Which AI Governance Framework Should Regulated Operations Teams Adopt?

Regulated operations teams should anchor their AI governance framework on ISO/IEC 42001 when they need a certificate an outside party can verify, or on NIST AI RMF 1.0 when they need a voluntary risk method without an external audit cycle. The EU AI Act and US sector rules (SR 26-2 for banks, the NAIC Model Bulletin for insurers, HIPAA and Section 1557 for payers) then sit on top as overlays. Those overlays define what the program must prove to a regulator.

What AI governance framework should regulated operations teams use?

Pick one base framework, then map every applicable rule into it.

ISO/IEC 42001 as the base. It fits firms that sell into the EU, serve clients who ask for certification, or want an accredited auditor to test the program every year.

NIST AI RMF 1.0 as the base. It fits US-focused firms that want structure without certification overhead. Pair it with the Generative AI Profile (NIST AI 600-1, July 2024). The NAIC Model Bulletin allows an insurer’s AI Systems (AIS) Program to adopt or rely on the NIST AI RMF, in whole or in part.

What drives the choice. Weigh four criteria: certifiability, jurisdiction, the risk profile of your use cases, and the operational overhead your team can carry.

Framework comparison matrix

The instruments below differ in kind: NIST AI RMF, ISO/IEC 42001, COSO, and COBIT are frameworks a firm chooses, the EU AI Act is law, and SR 26-2 and the NAIC Model Bulletin are supervisory guidance that examiners apply. Here is how each scores on the dimensions a regulator will test:

The second matrix applies those scores to common situations. Find the row that matches your vertical, jurisdiction, and risk tier:

A bank or insurer with any Annex III use case should certify to ISO/IEC 42001 and run NIST AI RMF as the risk method inside it. A US-only firm can start on NIST AI RMF and add certification when a client, partner, or examiner asks for third-party assurance.

How to choose: jurisdiction, certification, risk profile and overhead

Jurisdiction comes first because it sets deadlines. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved Annex III high-risk obligations to 2 December 2027 and Annex I product obligations to August 2, 2028. Article 50 transparency duties, which reach customer-facing chatbots, have applied since August 2, 2026.

A US-only firm faces no single federal AI statute. It faces SR 26-2, state insurance bulletins, and HHS rules.

Certification matters when an outside party must rely on the program, and it carries the highest overhead. Certification bodies issue ISO/IEC 42001 certificates, and accreditation bodies such as ANAB and UKAS assess those certification bodies against ISO/IEC 17021-1 and ISO/IEC 42006 (published July 2025).

Schellman reports that Stage 1 typically takes 1–2 days and surveillance audits run 2–5+ days depending on in-scope personnel. Governancedocs reports longer 2026 booking lead times because few auditors qualify under ISO/IEC 42006.

TÜV’s consulting arm notes that ISO/IEC 42001 is not harmonised and creates no formal presumption of conformity with the AI Act.

Teams should scale control depth to each use case’s risk profile. Annex III point 5(b) covers creditworthiness and credit scoring of natural persons, except systems used to detect financial fraud, and point 5(c) covers risk assessment and pricing in life and health insurance. Under Article 6(3), a provider may document why an Annex III system poses no significant risk, but a system that profiles individuals stays high-risk regardless.

Firms can combine frameworks in one program, and most should. A combined program has three layers:

• ISO/IEC 42001 as the management system container
• NIST Govern, Map, Measure and Manage as the risk method
• Each sector requirement listed as a control in the Statement of Applicability

NIST’s resource center lists a NIST AI RMF to ISO/IEC 42001 crosswalk attributed to Microsoft. NIST states that listing a crosswalk does not imply endorsement. The page shows no NIST crosswalk to the enacted EU AI Act.

Mapping sector rules onto a base framework

Sector rules fill in the specific evidence a base framework leaves open. Each rule below lands in a specific part of the base framework:

For banks:

• Banks should retire SR 11-7 references. SR 26-2 supersedes SR 11-7 and SR 21-8, the 2021 statement on Bank Secrecy Act and anti-money laundering (AML) models. The FDIC states the guidance “does not set forth enforceable standards or prescriptive requirements.”
• The model definition also excludes deterministic rule-based processes. A rules-based Know Your Customer (KYC) screening step may therefore sit outside SR 26-2, while a statistical AML alert-scoring model sits inside it.
• State-chartered banks should also track the Conference of State Bank Supervisors framework issued September 17, 2026, which sets three risk tiers.

Insurers face a moving count. NAIC’s retrieved map shows 24 states plus DC as of August 6, 2026, while third-party trackers cite an October 2026 map listing 27 to 29 jurisdictions, but that map was not available for confirmation. NAIC targeted its AI Risk Evaluation Supplement for adoption at the November 2026 Fall National Meeting, for voluntary state use in 2027.

For payers, the Department of Health and Human Services (HHS) definition in §92.210 reaches algorithms used for prior authorization and medical necessity (the insurer’s decisions on whether to approve care before it is delivered), according to Fierce Healthcare. US Food and Drug Administration (FDA) rules and GxP rules, the quality rules for regulated life-sciences work, apply only where a firm builds device software or runs GxP computerized systems. The International Society for Pharmaceutical Engineering (ISPE)’s July 2025 GAMP AI guide considers ISO/IEC 42001, which makes ISO the easier base for those units.

The pillars every framework shares

The NAIC bulletin gives a clear 3-pillar structure: an AIS Program should address governance, risk management controls, and internal audit functions. Those three map to NIST’s Govern function, to NIST’s Map, Measure, and Manage functions, and to ISO/IEC 42001’s internal audit and management review requirements.

The NAIC’s 2020 principles add fairness, accountability, transparency, and safe, secure systems. Each principle needs a concrete control and a record that proves the control ran:

Ownership and operating model for regulated operations teams

Governance fails when it has no named owner with authority to stop a deployment. SR 26-2 describes effective challenge from people with expertise, independence, and the standing to effect change as sound practice, and the NAIC bulletin lets insurers build new governance structures or rely on existing ones. EU Article 26(2) requires deployers to assign human oversight to people with the competence, training, and authority to exercise it, and this RACI chart, which shows who is Responsible, Accountable, Consulted, or Informed for each activity, shows how those duties can be allocated:

The Responsible AI Officer owns the written program, the regulatory mapping, and the Statement of Applicability. The Model Risk Review Board supplies the independent challenge SR 26-2 describes. For agents, the IIA’s January 20, 2026 CAE Bulletin advises treating AI agents as digital team members, with governance, training, and accountability structures similar to those applied to people.

Operational controls: inventory, risk tiering, human-in-the-loop, shadow AI

Airia, citing Gartner, reports that 43% of organizations cannot produce an AI inventory. SR 26-2 expects an inventory with enough information to understand model risk at the individual and aggregate levels. The NAIC bulletin lists inventories among the documents a regulator may request.

The Federal Reserve OIG’s summary of SR 11-7 attributes still makes a sound field list: purpose, use, restrictions, inputs, last update, expected validity window, policy exceptions, planned validation and responsible individuals. Add model type, risk tier and vendor.

No regulator text in the research mandates model cards. The NAIC bulletin does ask for a narrative of each predictive model’s goals and how it was developed and validated. A model card attached to the inventory record is a practical format for that narrative.

For risk tiering, assess the NAIC’s five factors alongside applicable EU AI Act requirements. The NAIC factors include decision type, potential harm, human involvement, explainability and third-party reliance.

Human-in-the-loop controls start at design. Article 14 requires high-risk systems to be effectively overseeable by people during use, and Texas Department of Insurance Bulletin B-0003-26 expects human review before acting on any AI decision. Runtime enforcement adds per-system permissions, escalation thresholds, and Article 12 event logging.

Shadow AI, meaning employees’ use of AI tools the firm has not approved, is already present in regulated firms. In a Gartner survey of 302 cybersecurity leaders, 69% suspected or had evidence of employees using prohibited public generative AI (GenAI) tools. Insurance Business reports that a majority of payers see employees using unauthorized shadow AI tools. Controls for unmanaged AI include:

• An approved tool list, with PHI allowed only in tools covered by a BAA
• Unique user identification, since a shared seat cannot show which person used the tool
• Endpoint discovery of unsanctioned AI applications, feeding the inventory

Monitoring, incident response and audit readiness

SR 26-2 ties monitoring frequency to model materiality and allows overlays, adjustment, or redevelopment when a model stops performing as expected. The NAIC bulletin asks for documented evaluation of model drift, and release gates come from the NIST Playbook, which describes impact assessments as inputs to go/no-go decisions. For incidents, EIOPA’s factsheet states that providers and deployers should inform the relevant authority and take corrective action or suspend the system after a serious incident.

Document these items first:

• AI inventory with owner, purpose, model type, risk tier and vendor
• Written program naming the base framework and each rule mapped into it
• Risk classification record per system, including any Article 6(3) assessment
• Validation, bias and drift test results
• Human oversight assignments and override records
• Log retention settings for automatically generated logs under the deployer’s control: appropriate to the intended purpose and at least six months for EU high-risk deployments, unless Union or national law provides otherwise
• Vendor due diligence files and contracts
• Fundamental rights impact assessments for Annex III 5(b) and 5(c) deployers, cross-referencing existing data protection impact assessments
• Statement of Applicability covering all 38 Annex A controls, if pursuing ISO

Before ISO/IEC 42001 Stage 1, complete 1 internal audit and 1 management review; GAICC notes Stage 1 checks for both. NQA, TÜV, and DNV publish readiness self-assessments. BSI offers a pre-certification assessment, limited to 1 per client location. Major nonconformities found at Stage 2 must close before a certificate issues.

Vendor and third-party AI risk

A purchased model leaves the accountability with the buyer, and SR 26-2 acknowledges that vendors may withhold code, data, or methodology while stating that “the principles of model risk management remain applicable.” Banks should understand a vendor model’s conceptual soundness and development data and monitor its outcomes, and the 2023 interagency third-party guidance remains in force while agencies consult on a September 2026 replacement, with comments due November 16, 2026. In the EU, Hogan Lovells notes that a bank procuring an AI system usually acts as a deployer (the organization that uses the system in its own operations), and Digital Operational Resilience Act (DORA) Articles 28–30 have governed information and communication technology (ICT) vendor contracts since 17 January 2025.

Build these controls into procurement:

• Contract terms: Include audit rights, data security, data sourcing, intellectual property and regulator cooperation, which match the NAIC’s contract documentation item.
• Data use: Require a BAA when a vendor creates, receives, maintains or transmits PHI on a covered entity’s behalf.
• Subcontracting: Assess subcontracting chains for critical functions, as DORA Article 30 requires.
• Certification checks: Verify the certification body’s accreditation on the accreditation body’s own register, with ISO/IEC 42001 explicitly in scope.

How Skan AI supports governed AI operations

Skan AI is an agentic AI platform for regulated enterprises that builds a Context Graph of Work, a connected record of the people, applications, tasks, decisions, policies, and outcomes seen in observed process activity. Banks, insurers, and payers can use it to ground governance evidence and agent execution in how work runs. It supplies operational evidence for whichever AI governance framework a firm adopts. The framework still defines the controls.

Control-relevant work often happens where system logs never reach: mainframe screens, spreadsheets, email approvals, and handoffs between applications.

• Workflow observation: Skan Virtual Assistant (Skan VA), a lightweight desktop sensor, observes screens, clicks and application switches across legacy desktop, mainframe, Citrix, VDI and web applications. It assembles end-to-end case flows with zero integrations, APIs, or logs.
• Context graph: The Context Graph of Work stores the result as a property graph. Its nodes are people, applications, tasks, decisions, policies and outcomes, and its edges carry sequences and governance constraints.
• Controls and audit evidence: Continuous controls monitoring compares observed cases against approved procedures and alerts on deviations in AML, KYC, HIPAA and segregation of duties (SOD) controls, without system integrations. The audit trail records inputs, outputs, actions, decisions and rationales, with case-level playback and QA on 100% of cases within the deployed scope.

Observation follows privacy by design, meaning sensitive data is protected before analysis begins. Skan PRISM, an on-premises gateway, redacts sensitive data at the pixel level before transmission, so raw screen data stays in the customer environment and employees are pseudonymized (identified by codes rather than names) at collection. Customers control application allow-lists (the applications that may be observed), retention, deletion, and right to erasure, and analysis covers work patterns.

Deployment options include on-premises inside the customer firewall, private cloud, and Skan AI hosted environments, all containerized (packaged as self-contained software units that run the same way in each environment).

Skan AI holds SOC 2 Type 2 attestation and ISO 27001 and ISO 42001 certifications, and is HIPAA, GDPR, and CCPA compliant. Skan AI also supports EU AI Act readiness.

For agentic programs, Skan AI Blueprint identifies candidate areas for automation, Skan AI Process Intelligence observes those areas in depth and detects drift (changes in how the work is actually done), and Skan AI Agents execute work under agentic operating procedures (AOPs), the approved step-by-step procedures that bound what an agent may do. Agent Studio sets each agent’s permissions, boundaries, and escalation paths. Agents are evaluated against human baselines before production promotion.

Ready to explore how captured workflows and mapped processes become context for governed AI execution? Request a demo.