Framework explainers

Organizational AIMS. Catalog: rather than looking at details of specific AI applications, it manages AI-related risks and opportunities across an organization.

Voluntary International Standard. Organizations may choose certification.

Yes — certification is performed by independent certification bodies.

ISO/IEC JTC 1/SC 42

December 2023 (edition 1)

Four functions (Govern, Map, Measure, Manage) for AI risk. Non-sector-specific and use-case agnostic.

Voluntary. NIST describes it as voluntary, rights-preserving, non-sector specific.

Not a certification scheme. Actions are not a checklist.

NIST

AI RMF 1.0 January 2023; Generative AI Profile (AI 600-1) 26 July 2024

A path to assuring the safety of AI in aircraft and related systems for inflight operations.

Not a standard, advisory circular, or means of compliance. Living document.

Not a certification standard. Applicants use project-specific issue papers and special conditions.

Federal Aviation Administration

Version I; first official release dated August 2024 in the FAA REDAC briefing

Design assurance and product assurance for airborne software, plus software tool qualification.

AC 20-115D is an acceptable means, not the only means; it is not mandatory and is not a regulation.

Used to show compliance for the software aspects of airborne systems when the AC is followed. Not an AI-product certificate.

RTCA / EUROCAE

DO-178C published 2011; AC 20-115D issued 21 July 2017 (active)

Joint SAE G-34 / EUROCAE WG-114 work on AI in aeronautical systems. ED-324 / ARP6983 is the ML development-assurance draft.

Committee work. AIR reports are issued information reports. ED-324 / ARP6983 is still listed as Draft.

Not yet. EUROCAE lists ED-324 as draft (target 31 December 2026). An EASA-hosted briefing says EASA is considering it as anticipated AMC; no FAA acceptance is on the pages we cite.

SAE International / EUROCAE

AIR6988 issued 30 April 2021; AIR6987 issued 12 December 2024; ED-324 still draft

Preliminary objectives for Level 1 and Level 2 machine-learning applications, including learning assurance.

Not final detailed guidance and not final rules.

Not a certification specification. Presents a first set of objectives to anticipate future EASA guidance.

European Union Aviation Safety Agency

Issue 2 published 6 March 2024

Information systems that process, store or transmit FCI or CUI. Technology-neutral; no AI-specific CMMC clause on the pages we cite.

Contractual when DFARS 252.204-7021 is specified. Phase 1 self-assessments remain in place; Phase 2 is suspended.

CMMC status at the level the contracting officer specifies. During the Phase 2 pause, program managers may only designate Level 1 (Self) or Level 2 (Self).

US Department of Defense / NIST

CMMC Phase 1 began 10 November 2025; Phase 2 suspended 13 July 2026

Five DoD AI ethical principles plus a public CDAO self-evaluation toolkit for AI projects.

Principles adopted as Department policy (February 2020). The toolkit is a voluntary process.

Not a certification or contract clause on the pages we cite. Completing the toolkit is voluntary.

US Department of Defense, CDAO

Principles adopted February 2020; RAI Toolkit released 14 November 2023

Horizontal EU AI regulation. Military, defence and national-security use is excluded when exclusive; civil aviation is handled through sectoral law.

Binding regulation. In force; high-risk Chapter III dates were moved by Regulation (EU) 2026/1744.

High-risk systems have Chapter III obligations (documentation, logging). Not an ISO-style management-system certificate. Aviation channel is EASA acts taking Chapter III Section 2 into account.

European Union

Regulation (EU) 2024/1689; high-risk Annex III from 2 December 2027, Annex I from 2 August 2028

Guidance on managing AI-specific risk for organizations that develop, produce, deploy or use AI products, systems and services.

Guidance. Application can be customized to any organization and its context.

Not a management-system certification scheme. ISO’s catalog describes guidance. We have not found an official ISO page that says 23894 is itself certifiable.

ISO/IEC JTC 1/SC 42

February 2023 (edition 1); IEC catalog date 6 February 2023

Technical report on AI inside a safety-related function, non-AI safety functions around AI-controlled equipment, and AI used to design safety functions.

Technical Report, not an International Standard with certifiable requirements.

Not a certification scheme and does not confer a SIL. Catalog pages do not say it replaces IEC 61508.

ISO/IEC JTC 1/SC 42

January 2024 (edition 1); IEC catalog date 8 January 2024

Principal policy framework for safe and responsible AI adoption across Defence projects that include AI.

UK MOD directive. Where it says must, the action is a compulsory requirement for the MOD audience it names.

Not a product-certification method. It does not list systems that are compliant or not compliant.

UK Ministry of Defence

Part 1 published 13 November 2024 (JSP 936 V1.1)

Six Allied principles for AI in defence. A baseline for Allies; applies across all types of AI applications.

Allied baseline. Do not affect or supersede existing national and international obligations. Not a national contract clause.

Not a published product-certification method. A 2022 DARB text mentioned developing an RAI certification standard; we have not found that standard issued as a public specification.

NATO

Endorsed in the 2021 AI Strategy; restated 10 July 2024

Safety argument for vehicles that can operate in an autonomous mode without human supervision.

ANSI/UL standard. Voluntary unless an authority adopts it. Not an aviation standard on the pages we cite.

A standard for building and evaluating a safety argument (safety-case approach). We do not treat it as an aircraft, rail or medical means of compliance.

UL Standards & Engagement

ANSI/UL 4600 new edition dated 17 March 2023 (ANSI approval the same day)

Guidelines for developing civil aircraft and systems, including validation of requirements and verification of the design implementation.

AC 20-174 is an acceptable means, not the only means; it is not mandatory and is not a regulation. It still names ARP4754A.

Used to establish a development-assurance process when the AC is followed. Not an AI-product certificate.

SAE International; FAA AC 20-174 recognizes the A revision

AC 20-174 issued 30 September 2011 still names ARP4754A (21 December 2010)

Qualification considerations for software tools used to develop, transform, test, analyze, produce or modify another program, its data or its documentation.

AC 20-115D is an acceptable means, not the only means; it is not mandatory and is not a regulation.

Used to qualify tools when DO-178C 12.2 applies. Effort scales with TQL. Not an AI-model certificate.

RTCA / EUROCAE (ED-215)

Recognized by AC 20-115D, issued 21 July 2017 (active)

Processing of aeronautical data (navigation, terrain, obstacle, airport mapping and other aeronautical applications). Not ML training sets.

AC 20-153B is an acceptable means, not the only means; it is not mandatory and is not a regulation.

An FAA Letter of Acceptance confirms compliance with DO-200B. Not an AI-model certificate.

RTCA / EUROCAE (ED-76A)

AC 20-153B issued 19 April 2016; DO-200A no longer acceptable for new applications under that AC

Autonomous and semi-autonomous weapon systems. Excludes unarmed platforms and systems that are not weapon systems.

DoD Directive. Binding on the organizations and weapon-system activities it names.

Not a product certificate. Requires senior review for covered weapon systems; completing a toolkit is not that review.

US Department of Defense (Under Secretary of Defense for Policy)

Effective 25 January 2023; reissues the 21 November 2012 directive

Five AI ethical principles plus 64 lines of effort for operationalizing them across how the Department develops, deploys and uses AI.

Department direction. Principles adopted February 2020; pathway signed June 2022. Not a contractor certification on the pages we cite.

Not a product-certification method. The public toolkit that implements it is voluntary.

US Department of Defense; CDAO implements the public toolkit

Principles February 2020; RAI Strategy and Implementation Pathway signed June 2022

Voluntary self-evaluation of AI projects against RAI best practices and DoD/DoW AI Ethical Principles, with modular assessments across the product lifecycle.

Voluntary process. Offers guidance to DoD industry partners; not a DFARS clause on the pages we cite.

Not a certification. Completing the toolkit is a self-evaluation, not a CMMC status or a 3000.09 review.

DoD Chief Digital and Artificial Intelligence Office

Publicly released 14 November 2023; live page titled AIA Toolkit

SSDF Community Profile adding generative-AI and dual-use foundation-model practices for model producers, system producers and acquirers.

Voluntary Community Profile. Use with SP 800-218 SSDF 1.1. Not a CMMC or DFARS clause.

Not a certification scheme. Completing SSDF tasks is not an AI RMF assessment.

NIST (with CISA and Scarfone Cybersecurity among the authors)

Final 26 July 2024

Safety-related E/E systems installed in series production road vehicles, excluding mopeds. Addresses hazards from malfunctioning E/E behaviour.

International Standard. ISO sells the full text. Catalog marks edition 2 to be revised (stage 90.92).

Functional-safety framework for malfunctioning E/E behaviour. Not an AI-management standard on the catalog page we cite.

ISO/TC 22/SC 32

December 2018 (edition 2)

Safety-related E/E systems that use AI technology in series production road vehicles, excluding mopeds. Addresses vehicle-level risk from AI output insufficiencies, systematic errors and random hardware errors.

Publicly Available Specification, not an International Standard with a certification scheme on the public catalog page.

Does not provide specific guidelines for software tools that use AI methods. Not a replacement for ISO 26262.

ISO/TC 22/SC 32

December 2024 (edition 1, 13 December 2024; 172 pages)

Recommendations for AI-enabled device software functions, including optional predetermined change control plans reviewed with a 510(k), De Novo or PMA marketing submission.

The January 2025 lifecycle document is draft and not for implementation. The August 2025 PCCP guidance is final recommendations.

FDA reviews a PCCP as part of a marketing submission. It is not a product certification or a substitute for that submission.

U.S. Food and Drug Administration

Lifecycle/marketing-submission draft January 2025; PCCP guidance final August 2025

Life-cycle requirements for medical device software when the software is itself a medical device or is an embedded or integral part of the final medical device.

International Standard. IEC sells the full text. Consolidated with Amendment 1 (26 June 2015).

Does not cover validation and final release of the medical device, even when the medical device consists entirely of software.

IEC TC 62/SC 62A

Published 9 May 2006 (edition 1.0); Amendment 1 26 June 2015

Regulation (EU) 2017/745 remains Union medical-device law. AI Act Annex I Section A still lists that regulation as item 11.

MDR is Union law. Listing MDR in Annex I is the official interplay we cite, not a merged certificate.

Not a claim that MDR and the AI Act are one certificate. Section A item 1 is DELETED; item 11 (MDR) is still present.

European Union

MDR in force; AI Act Annex I as consolidated 27 July 2026 on the Commission Service Desk

Aspects to be considered when E/E/PE systems are used to carry out safety functions. Basic safety publication according to IEC Guide 104.

International Standard. Facilitates the development of product and application sector international standards.

Does not by itself confer an AI-specific SIL. Official catalog pages we cite do not say ISO/IEC TR 5469 replaces it.

IEC TC 65/SC 65A

Published 30 April 2010 (edition 2.0)

Union machinery product-safety regulation covering safety risks from new digital technologies, including machine-learning software that ensures safety functions.

Union regulation repealing Directive 2006/42/EC. Recital 55 limits extra third-party assessment of safety-function software to self-evolving ML ensuring safety functions.

Annex III AI delegated acts shall apply by 2 August 2028. Also listed as AI Act Annex I Section B item 21.

European Union

14 June 2023; consolidated text current as of 27 July 2026 on EUR-Lex

Safety requirements specific to industrial robots, addressing them as partly completed machinery prior to integration under ISO 10218-2.

International Standard. Not applicable to medical, military (defence), airborne and space, healthcare or service robots.

Not an AI-management standard on the catalog page we cite. Not presented as a means of compliance for Regulation (EU) 2023/1230.

ISO/TC 299

February 2025 (edition 3; publication date 5 February 2025)

Requirements for specifying, designing, installing, operating and maintaining a safety instrumented system so it can achieve or maintain a safe state of the process.

International Standard developed as a process sector implementation of IEC 61508:2010.

Official catalog pages we cite do not say IEC 61511 confers a SIL on a machine-learning model or that TR 5469 replaces it.

IEC TC 65/SC 65A

Published 24 February 2016 (edition 2.0); Amendment 1 16 August 2017