Skip to content
AIGP Quest

AIGP cheat sheet · II.D · BoK v2.1

NIST AI RMF, ISO 42001 and OECD AI frameworks

II.D Standards & frameworks (3 to 5 exam questions)

Understand the main industry standards and tools that apply to AI.

II.D.1 · The OECD AI Principles

  • Five principles: inclusive growth and well-being; human rights and democratic values; transparency and explainability; robustness, security and safety; accountability.
  • Five recommendations for governments: R&D, ecosystem, interoperable governance, human capacity, international cooperation.
  • Adopted May 2019, updated May 2024; 47 adherents; non-binding but widely adopted.
  • Practical OECD tools: classification framework, tools and metrics catalog, AI Incidents Monitor, Policy Observatory, Hiroshima reporting framework.
OECD AI Principles:
The 2019 (updated 2024) OECD Council Recommendation setting five values-based principles for trustworthy AI and five recommendations for governments.
AI actor:
Anyone who plays an active role in the AI system life cycle, including organizations and individuals that deploy or operate AI.
Framework for the Classification of AI Systems:
An OECD tool that profiles AI systems across five dimensions to connect their characteristics with policy and risk considerations.
Catalogue of Tools & Metrics for Trustworthy AI:
An OECD.AI library of tools and metrics that help put the principles into practice.
AI Incidents Monitor (AIM):
An OECD database tracking AI incidents and hazards reported in the news, to build evidence for policy.

Exam tips: Principles = AI actors; recommendations = governments. Questions often swap them. · The OECD Principles are voluntary soft law but foundational: the EU AI Act's AI-system definition comes from the OECD. · Frameworks and standards (NIST AI RMF, ISO/IEC 42001) operationalize principles. Principles alone don't tell you how. · 2024 update themes to recognize: safety (override, repair, decommission), mis- and disinformation, interoperability.

II.D.2 · NIST AI RMF: the big picture

  • AI RMF 1.0 (Jan 2023): voluntary, flexible, for any sector and use case; a revision is underway but 1.0 is current.
  • Four functions: GOVERN (cross-cutting), MAP (context), MEASURE (assess and track), MANAGE (prioritize and act).
  • Harms to people, organizations and ecosystems; challenges in measurement, tolerance, prioritization and integration.
  • Seven trustworthy characteristics, with trade-offs balanced in context.
NIST AI RMF:
NIST's voluntary AI Risk Management Framework (AI 100-1, January 2023), organized around GOVERN, MAP, MEASURE and MANAGE.
GOVERN:
The cross-cutting function that builds the policies, accountability, culture and processes the other functions rely on.
MAP:
The function that establishes context and identifies risks and impacts of an AI system.
MEASURE:
The function that analyzes, assesses, benchmarks and monitors AI risks and trustworthiness.
MANAGE:
The function that prioritizes risks and allocates resources to treat, respond to, recover from and communicate about them.
Risk tolerance:
The level of risk an organization is willing to bear to achieve its objectives; the AI RMF leaves it to each organization.

Exam tips: GOVERN is cross-cutting, not 'step one then done'. Any option treating it as a one-time gate is a trap. · Seven characteristics; 'valid and reliable' is the base and 'accountable and transparent' cuts across the rest. 'Profitable', 'autonomous' or 'cost-effective' are never on the list. · What = transparency; how = explainability; why = interpretability. · Voluntary and no certification, and no implementation tiers (that's the Cybersecurity Framework).

II.D.3 · Inside the RMF: categories, Playbook, profiles

  • Each function breaks into outcome-based categories and subcategories (19 and 72).
  • The Playbook gives suggested actions, documentation prompts and references per subcategory; it's not a checklist.
  • Use-case, temporal (current vs target) and cross-sectoral profiles tailor the framework.
  • The GenAI Profile (NIST AI 600-1) adds 12 GenAI risks; NIST's ARIA program supports measurement through model testing, red teaming and field testing.
Category and subcategory:
The outcome statements each AI RMF function breaks into: 19 categories and 72 subcategories in total.
AI RMF Playbook:
NIST's voluntary online companion offering suggested actions, documentation prompts and references for every subcategory.
Profile (current vs target):
A tailored application of the AI RMF; comparing a current profile with a target profile reveals gaps to address.
NIST AI 600-1 (Generative AI Profile):
A July 2024 cross-sectoral profile naming 12 risks unique to or worsened by generative AI, with actions mapped to the AI RMF.
Confabulation:
Generative AI confidently producing false or fabricated content; one of the 12 GenAI Profile risks.

Exam tips: Numbers: 4 functions, 19 categories, 72 subcategories. GOVERN has the most categories (6). · Framework = outcomes (what). Playbook = suggested actions (how). Profile = tailored to a use case, a sector, or current versus target state. · GenAI Profile = NIST AI 600-1, July 2024, 12 risks (confabulation, information integrity, CBRN information, value chain and more). · Texas TRAIGA's defense refers to substantially complying with the NIST GenAI Profile or another recognized framework, a sign of how laws lean on NIST.

II.D.4 · ISO/IEC 22989, 42001 and 42005

  • ISO/IEC 22989 (2022): shared AI terms, stakeholder roles and life-cycle stages.
  • ISO/IEC 42001 (2023): certifiable AI management system; PDCA, risk and impact assessment, Statement of Applicability, Annex A controls.
  • ISO/IEC 42005 (2025): guidance for AI system impact assessments on individuals, groups and society.
  • They work together, and with 23894 for risk management.
ISO/IEC 22989:
The 2022 international standard defining AI concepts and terminology, including stakeholder roles and life-cycle stages.
ISO/IEC 42001 (AIMS):
The 2023 certifiable standard setting requirements for an AI management system, using Plan-Do-Check-Act.
ISO/IEC 42005:
The 2025 guidance standard on assessing an AI system's impacts on individuals, groups and society.
Statement of Applicability:
A 42001 document listing which Annex A controls an organization applies and why any are excluded.
Plan-Do-Check-Act (PDCA):
The continual-improvement cycle behind ISO management-system standards.
ISO/IEC 23894:
Guidance on AI risk management, adapting ISO 31000 to AI.

Exam tips: 22989 = words, 42001 = system (certifiable), 42005 = impact (guidance). · Only 42001 is certifiable. Any option offering 42005 or 22989 'certification' is a trap. · 42001 requires an AI system impact assessment; 42005 tells you how to do one well. · Standards support legal compliance but don't equal it: 42001 certification isn't EU AI Act conformity.

Independent study aid, not affiliated with the IAPP. Written with AI from primary sources; laws change, so check the sources. Last updated 7 Nov 2026.