Read from the real rules
The framework this record is built from
ISO/IEC 23053:2022, Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML), first edition, 36 pages, ISO/IEC JTC 1/SC 42, ICS 35.020. The public record is at iso.org/standard/74438.html. The amendment record is at iso.org/standard/88149.html. The base sample and the public draft summary are listed on the sources page.
This product is for the organisation that uses the framework: an AI governance lead, an ISO/IEC 42001 implementer or an ML platform lead. It is not written for a certification body, and the free check says so when that role is chosen.
The framework's own normative reference is ISO/IEC 22989, and that terminology standard has a parallel generative AI amendment. A change there reaches this framework's vocabulary without any change to 23053 itself, so the pair is read together.
The record reads two sources of its own: ISO/IEC 23053:2022, with 21 substantive descriptive units, and the Amendment 1 record, with the 3 public draft additions. Neither sets a certifiable requirement. The four market sections add the instruments that create duties around them.
United States
The held reference framework for US practice is the NIST AI Risk Management Framework (AI RMF 1.0), with 72 controls. It is the federal reference for AI risk practice, and it gives the governance lead a risk vocabulary that sits beside the ISO description. State privacy and biometric statutes are named here and not stated: they apply by sector and by state, and the record does not hold a universal set.
European Union
The held framework is the EU AI Act, with 64 controls. It is the instrument that creates duties for providers and deployers of AI systems, including transparency and general-purpose AI obligations that a generative system can trigger. The EU Product Liability Directive (Directive (EU) 2024/2853) is also held, with 18 controls, and the ENISA Data Protection Engineering guidance is held with 28 controls. The framework describes; these instruments oblige.
United Kingdom
The held framework is the UK AI Regulation Framework, with 21 controls, read with the UK GDPR (60 controls) and the ICO employment monitoring guidance (60 controls) where the system touches workers. The UK has no single AI statute in the held record; the obligations are distributed across regulators and data law.
Australia
The held framework is Australia Guidance for AI Adoption (2025), with 106 controls, read with the National Framework for the Assurance of AI in Government (2024) where the buyer is a government body. The Privacy and Other Legislation Amendment Act 2024 (33 controls) applies to personal information. The obligations are named and, where held, cited.
What this means for the record
The unit pages state the framework. The four market sections name the instruments that create duties around it. The two are never blended: a framework line is not a legal obligation, and a legal obligation is not attributed to the framework. Where a market's regime is not held, it is named and left unstated rather than paraphrased from memory.
The four-market scan was run against the held record on 21 October 2026 with the keywords artificial intelligence, AI, automated decision, data protection, privacy and employment. The choices above are held frameworks. The unheld state and sector regimes are named only.