms. Operationalised in the EU AI Act through Article 10 data governance requirements (representative datasets, bias monitoring), Article 13 transparency (right to explanation), and Article 14 human oversight.
Transparency and explainability
People should understand AI-based outcomes and be able to challenge them. In practice: logging and audit trails, explanation mechanisms, public disclosure of AI system use. Operationalised in the EU AI Act through Article 12 (logging), Article 13 (transparency and provision of information to deployers), and Article 50 (transparency obligations for certain AI systems toward end users, including the right to know when interacting with an AI).
Robustness, security and safety
AI systems must be robust and safe throughout their entire lifecycle. In practice: adversarial testing, red-teaming, vulnerability management, post-market monitoring. Operationalised in the EU AI Act through Article 15 (accuracy, robustness and cybersecurity), Article 72 (post-market monitoring), and Article 55 (adversarial testing for GPAI models with systemic risk).
Accountability
Organisations should be accountable for AI systems functioning in line with the principles. In practice: clear allocation of responsibility across the supply chain, incident reporting, governance structures, fines for non-compliance. Operationalised in the EU AI Act through the actor-role framework (Article 3 definitions of provider/deployer/importer/distributor), Article 16 (provider obligations), Article 26 (deployer obligations), and Article 99 (penalties).
How the landscape is organised
The EU AI Act as anchor framework
What organizations must do
- Map your AI systems against the applicable frameworks by jurisdiction: identify which binding laws apply (EU AI Act for EU market exposure, China interim measures for China market, sector-specific rules for regulated industries), then layer voluntary frameworks (NIST AI RMF, ISO/IEC 42001) as the operational architecture.
- Classify your AI systems by risk level before designing controls — classification determines what governance is proportionate. Use the EU AI Act risk taxonomy if EU-exposed; use the NIST AI RMF impact categories for all systems.
- Assign clear accountability for each AI system in your inventory — identify whether your organisation is acting as provider, deployer, importer, or distributor under the EU AI Act, and assign corresponding obligations to specific roles or functions.
- Consider ISO/IEC 42001 certification as the audit trail for your AI governance programme — it provides a documented, auditable record that satisfies due diligence requirements and increasingly appears in procurement requirements.
- Track the OECD AI Policy Observatory for national implementation developments in your operating jurisdictions — the Observatory monitors how OECD member countries are implementing the Principles and flags new binding requirements as they emerge.
Common mistakes
Treating OECD Principles adherence as compliance with the EU AI Act is a common mistake — the Principles are a political commitment with no legal force. EU AI Act compliance requires satisfying specific legal requirements by risk category and actor role. The Principles are a useful diagnostic, not a compliance test.
Building a governance programme around voluntary frameworks alone is a second mistake — organisations with EU market exposure are subject to binding law. A NIST AI RMF-aligned programme that does not address EU AI Act requirements is not a compliance programme for EU-exposed AI systems.
Failing to account for extraterritorial reach is a third mistake — the EU AI Act, like the GDPR, applies based on where the system is used, not where the provider is established. A US-based provider whose AI system is used in the EU is subject to the Act regardless of where the organisation is headquartered.
Waiting for a single comprehensive national framework is a fourth mistake — the US, UK, and most other jurisdictions are using sector-specific and incremental approaches. An organisation operating in multiple jurisdictions must manage a patchwork of frameworks, not wait for harmonisation.
Open questions
- Whether the US will adopt omnibus AI legislation at federal level — as of August 2026, no comprehensive federal AI law has been enacted; governance relies on executive action, agency guidance, and voluntary commitments.
- How the G7 Hiroshima voluntary code of conduct has been adopted by major AI developers — initial commitments were made in late 2023; implementation monitoring is ongoing but not systematically published.
- Whether ISO/IEC 42001 certification will become a mandatory requirement in regulated sector procurement — currently referenced voluntarily; sector regulators (financial services, healthcare) may begin requiring it as AI governance expectations mature.
- How the OECD AI Principles will be updated as generative AI and agentic AI systems create governance gaps not addressed in the 2024 revision — the OECD AI Policy Observatory is monitoring; further revision likely.