airegistryhub.com / standards
A ranked guide to the security, privacy, governance, and assurance standards shaping trusted AI.
Rank 1 · Tier 1
ISO 27001International standard specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
Universal baseline information security prerequisite across global enterprise AI vendors and infrastructure providers; foundational requirement for enterprise trust.
Rank 2 · Tier 1
AICPA SOC 2Auditing standard and framework for service organizations defining controls across Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
De facto non-negotiable procurement standard for enterprise SaaS and AI applications in North America; necessary for enterprise B2B sales and vendor approval.
Rank 3 · Tier 1
EU GDPREuropean data protection regulation with AI-relevant provisions on automated decision-making, profiling, and data subject rights.
Universally enforced data protection regulation with extraterritorial reach and major penalties governing all AI personal data processing, model training, and automated decision-making.
Rank 4 · Tier 2
NIST AI RMFThe NIST AI RMF is the United States government framework for managing AI risks throughout the AI lifecycle with four core functions: Govern, Map, Measure, and Manage.
Premier voluntary AI risk management framework in the US and globally; widely adopted across government agencies, defense contractors, and enterprise AI governance programs.
Rank 5 · Tier 2
OWASP Top 10 for LLM ApplicationsThe Open Worldwide Application Security Project Top 10 for LLM Applications is a curated list of the most critical security threats to LLM and generative AI systems.
De facto industry standard for LLM application security, vulnerability scanning, and red teaming across developers and security practitioners worldwide.
Rank 6 · Tier 2
EU AI ActThe EU Artificial Intelligence Act is an EU regulation classifying AI systems by risk levels (minimal, limited, high, unacceptable) with corresponding compliance obligations.
World's first comprehensive binding horizontal AI law; drives mandatory legal compliance architecture across global AI providers and deployers entering the European market.
Rank 7 · Tier 2
ISO 42001ISO 42001 is an international standard for AI management systems (AIMS) covering responsible AI development and deployment.
First certifiable international standard for AI Management Systems (AIMS); rapidly gaining enterprise traction as the dedicated governance benchmark for AI.
Rank 8 · Tier 3
HIPAAUnited States federal law establishing national standards for the protection, privacy, and security of electronic protected health information (ePHI) in healthcare and AI applications.
Mandatory statutory federal US law strictly enforced for all AI systems handling Protected Health Information (PHI) in healthcare and clinical environments.
Rank 9 · Tier 3
MITRE ATLASMITRE ATLAS is a knowledge base of adversarial tactics, techniques and mitigation strategies for machine learning systems, similar to MITRE ATT&CK for cybersecurity.
Industry-standard adversarial threat matrix and knowledge base used by AI red teams and security operations to model real-world attacks on ML systems.
Rank 10 · Tier 3
CSA AICMThe Cloud Security Alliance’s AI Controls Matrix provides a security controls framework specifically designed for AI/ML systems.
Widely recognized cloud security controls framework specifically tailored for AI/ML systems and CSA STAR for AI assurance.
Rank 11 · Tier 4
OWASP Top 10 for Agentic ApplicationsThe Open Worldwide Application Security Project Top 10 for Agentic Applications is a curated list of the most critical security threats to autonomous AI agent systems.
Rapidly growing developer and security framework targeting autonomous AI agent risks, tool execution, and multi-agent coordination.
Rank 12 · Tier 4
AIUC-1Artificial Intelligence Underwriting Company 1: The standard for AI agent security, safety and reliability
Emerging commercial standard and consortium specifically for AI agent security, independent third-party audits, and insurance underwriting.
Rank 13 · Tier 4
OWASP AIVSSThe OWASP AI Vulnerability Scoring System enables organizations to quantify how agentic capabilities amplify security risks, producing numerical scores (0-10) that combine technical vulnerability severity with agent-specific factors like autonomy, tool access, and memory persistence.
Standardized quantitative scoring framework for AI agent vulnerabilities modeled after CVSS; currently in early-stage adoption.
Rank 14 · Tier 4
AEF-1AI Evaluator Forum - 1: Minimum Operating Conditions for Independent Third Party AI Evaluations.
Voluntary standard establishing minimum operating conditions for independent third-party AI evaluators.
Rank 15 · Tier 5
ISO 42006International standard specifying requirements and providing guidance for bodies providing audit and certification of artificial intelligence management systems (AIMS) under ISO/IEC 42001.
Specialized standard establishing competence and accreditation requirements for bodies auditing and certifying ISO 42001 systems, rather than direct AI deployers.
Rank 16 · Tier 5
Canada Artificial Intelligence and Data Act (AIDA)Canada’s proposed Artificial Intelligence and Data Act regulating AI systems based on impact assessments and risk mitigation.
Proposed Canadian legislation (Bill C-27) currently undergoing parliamentary review; not yet enacted into law or in active enforcement.
