TL;DR

  • Four frameworks matter for a bank evaluating AI governance right now: NIST’s AI Risk Management Framework, ISO/IEC 42001, the Financial Services AI Risk Management Framework, and the EU AI Act.
  • The Financial Services AI Risk Management Framework, released February 2026, is the one built specifically for this audience. The US Treasury designed it with the Cyber Risk Institute and over 100 financial institutions, and it names community banks and credit unions directly.
  • None of the first three are mandatory in the United States. Adopting one demonstrates governance to an examiner or a customer. It does not substitute for supervisory guidance like SR 26-2.
  • ISO/IEC 42001 is the one framework here that produces a certificate an outside auditor can independently verify.
  • The EU AI Act applies to a US bank only in specific circumstances, when it places an AI system on the EU market or when the system’s output is used in the Union. A purely domestic institution falls outside those conditions by default.
  • Honest caveat: none of these frameworks generate the audit trail an examiner asks for. Adopting one on paper still leaves a bank to build the evidence itself.

A bank comparing AI governance frameworks is usually trying to answer one question: which one should we adopt first? For most of this audience, the answer is the Financial Services AI Risk Management Framework, since it was built specifically for institutions like theirs. ISO/IEC 42001 matters once a partner or customer asks for independent certification. NIST’s framework supplies the common vocabulary underneath both. The EU AI Act applies to almost none of this audience, and most readers can set it aside.

Four AI governance frameworks a bank needs to know

An AI governance framework is a structured set of practices for identifying, managing, and documenting the risks a bank’s AI systems create. Four frameworks show up in almost every serious comparison: NIST’s AI Risk Management Framework, ISO/IEC 42001, the Financial Services AI Risk Management Framework, and the EU AI Act. Only one was built for this audience specifically.

A framework is voluntary guidance a bank chooses to adopt. Supervisory guidance sits in a different category. SR 26-2, the Federal Reserve’s current model risk guidance, states directly that it does not set enforceable standards, but examiners still use it to structure what they ask a bank to show, a distinction covered in more depth in iTuring’s piece on model governance. None of the four frameworks compared here carry even that supervisory weight. All four are voluntary. Adopting one is a choice a bank makes on its own. No supervisor requires it.

NIST AI RMF: the voluntary foundation most other frameworks build on

The NIST AI Risk Management Framework is a voluntary set of practices for managing AI risk, published by the National Institute of Standards and Technology in January 2023. It organizes AI governance into four functions: Govern, Map, Measure, and Manage. Most frameworks published since, including the two built specifically for finance below, use this same structure or reference it directly.

Govern sets the policies and accountability structure before any model ships. Map identifies the context and risk profile of a specific AI use case. Measure tests the system against that risk. Manage tracks and responds to risk once the system is in production.

NIST built the framework through an open public comment process, and it applies across every industry. It was not built for banking specifically. No US law requires an institution to adopt it. Its real value is the shared vocabulary. When a bank’s own documentation uses these same four functions, a supervisor, an auditor, or the next framework the bank adopts can all read it the same way.

ISO/IEC 42001: the certifiable standard auditors can point to

ISO/IEC 42001 is the international standard for AI management systems, published by the International Organization for Standardization in 2023. An organization can pay an accredited body to certify against it, producing a certificate a customer or examiner can independently verify, something NIST’s framework does not offer.

Certification is voluntary, and ISO 42001 applies to any organization that builds, deploys, or uses AI systems. It was not built for financial institutions specifically. A bank that certifies is telling the market it has a documented, audited AI management system in place. That certificate carries weight with a customer or a counterparty running its own vendor due diligence. It does not satisfy anything a US banking examiner asks for on its own. Examiners work from supervisory guidance, and ISO standards sit outside that guidance.

The Financial Services AI Risk Management Framework: the one built for this audience

The Financial Services AI Risk Management Framework, or FS AI RMF, is the only one of these four built specifically for banks, credit unions, and other financial institutions. The US Treasury released it on February 19, 2026, developed with the Cyber Risk Institute and more than 100 financial institutions, alongside a shared AI lexicon for the sector.

The framework states directly that it was “designed for all financial institutions, community banks, credit unions, national and multinational banks, insurers, investment firms, and more, and their third-party providers.” That scope statement matters. NIST’s framework and ISO’s standard were written for any industry and adapted afterward. The FS AI RMF started from a bank’s actual risk categories: credit decisioning, fraud detection, collections, underwriting.

For a bank deciding where to start, this is usually the right first stop. It speaks the language a risk committee already uses, and it names the reader directly. A general-purpose standard requires a translation exercise first. This one does not.

Comparison of four AI governance frameworks: NIST AI RMF, ISO/IEC 42001, the Financial Services AI Risk Management Framework, and the EU AI Act, highlighting their scope, certification options, and regulatory requirements.

The EU AI Act: when it applies to a US bank

The EU AI Act is a binding regulation. That sets it apart from the three voluntary frameworks above, and the distinction matters immediately. It applies to a provider or deployer of an AI system when that system is placed on the EU market, or, separately, when the system’s output is used in the Union, even if the provider itself is based entirely outside the EU. A US institution that meets neither condition falls outside its scope.

The confusion is understandable. Search results and vendor content frequently list the EU AI Act alongside NIST and ISO as though every bank needs to check all three the same way. A domestic US bank with no AI system placed on the EU market and no output reaching EU users has no obligation under the Act today. The reason it still belongs in this comparison is scale. A bank that expands into the EU, partners with a European fintech, or serves a customer base that grows to include EU residents can trigger the Act’s requirements without changing anything else about its US operations. Worth tracking. Not worth acting on, for most readers of this piece.

How these frameworks relate to what a US examiner checks

None of the four frameworks in this piece replace SR 26-2, the Federal Reserve’s current model risk guidance. SR 26-2 states plainly that it does not set enforceable standards, but examiners still use it to structure what they ask a bank to show. Adopting a framework gives a bank a structured way to produce that evidence. It does not substitute for producing it.

SR 26-2’s one firm requirement is naming an individual accountable for each model, covered in detail in iTuring’s piece on model governance. None of the four frameworks compared here mandate that specific structure, though the FS AI RMF’s governance function and NIST’s Govern function both point the same direction. A bank that builds its AI governance program around one of these frameworks usually finds an examiner’s questions easier to answer. That happens because the documentation habit the framework builds matches the habit the examiner is checking for. The framework itself does not satisfy the exam on its own.

Choosing a starting point: a short decision guide

Most banks do not need all four frameworks at once. The right starting point depends on two things: whether a customer or partner is asking for independent certification, and whether the bank’s AI use touches EU customers at all.

  1. No EU exposure, no certification request. Start with the FS AI RMF. It matches the institution’s actual risk categories and requires no external audit to begin using it.
  2. A partner or customer wants independent proof beyond a policy document. Pursue ISO/IEC 42001 certification, using the FS AI RMF’s risk categories as the input.
  3. Building the internal vocabulary from scratch. Start with NIST’s four functions, then layer the FS AI RMF’s financial-sector detail on top.
  4. Any EU customers or operations, even a small number. Confirm EU AI Act scope with counsel before finalizing a framework choice, since the Act carries binding requirements the other three do not.

How iTuring supports whichever framework you adopt

A framework sets the categories a bank has to document. It does not generate the audit trail itself. iTuring’s platform produces that trail automatically, structured so it can answer to any of the four frameworks compared here without a bank rebuilding its evidence each time a customer or examiner asks for a different one.

Model Gov keeps a single accountable owner and a maker-checker approval record for every model, the same governance evidence NIST’s Govern function and the FS AI RMF both ask for. Model Risk Management tracks the testing and monitoring evidence NIST’s Measure and Manage functions expect. Data Accelerator carries the lineage record an ISO 42001 audit or an FS AI RMF review would both want to see, covered in more depth in iTuring’s piece on data governance models. A bank does not have to choose a framework before choosing iTuring. The platform’s evidence works for whichever one it lands on.

Most banks reading this do not need to adopt all four frameworks. They need to pick the one that matches what the next twelve months ask of them, a certification request, an examiner’s question, or building a defensible program before either arrives. Book a 15-minute discovery call to see how iTuring’s audit trail maps to whichever framework fits your institution.

Sources

  1. “Treasury Releases Two New Resources to Guide AI Use in the Financial Sector,” US Department of the Treasury, 19 February 2026. https://home.treasury.gov/news/press-releases/sb0401
  2. “Financial Services AI Risk Management Framework,” Cyber Risk Institute. https://cyberriskinstitute.org/artificial-intelligence-risk-management/
  3. “AI Risk Management Framework,” National Institute of Standards and Technology, published January 2023. https://www.nist.gov/itl/ai-risk-management-framework
  4. “ISO/IEC 42001 explained,” International Organization for Standardization. https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html
  5. “Article 2: Scope,” EU Artificial Intelligence Act (Regulation (EU) 2024/1689), artificialintelligenceact.eu. https://artificialintelligenceact.eu/article/2/