Three layers to remember
Think of AI governance as a building with three floors. Each floor answers a different question, and each is owned by a different team.
| Layer | Question it answers | Binding? | Owner |
|---|---|---|---|
| Principles | What should AI do / not do? | Non-binding | Board / leadership |
| Frameworks | How do we actually run AI responsibly? | Voluntary | CTO / Risk |
| Laws | What must we do, or get fined? | Binding | Legal / Compliance |
Layer 1 - Principles (non-binding)
Principles are the shared language: what every government and large company broadly agrees "good AI" looks like. They are not enforceable, but they shape everything above them.
| Instrument | Year | What it is |
|---|---|---|
| OECD AI Principles | 2019 (revised 2024) | The global baseline; adopted across 40+ jurisdictions |
| OECD AI Policy Observatory (OECD.AI) | 2020 | The "principles → practice" coordination layer |
| EU Ethics Guidelines for Trustworthy AI | 2019 | The 7 requirements that shaped EU thinking |
| UNESCO Recommendation on AI Ethics | 2021 | First global normative framework; all 193 member states |
| G7 Hiroshima Code of Conduct | 2023 | Voluntary code for advanced AI developers |
| Bletchley / Seoul / Paris Declarations | 2023-25 | AI Safety Summit series; Paris (2025) shifted toward competitiveness |
| ASEAN Guide on AI Governance & Ethics | 2024 (GenAI expansion 2025) | Southeast Asian, pro-innovation |
Layer 2 - Frameworks & standards (voluntary)
This is where values turn into daily practice - the playbook, the controls, and the proof. Frameworks are voluntary, but increasingly demanded by enterprise procurement and insurers, and they are the most direct way to evidence compliance with the law.
| Instrument | Year | What it is |
|---|---|---|
| NIST AI RMF 1.0 (+ Generative AI Profile) | 2023 (2024) | US voluntary framework: Govern-Map-Measure-Manage |
| ISO/IEC 42001 | Dec 2023 | First certifiable AI management system ("ISO 27001 for AI") |
| ISO/IEC 23894 | 2023 | AI risk-management guidance |
| Singapore Model AI Governance Framework + AI Verify | 2019 / 2022 | Practical guide plus a testing toolkit |
| UK AI assurance resources | 2023- | The UK's de-facto "how-to" for assurance |
| Canada Directive on Automated Decision-Making | 2019 | Algorithmic Impact Assessments for federal use |
Layer 3 - Laws & regulations (binding)
Binding rules with penalties. This is the floor you cannot skip if you operate in the relevant market.
| Instrument | Year / status | What it is |
|---|---|---|
| EU AI Act (Reg. 2024/1689) | In force Aug 2024; high-risk now confirmed Dec 2027* | World's first comprehensive horizontal AI law |
| Council of Europe Framework Convention on AI | Signed 5 Sep 2024 | First binding international AI treaty |
| China generative-AI rules | 2022-23 | Layered rules; first GenAI-specific regulation globally |
| US - federal AI executive order (replacement) | Jan 2025 | Pro-innovation pivot; replaced the prior 2023 executive order |
| US OMB Memo M-24-10 | Mar 2024 | Binds federal agencies; Chief AI Officers + AI inventories |
| Colorado AI Act (SB 24-205) | Signed 2024; enforcement paused/replaced 2026** | First US state comprehensive AI law |
| South Korea AI Basic Act | Effective 22 Jan 2026 (penalties deferred ~1 yr) | Second jurisdiction after the EU; lighter than the AI Act |
*The EU AI Act high-risk deadline was confirmed deferred from 2 Aug 2026 to 2 Dec 2027 under the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) - see our Digital Omnibus explainer. **Colorado's law was delayed to 30 June 2026, then its enforcement was paused by a federal court in April 2026 while the legislature passed a scaled-back replacement (SB 189) in May 2026 - a live example of ambition outrunning execution.
Why the stack is useful in any exec conversation
- It prevents confusion. "We follow OECD principles" does not mean "we comply with the EU AI Act." Different floors, different obligations.
- It clarifies ownership. Values sit with the board; operations with the CTO and Risk; law with Legal and Compliance.
- It shows where to invest first. Most companies need to climb up: meet the law, build the operations, then credibly claim the values.
- It travels. Swap the EU AI Act for the US, UK, or Korean rules and the stack still holds.
The bottleneck is the operating model
Here is the strategic insight. The next phase of AI governance is no longer about defining ethical principles or drafting law - both layers are maturing fast. The bottleneck is the middle floor: how organisations actually implement governance at scale.
Two live illustrations make the point. The OECD.AI Policy Observatory shows principles hardening into shared infrastructure. The Colorado AI Act's repeated delays show the opposite risk - ambition outrunning the operational capacity to implement it. The gap, in both directions, is operations.
Where Aurora Trust sits: Floor 2 - Operations. We translate the values on Floor 1 into the compliance Floor 3 demands - risk classification, requirements mapping and structured governance documentation - for the SMEs that cannot build that operational floor on their own. From €49/month.