Frameworks: the law you run against, and the standards you switch on

Frameworks is a tab of Organisation (under Configure). It says which law your organisation is run against and which standards it has chosen to work toward. Any member can read it; only an org admin can switch a standard on or off. The rail's Add a standard link comes here.

Binding law

Listed first, always in scope — neither can be switched off:

• EU AI Act — the spine. Every registered system walks its six stages, and the obligations come from each system's role and risk tier. See The EU AI Act journey: six gated stages per system.
• GDPR — duties on each system that processes personal data, and the organisation's own duties, all on Obligations. It is also an optional programme on every plan, switched on under Organisation → Frameworks: its page is under Frameworks, beside Programmes, and its steps are those same organisation duties. See GDPR for AI systems.

Standards

ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF, each a row with its tag, one sentence on what it is — certifiable, or, for NIST AI RMF, no certification scheme at all — its price line, and a switch. Once a standard is on, its row adds Programme running · n of m done, its target date, Open programme → and, for an admin, Scope and target: the scope statement and target date for that standard, set here once and shown on its programme page.

Switching a standard on adds its programme under Frameworks in the rail, with the steps your EU AI Act work already credits. It changes nothing on your systems — their obligations and stages stay exactly as they were. Switching it off hides the programme and keeps every record. See Programmes: a standard as a path, not a list.

ISO/IEC 42001 and NIST AI RMF are included from the Govern plan; ISO/IEC 27001 is €199 a month on Govern and part of Manage and Enterprise. A standard your plan does not include is marked Not on your plan, with the way to add it. While the frameworks-crosswalk switch is off, each standard reads Not available yet; during the public beta, Available at launch — and the rail shows the three standards as faded rows under Frameworks that do not open yet. The rows are still there either way, and nothing leads to a dead page.

Aria's knowledge sources follow these switches, so a standard you switch on is one Aria can cite.

Where the rest went

This used to be a workspace of its own. Its parts now live where they are used: the programme cards on Programmes under Frameworks; each standard's clause-by-clause map on its programme's Clauses tab; the regulatory-change register on Regulatory watch; and Regenerate obligations — which re-runs the rules engine over every system — on Organisation → Advanced, for admins. Old links to the workspace land on the right one of those.

What the frameworks are not

None of them is a certificate. ISO/IEC 42001 is not a legal shield and NIST AI RMF has no certification; the EU AI Act and GDPR are the binding law, and the standards are ways of organising the work that evidences it. The plain-language reads under Frameworks explained say what each one gives you, and what it does not.