How to run a framework assessment of your AI governance

A framework assessment compares what your organisation actually does with a recognised reference, requirement by requirement, so you can see where you stand and what is missing. It answers a different question from a maturity assessment. Maturity asks how well your practices operate. A framework assessment asks whether they meet a specific set of requirements someone outside will read you against.

Choose the framework that fits

The frameworks answer different questions, so choose by what you need the assessment for. ISO/IEC 42001 is a certifiable management-system standard, so assessing against it suits an organisation heading toward certification or wanting the discipline of a management system. The NIST AI Risk Management Framework, built around its Govern, Map, Measure and Manage functions, is voluntary and outcome-focused, and suits an organisation wanting a risk lens without pursuing a certificate. A law is different again. If you are in scope of the EU AI Act, the obligations it places on your role, as provider (the organisation that builds or supplies the system) or deployer (the organisation that uses it), are the requirements to map. Many organisations assess against more than one, because the frameworks overlap heavily and a strong practice satisfies several at once. The framework crosswalk shows where they meet.

Map each requirement to your practice

The assessment is a mapping exercise, so build the map. Take each requirement or control of the chosen framework and set against it what your organisation actually does, and the evidence that shows it. A requirement met in practice but unevidenced is not met for the purpose of an outside reader, so record both the practice and the record behind it. Work through the framework in full rather than sampling the parts you are confident about. The assessment is most valuable exactly where you would rather not look, and a map with the inconvenient parts left off it is not an assessment. It is a reassurance.

Mark plainly and read the findings

For each requirement, mark where you stand, met and evidenced, partly met or not met. Resist the pull toward the generous mark, because the point is to find the work, not to feel finished. The findings are the output. Read them for pattern, whether they cluster in scope, in evidence, in the management-system machinery or in lifecycle maintenance, because a cluster tells you where to concentrate. An assessment that produces a tidy result with nothing material to report usually means the marking was soft, not that the programme is complete.

Assess again, not once

A single assessment is a snapshot, and a programme and its framework both move. Systems change, new AI is adopted and the frameworks themselves are revised. Set a schedule to assess again, so you can show not only where you stand but that you are closing findings over time, which is what a board and an auditor actually want to see. ISO/IEC 23894 frames AI risk management as an ongoing activity across the lifecycle, and the same holds here. A programme that assesses itself once and files the result is describing a moment, not managing its governance.

What a useful assessment produces

• A clear reference, the framework chosen and why it fits the organisation.
• Each requirement mapped to current practice and to the evidence behind it.
• A plain mark against each, met and evidenced, partly met or not met.
• The findings read for pattern, so the work concentrates where it matters.
• A schedule to assess again, so progress over time is visible.

In Australia

The Australian reference is the National AI Centre’s Guidance for AI Adoption, published by the Department of Industry, Science and Resources in October 2025. It sets out six essential practices and replaced the earlier Voluntary AI Safety Standard and its ten guardrails, so an assessment built on the guardrails should be re-mapped to the six practices. It is voluntary and written to align with international standards, ISO/IEC 42001 among them, so an assessment against it carries across to the international references. Public sector bodies have their own references, the DTA policy for the responsible use of AI in government and, in New South Wales, the NSW AI Assessment Framework. Organisations that make automated decisions about individuals also have the Privacy Act transparency obligations for automated decision-making (ADM) from 10 December 2026, which are law rather than guidance.

Where Aicura fits

Framework mappings most often go wrong on coverage, because requirements get mapped against the systems someone remembered. Aicura’s discovery and AI register give you the current list of AI systems first. Risk and impact assessments then apply the frameworks you enable to each registered system and agent, governance policy reviews return recommendations against them, and a policy review report shows where each policy stands against the frameworks it was reviewed under. Risks and Controls tracks the resulting controls as applicable, implemented and tested, which is much of the practice a framework assessment maps against.

The frameworks on offer follow the plan and your country. ISO/IEC 42001 and the NIST AI RMF are in Pro everywhere, and each country adds its own, such as the EU AI Act in Essentials in the EU, or the Guidance for AI Adoption and the NSW AI Assessment Framework in Essentials in Australia. The marks against each requirement stay yours.

Sources

• ISO/IEC 42001:2023, AI management system, International Organization for Standardization, iso.org
• AI Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, nist.gov
• ISO/IEC 23894:2023, AI risk management guidance, International Organization for Standardization, iso.org
• Guidance for AI Adoption, National AI Centre, Department of Industry, Science and Resources, industry.gov.au

A note on this page

This guide is general information on how to assess AI governance against a recognised framework. It is not legal advice and it does not tell you whether your organisation meets a particular framework or obligation. For how a framework applies to your organisation, read the primary sources above and take your own professional advice.