AI Governance
Risk frameworks, regulation, and management systems. These pages are written from the public primary sources - the NIST framework, the text of Regulation (EU) 2024/1689, and ISO's public catalogue entry - with every date, threshold and penalty checked against the source rather than summarised from commentary.
Frameworks and regulation
Each page states what it applies to and links the articles or sections it draws on.
How the AI RMF's govern, map, measure and manage functions decompose into subcategories, what the Playbook adds, and how to run it on a real system.
Regulation (EU) 2024/1689 in detail - the four risk tiers, provider versus deployer duties, GPAI and systemic risk, phased dates and fine ceilings.
The AI management system standard - scope, the Annex SL structure it shares with ISO 27001 and 9001, how certification works, and its limits as evidence.
Where generative AI processes personal data, the lawful basis and DPIA analysis, erasure against model weights, and the Dutch DPA's deployment checks.
On sourcing. Some governance material in circulation is confidential or commercially licensed. Nothing here is derived from such documents. Where a standard is paywalled - ISO/IEC 42001 is - the page describes its scope and structure and says plainly that it is not reproducing clause text. Nothing on these pages is legal advice.