© 2026 Medoya LLC
Powered by voilamia
Medoya Resources
Practical references for AI governance and technical assessment.
Resources › AI Standards & Frameworks
Overview · United States · European Union · Canada · Standards & Frameworks
Standards, frameworks, and threat references can help teams organize their AI risk work and explain the evidence they collect. This page distinguishes management-system standards, voluntary risk frameworks, and technical security references. Their relevance depends on the deployment and any applicable legal or contractual requirements.
Type: Voluntary framework · Last verified: October 29, 2026
NIST's AI Risk Management Framework (AI RMF 1.0, released January 26, 2023) is intended for voluntary use. It helps organizations incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems. The Generative AI Profile (NIST AI 600-1, released July 26, 2024) helps organizations identify risks unique to generative AI and proposes actions to manage them. NIST states that AI RMF 1.0 is being revised.
Practical use. Organize a risk register, evaluation evidence, mitigation decisions, and monitoring responsibilities.
Important distinction. Framework alignment does not establish regulatory approval or certification.
Sources: NIST AI Risk Management Framework · Generative AI Profile, NIST AI 600-1
Type: Management-system standard · Last verified: October 29, 2026
ISO/IEC 42001, published in December 2023, specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system within an organization. It can help connect governance, responsibilities, risk management, and continual improvement.
Practical use. Connect technical assessment records with the organization's management-system processes and evidence.
Important distinction. ISO does not perform certification or issue certificates: certification is performed by independent certification bodies. Management-system certification should not be presented as blanket approval of every AI product.
Sources: ISO: ISO/IEC 42001:2023 · ISO: certification
Type: Technical reference (community security reference) · Last verified: October 29, 2026
OWASP's Top 10 for Agentic Applications identifies the most critical security risks facing autonomous and agentic AI systems that plan, act, and make decisions across workflows. The 2026 edition was published on December 9, 2025.
Practical use. Structure threat modeling, select agent-security test scenarios, and communicate assessment coverage.
Important distinction. Mapping findings to OWASP categories does not establish certification or complete coverage of a deployment's risks.
Type: Technical reference (threat knowledge base) · Last verified: October 29, 2026
MITRE ATLAS is a living knowledge base of adversary tactics and techniques involving AI, based on observations of real-world attacks and realistic demonstrations from AI red teams and security groups.
Practical use. Develop threat models, select assessment scenarios, and map findings to tactics and techniques. Document what was tested and what remained outside scope.
Important distinction. ATLAS is a technical reference. Use its current content: its techniques and case studies change over time.
Sources: MITRE ATLAS · MITRE: AI assurance
Selected AI, privacy, cybersecurity, and sector requirements across the United States, European Union, and Canada, with official sources and key dates.
This resource provides general information about selected regulations and technical considerations. It is not legal advice or a determination that a particular system complies. Check the linked official sources and obtain advice for your circumstances.
Assess what an agent can access and do, test relevant attack paths, and document findings and limitations.
Examine how a vendor's product fits the intended use, including data flows, deployment options, available evidence, and open questions.
Review trust boundaries, permissions, human approvals, logging, and recovery arrangements before deployment or expansion.
Medoya reviews AI agent behavior, vendor evidence, and architecture within an agreed technical scope. We document findings, limitations, and practical next steps so your team can decide what to change and what needs further review.