# AI rules by market, ISO 42102

Home / Rules by market

# Where the framework meets the law

ISO/IEC DIS 42102 is a voluntary descriptive standard. It creates no legal duty on its own. The duties come from the law and regulation of each market, and those instruments have their own definitions. This page names the instruments behind this page that matter to the buyer in four markets and says plainly which texts are covered here and which are named only.

How to read this page. A named instrument is not a quoted instrument. Where a market's regime is not covered in this record, we name it and do not state a clause as if we had read it. Check the current official text before you rely on it.

## United States

The federal position is guidance rather than a single AI statute. This page names the NIST AI Risk Management Framework 1.0 and its generative AI profile. They share the vocabulary of risk, impact and life cycle with the draft, and they are the reference most US AI governance programmes use. Sector regulators and state privacy laws add duties on data, notice and automated decisions; those are named only.

## European Union

This page names the EU Artificial Intelligence Act. It defines AI system and sets obligations by risk category, with duties for providers and deployers. A firm that uses the 42102 descriptors in its AI Act evidence should map the two, because the regulation has its own definitions and its own scope tests. The descriptive framework does not replace the regulation and does not satisfy it.

## United Kingdom

The UK has no single AI act. The approach is a pro-innovation framework applied by existing regulators, with the Information Commissioner's Office leading on data protection and AI guidance. There is no UK AI-specific instrument in this record. The practical reference is ISO/IEC 42001:2023, adopted as a British standard, and the ICO guidance is named here but not quoted. UK legal duties come from data protection law and the sector regulator.

## Australia

This page names the Australia Guidance for AI Adoption (2025) and the National Framework for the Assurance of AI in Government (2024). Both are voluntary for most organisations; the Privacy Act 1988 sets the binding duties on personal information. The state and territory AI policies add duties for public sector bodies, and they are named where relevant.

## What this means for the matrix

Keep two columns in the kit: the descriptor claim and the legal instrument that uses the same idea. They are not the same claim. The framework tells you how to describe a system; the law tells you what you must do. A register that blurs them will fail the first legal review.

## The controls behind this page

The matrix page crosswalk draws on 167 requirement rows exported from ISO/IEC 42001:2023, ISO/IEC 23894:2023 and ISO/IEC 42005:2025. Each framework page on compliance.theartofservice.com states the requirement in our words and cites the clause, so a reader can check a line without opening the standard.

- ISO/IEC 42001:2023, AI management system

- ISO/IEC 23894:2023, AI risk management

- ISO/IEC 42005:2025, AI system impact assessment

Last updated: 2026-10-22

Source: https://iso-42102-revision-checker.theartofservice.com/rules/