Prioritise the EU AI Act whenever an AI system is in scope for EU users or deployment, because it is binding and extraterritorial. Voluntary frameworks can support internal governance, but they do not replace legal obligations. The first move is to classify each system into the Act’s risk tiers, then build controls around the applicable obligations and deadlines.
When the EU AI Act overrides “good enough” internal governance
Voluntary AI frameworks are useful for structure, documentation, and consistency, but they sit below a binding legal regime once a system falls within EU scope. The practical trigger is not whether an internal policy exists, it is whether the AI system is placed on the market, put into service, or used in a way that the Act regulates. At that point, legal classification and deadlines drive the control plan.
The right order is to treat the Act as the non-negotiable baseline, then use internal governance to make implementation repeatable. That means mapping each system to the relevant obligations first, then using voluntary frameworks to organise ownership, evidence, testing, and escalation around those obligations.
A useful way to think about the choice is that voluntary frameworks answer “how do we run the programme well?” while the eu ai act answers “what must we do, for which systems, by when?”. If the two disagree, the law wins. That is especially important for cross-border deployments, vendor selection, and product teams that assume an internal governance standard is sufficient because it is mature or widely adopted.
What should be prioritised first in practice?
The first priority is scope classification. Organisations should determine whether they are acting as provider, deployer, importer, distributor, or another relevant role, because the obligation set changes with the role and with the risk tier of the system. Without that classification, teams tend to overbuild low-risk use cases and under-control high-risk ones.
Second, map the system to the Act’s required controls and evidence set, then identify where an internal framework already covers the same ground. A voluntary framework can still be valuable if it helps with documentation discipline, monitoring, model inventory, or control ownership, but it should be treated as an implementation aid rather than the source of compliance truth.
Third, align deadlines to release management. A common failure mode is to approve a model or application under an internal AI policy, then discover that the Act’s obligations require additional testing, transparency, human oversight, or vendor due diligence before deployment. The compliance date is operationally more important than the maturity of the internal framework.
How to combine legal compliance and voluntary frameworks without confusion
Voluntary frameworks are most useful when they become the operating model around the law instead of a parallel programme. For example, teams can use an AI management system standard to define ownership, review cadence, documentation, and continual improvement, while using the Act to define mandatory gates for launch, change, and exceptions. That keeps governance coherent without diluting the legal requirement.
For teams with multiple AI use cases, the best practice is to maintain one control inventory and annotate each control with its legal or voluntary source. That avoids duplicate reporting, conflicting terminology, and “framework shopping” when one team prefers a lighter standard. It also makes it easier to prove that a control exists because the law requires it, not merely because it is a recommended practice.
Where organisations use supplier tools or foundation models, contract review should be tied to the Act’s role-based obligations, not just to generic procurement checks. The EU AI Act regulatory framework is the canonical reference for the obligations that determine whether a voluntary framework is enough, or whether legal controls must be added.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI RMF and NIST CSF 2.0 set the technical controls, while ISO/IEC 42001:2023 and EU AI Act define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Govern | AI governance and risk management are central to structuring controls around EU AI Act obligations. |
| Recommendation — Use AI RMF functions to organise AI risk ownership, assessment, and monitoring around legal duties. | ||
| ISO/IEC 42001:2023 | A.4 — Context of the organization | AI management systems help turn legal AI obligations into repeatable governance processes. |
| Recommendation — Define AI governance scope, roles, and obligations in an AI management system. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The question is about prioritising mandatory legal obligations over voluntary governance choices. |
| Recommendation — Align AI controls to a risk strategy that reflects mandatory regulatory requirements first. | ||
| EU AI Act | Regulatory Framework for Artificial Intelligence | The EU AI Act is the binding regime that determines when voluntary frameworks are secondary. |
| Recommendation — Classify AI systems and implement the Act’s required controls before relying on voluntary frameworks. | ||
Practitioner Guidance
What to prioritise: Start with system classification and role mapping, then build your control set from the Act outward. If a control exists only in a voluntary framework and not in the legal obligation set, treat it as helpful but not sufficient.
What to verify: Confirm that every in-scope system has a named owner, a documented risk tier, an evidence trail for the applicable obligations, and a release gate that blocks deployment when required artefacts are missing. If you cannot produce those items quickly, the governance model is too informal.
Common mistake: Treating framework alignment as compliance. A mature voluntary framework can improve assurance, but it does not reduce statutory scope, deadline pressure, or enforcement exposure once the Act applies.
Practitioner takeaway: Use voluntary frameworks to operationalise compliance, not to substitute for it; when the Act applies, the legal classification and mandatory obligations define the floor, and everything else is implementation detail.
Related resources from NHI Mgmt Group
- When should organisations prioritise third-party conformity assessment over internal assessment under the EU AI Act?
- Should organisations prioritise external exposure or internal credential governance first?
- When should organisations prioritise AI identity governance over new AI deployments?
- When should organisations prioritise governance over more AI pilots in healthcare?
