AI governance for a large company: NIST, the EU AI Act, ISO/IEC 42001 and Colorado

AI governance is the set of rules, roles and checks that decide which artificial intelligence (AI) a company uses, for what purpose, under whose responsibility, and who can stop it. For a large company it has to answer two questions at once: what the law requires, and what the company itself has decided is safe.

Four texts shape the answer as of 26 October 2026: a US framework, an EU law, an international standard and a US state law. This page explains each, with its status and dates, and then shows how a large company can combine them in one setup. It is part of the guide on enterprise AI adoption.

Text	What it is	Status on 26 October 2026	Source
NIST AI Risk Management Framework 1.0	A voluntary US framework	Current; being revised under the White House AI Action Plan; no revised version published	[1]
EU AI Act, Regulation (EU) 2024/1689	An EU law	In force; amended by Regulation (EU) 2026/1744; high-risk duties from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)	[4][5]
ISO/IEC 42001:2023	An international management system standard	Published December 2023, edition 1; certification voluntary	[6][7]
Colorado SB26-189	A US state law on automated decision-making	Signed 14 May 2026; developer documentation duties from 1 January 2027; attorney general stopped from starting enforcement by a federal court order of 27 April 2026, with no later order on the court record read 26 October 2026	[9][10]

The NIST AI Risk Management Framework

The National Institute of Standards and Technology (NIST) is the US agency for measurement and standards. NIST says its AI Risk Management Framework (AI RMF) "is intended for voluntary use" [1]. Version 1.0 was "Released on January 26, 2023" [1]. NIST's page also says: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan" [1]. As of 26 October 2026 no revised version had been published, so version 1.0 is the one to use.

The core of the framework has four functions: govern, map, measure and manage [2]. NIST says the actions under them are not a list to tick off in order: "Actions do not constitute a checklist, nor are they necessarily an ordered set of steps" [2].

Function	What it does	One item a large company should start with
Govern	Holds the company-wide policies; the manage function acts "as defined by the GOVERN function" [2]	GOVERN 1.6: "Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities" [2]
Map	"establishes the context to frame risks related to an AI system" [2]	MAP 1.1: document the intended purpose, the setting and the laws that apply [2]
Measure	"employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts" [2]	MEASURE 2.1: document the test sets, metrics and tools used [2]
Manage	"entails allocating risk resources to mapped and measured risks on a regular basis and as defined by the GOVERN function" [2]	MANAGE 2.4: be able to stop a system that behaves outside its intended use [2]

MANAGE 2.4 covers stopping a system. It asks that "Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use" [2]. So someone named must be able to switch the system off, and must know when to do it.

NIST added a profile for generative AI, which is AI that writes text, images or code. "On July 26, 2024, NIST released NIST-AI-600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" [1]. It lists 12 risks that are specific to generative AI or made worse by it, such as confabulation, "The production of confidently stated but erroneous or false content" [3]. For utilities and other critical infrastructure, NIST released a concept note for a separate profile on 7 April 2026 [1].

The EU AI Act, as amended in 2026

The EU AI Act is a law of the European Union (EU). In the original text, its high-risk duties were to apply from 2 August 2026 for Annex III systems and from 2 August 2027 for Annex I systems [5]. Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, moved them. They now apply from "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III" and from "2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I" [4]. Annex III lists uses such as credit scoring and the pricing of life and health insurance. The EU gave as its reason "the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities" [4].

What a deployer of a high-risk system must do

A deployer is an organisation that uses an AI system under its own authority, so a company that uses a high-risk system for its own work is that system's deployer. For a high-risk system, the AI Act sets these duties on the deployer [5]:

• Assign human oversight to people "who have the necessary competence, training and authority, as well as the necessary support" (Article 26(2)).
• Keep the logs the system creates, where they are under the deployer's control, for at least six months (Article 26(6)).
• Before using the system at work, inform workers: "deployers who are employers shall inform workers' representatives and the affected workers that they will be subject to the use of the high-risk AI system" (Article 26(7)).

Some deployers must also assess the system's effect on people's fundamental rights before using it. Article 27 covers "deployers that are bodies governed by public law, or are private entities providing public services", and deployers of systems used for credit scoring and for life and health insurance pricing [5]. The 2026 amendment lets a deployer "include cross-references to the relevant sections of that data protection impact assessment", meaning the assessment it already made under the General Data Protection Regulation (GDPR), the EU's main privacy law [4].

Two more dates and the fines

Under Article 50(1), providers of AI systems meant to interact directly with people must design them so that those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed person in the circumstances [5]. Article 50 applies from 2 August 2026. Providers of AI systems that generate synthetic audio, images, video or text and that "have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026" [4]. Article 50(2) is the duty to mark AI-generated content.

Breaking the Act's prohibitions can cost "up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover", whichever is higher, and breaking most other duties can cost up to EUR 15 million or 3%, again whichever is higher [5]. Regulation (EU) 2026/1744 added that for small mid-cap companies, the fines for those other duties are capped at the lower of the two amounts [4]. A large company that is not a small mid-cap faces the higher amount.

Date	What applies	Source
2 February 2025	Chapters I and II, including the AI literacy duty in Article 4 and the prohibited practices in Article 5	[4]
2 August 2026	General application of the Act, including Article 50	[5]
2 December 2026	Marking duty for generative systems placed on the market before 2 August 2026; two prohibitions that Regulation (EU) 2026/1744 added to Article 5	[4]
2 December 2027	High-risk duties for Annex III systems, including deployer duties	[4]
2 August 2028	High-risk duties for Annex I systems	[4]

The guide on the EU AI Act and your product covers the provider side, and AI in banking covers credit scoring in banks. The AI literacy duty is on the page AI training for staff.

ISO/IEC 42001: a management system for AI

ISO/IEC 42001 is a standard from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It "specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations" [6]. A management system is a set of written policies and procedures that a company follows and checks. ISO says that implementing the standard "means putting in place policies and procedures for the sound governance of an organization in relation to AI, using the Plan-Do-Check-Act methodology" [6]. In that method, a company plans its controls, carries them out, checks the results, and acts on what the check finds.

The current edition is the first, published in December 2023, with 51 pages [6]. Certification is optional: "Certification for ISO/IEC 42001 is voluntary" [7]. ISO itself certifies nobody: "Certification is carried out by independent certification bodies, which may be accredited by national accreditation bodies" [7]. A second standard, ISO/IEC 42006:2025, published in July 2025, "sets out the additional requirements for bodies that audit and certify artificial intelligence management systems" [8]. A buyer that asks a vendor for a 42001 certificate can ask which body issued it and whether that body follows 42006.

ISO states the limit: "The standard does not replace laws or regulations" [7]. ISO describes it as a management framework that helps organisations meet their compliance duties [7]. A company with a 42001 certificate still has to meet each EU AI Act duty that applies to it.

Colorado SB26-189: automated decisions about people

Colorado's SB26-189 became law on 14 May 2026. It replaces the 2024 Colorado AI Act, SB24-205: it "repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions" [9]. The act defines automated decision-making technology (ADMT) as technology that processes personal data and uses computation to produce output, such as scores or recommendations, that is used to make, guide or assist a decision about a person. Its duties fall on a covered ADMT, one used to materially influence a consequential decision [9]. A consequential decision is one about a person's "access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits" [9].

The bill summary sets these duties [9]:

• From 1 January 2027, developers must give deployers technical documentation, including intended uses, categories of training data, known limitations and instructions for human review.
• Developers and deployers must keep records that show compliance "for at least 3 years".
• Deployers must give consumers clear notice at the point of interaction with a covered system.
• After an adverse decision, a deployer must give the consumer "a plain language description of a covered ADMT's role within 30 days", and the attorney general must adopt rules on this disclosure by 1 January 2027.
• Consumers can ask for meaningful human review and reconsideration of an adverse decision.

The attorney general enforces the law under the Colorado Consumer Protection Act. Before bringing an action before 1 January 2030, the attorney general must give a 60-day notice and a chance to fix the problem, and "The act does not create a new private right of action" [9]. This page is based on the bill summary. The signed act was not read, so the start date of the deployer notice duties is not given here; check it with counsel.

Enforcement is on hold under a federal court order

On 9 April 2026, xAI sued the Colorado attorney general in the US District Court for the District of Colorado, in the case X. AI LLC v. Weiser (case 1:26-cv-01515), and the United States joined as a plaintiff on 24 April 2026 [10][11]. All three parties then asked the court to pause the case. On 27 April 2026, Magistrate Judge Cyrus Y. Chung granted their request and ordered that "The defendant shall not initiate enforcement, including but not limited to the initiation of an investigation, for alleged violations of SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session)" [10]. SB26-189 replaced SB24-205 in that session, the 2026 regular session [9], so the order covers it.

The order covers violations that happen up to 14 days after the court rules on a motion for a preliminary injunction that xAI agreed to file. A preliminary injunction is a court order that blocks a law while the case goes on. Under the same order, xAI files that motion within 28 days after "final adoption of rulemaking implementing SB24-205 or any legislation that may replace or amend SB24-205" [10]. The court record, read on 26 October 2026 through CourtListener, shows no such motion yet and no later order that changes the stay [11]. Its newest entries, of 2 October 2026, concern a lawyer leaving the case [11].

The law and its 1 January 2027 date for developer documentation stay in place. The order limits which conduct the attorney general may investigate or bring a case over. Reveneau's view is that a company should prepare the records and notices anyway, because conduct from the 15th day after the court's ruling falls outside the order, and the date of that ruling is not known.

A governance setup for a large company

The table below is Reveneau's suggested setup. Each line points to the text that asks for it, so one setup can answer the framework, the law and the standard together.

Part of the setup	What it holds	Where it comes from
AI inventory	Every AI system in use, its purpose, its vendor and its owner	NIST GOVERN 1.6 [2]
Risk tier for each system	Whether it is EU high-risk, a Colorado consequential decision, or neither	EU AI Act Annex III [5]; SB26-189 [9]
Purpose and setting, written down	What the system is for, where it runs, which laws apply	NIST MAP 1.1 [2]
Tests before release, with results kept	Test sets, metrics and dated results	NIST MEASURE 2.1 [2]
Oversight and switch-off	A named person who can stop each system, and when to do it	NIST MANAGE 2.4 [2]; AI Act Article 26(2) [5]
Logs and records	Logs for six months or more; compliance records for three years where Colorado applies	AI Act Article 26(6) [5]; SB26-189 [9]
Notices	Workers told before high-risk use; consumers told at the point of interaction	AI Act Article 26(7) [5]; SB26-189 [9]
Management review	A regular check of whether the setup works, under Plan-Do-Check-Act	ISO/IEC 42001 [6]

An eval is a written, repeatable test of an AI system's answers against cases the company chooses. Eval results, kept with their dates, are the evidence the measure function asks for. The guides on why AI evals matter and AI agent evals explain how to write them. Security belongs in the same setup, and the page AI security risks for a large company covers it. Data rules are on getting company data ready for AI.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, and that it takes responsibility for the whole project through production and after release. For a large company, the dated results of that suite are one piece of the record the governance setup above asks for. To talk about a project, see Reveneau's services or contact Reveneau.