Build the evidence once: what actually transfers between AI governance frameworks.

This desk writes for operators outside any single jurisdiction. What follows is a practical split rather than a legal comparison: which artefacts can be built once and shown to everyone, and which determinations have to be made separately for every regime you touch. Where a framework's content is stated, it is stated at the level the framework itself publishes. Where a jurisdiction's operative requirements would need reading at source, this article says so and does not state them.

The shape of the problem

Consider a company headquartered in Toronto with engineering in Bangalore, customers in Germany and the Netherlands, and a product that puts an autonomous agent in front of end users. Over eighteen months it acquires, in roughly this order: an enterprise customer's AI questionnaire, a second one with different questions in a different format, an internal decision to pursue ISO/IEC 42001 because two prospects asked for it, an insurance submission requiring governance documentation, a European legal opinion on whether its product falls within the EU AI Act's high-risk categories, and a board that wants one page describing the whole position.

Handled as six workstreams, this consumes a governance function for a year and produces six documents that contradict each other in small ways, which is worse than producing none, because inconsistency between your own statements is the finding an auditor or an underwriter notices first.

Handled correctly it is one evidence base and a thin layer of jurisdiction-specific conclusions on top. The rest of this article is the line between those two things.

The seven that transfer

Each of these is asked for, in substantially the same form, by the EU AI Act's documentation expectations, by an ISO/IEC 42001 management system audit, by an organisation describing itself in NIST AI Risk Management Framework terms, by an insurance underwriter, and by every serious enterprise procurement questionnaire we have seen in the past year.

Two of these deserve a note. The change history, artefact six, is the one operators consistently underestimate, and it is the one that makes the other six checkable over time rather than true on the day they were written. The methodology treatment of what a defensible change record contains is on agentcertified.eu. The risk assessment record, artefact four, is only reusable if the acceptance of residual risk is attributed to a person rather than to a committee or to the organisation, because an unattributed acceptance answers a form without answering the question.

The four that never transfer

These are determinations rather than artefacts, and each has to be made separately for each regime. Reusing a determination made under one framework as though it answered another is the single most common structural error we see in multi-jurisdiction governance programmes.

Legal classification of the system. Every regime that regulates AI does so by first sorting systems into categories, and no two regimes use the same test. A system that is in scope in one place may be out of scope in another, and the reasoning is not portable even when the outcome coincides. A classification memo has to name the regime it was written under, on its face, or it will eventually be read as a general conclusion. In the European Union this determination also now has a moving date attached to it: the Digital Omnibus, in force since 27 July 2026, deferred the Annex III high-risk obligations to 2 December 2027 and the Annex I obligations to 2 August 2028, while leaving the transparency and governance rules applying from 2 August 2026. Our reading for operators outside the Union is at the AI Omnibus and non-EU operators.

Who your supervisor is. Frameworks differ not only in what they require but in who asks. In some jurisdictions oversight sits with a single designated authority, in others it is distributed across sectoral regulators who each hold a slice, and in others no authority has been designated at all and general consumer, data protection or competition law applies by default. This determines who you talk to, in what register, and on what timetable. It cannot be inferred from another country's arrangement, and it changes: our running position by jurisdiction is at the global status tracker, and any operative requirement in a specific country should be read at that country's own administering body before it is relied on.

Notification duties and their clocks. What must be reported, to whom, within how long, and what starts the clock are jurisdiction-specific and frequently the most operationally demanding thing in a regime, because a reporting window measured in days cannot be met by a process that does not already exist. Notification obligations under AI rules also sit alongside, and do not replace, existing data protection breach reporting and sectoral incident reporting. An organisation that has mapped only one of these has mapped the easy one.

Language, retention and location of records. Where documentation must be held, for how long, and in which language are unglamorous requirements that reliably surprise organisations at the worst moment. They are also the requirements that make a single global evidence store a design question rather than an obvious answer.

What the standards actually certify

Two frameworks are routinely described in a way that overstates them, usually by the party trying to sell something rather than by the standard's own authors.

ISO/IEC 42001:2023 is an AI management system standard. Certification against it means an independent third party auditor has examined an organisation's management system for AI and concluded it exists, is documented, and is operated. That is a real and useful thing. It is an organisational statement. It is not a determination that any particular system complies with any particular law, because a management system standard does not perform system-level legal classification and does not claim to. What certification genuinely does is make regulatory evidence dramatically cheaper to produce, because the artefacts above are already being maintained as a matter of course. Our operator-level treatment is at ISO/IEC 42001 for global operators.

The NIST AI Risk Management Framework, released in January 2023 and organised around the GOVERN, MAP, MEASURE and MANAGE functions, is voluntary and carries no certification scheme. No body issues a certificate against it. Describing your practices in its language is worth doing, because it has become a common vocabulary that procurement teams and US counterparties recognise, and the Generative AI Profile published as NIST AI 600-1 in July 2024 extends that vocabulary to generative systems specifically. A statement of alignment is a self-description and should be labelled as one. Presenting it as a certification is the kind of overclaim that costs credibility precisely when the counterparty is checking. Our treatment of the framework as a standard of care is at the NIST AI RMF and reasonable care.

The instruments that sit above both, the OECD AI Principles as revised in 2024 and the Council of Europe Framework Convention on artificial intelligence opened in 2024, operate at a different level again. They shape what national frameworks converge toward, which is why they are worth understanding, and they impose nothing directly on an operator. Treat them as a forecast of where the seven artefacts will be asked for next, not as a compliance obligation. We cover them at the OECD AI Principles and the Council of Europe Framework Convention.

The deadline that arrives without notice

Regulatory dates are published years ahead and, as the past twelve months demonstrated, sometimes move. Procurement questionnaires are not published, do not move, and block a signature.

For a large share of operators the first hard AI governance deadline was not set by any legislature. It was set by an enterprise customer's vendor risk team, arriving with a spreadsheet, a two-week turnaround, and questions that map with striking consistency onto the seven artefacts above. The organisations that answer those well are not the ones with the most sophisticated regulatory analysis. They are the ones that already had an inventory, an oversight design and a change history, and could send them the same week.

This reframes the economics of the work. Governance evidence built only for a regulator is a cost centre with a deferred deadline, which is why it slips. The same evidence understood as a sales asset has a return that is visible in the current quarter. The artefacts are identical. Only the internal argument for building them changes, and it is the argument that determines whether they get built.

A build order

For an operator starting from very little, across several jurisdictions, the sequence matters more than the pace.

1. Inventory. Everything else is per-system. An inventory missing systems produces gaps in every downstream artefact simultaneously. Expect the first pass to find deployments no governance function knew about; that discovery is the point, not a failure.
2. Change and version history. Start it now rather than reconstructing it later, because it can only ever be built forward. Every week it does not exist is a week that is permanently undocumented.
3. Human oversight design. Cheap to document, high weight with every audience, and the artefact most likely to reveal that a control everyone believed existed does not.
4. Risk assessment record. Per system, with named acceptance of residual risk.
5. Data provenance and incident register. Both are cumulative and both are more painful the later they are started.
6. Classification, per jurisdiction. Last, deliberately. Classifying an incomplete inventory produces confident conclusions about the wrong set of systems.

The one thing not on this list is a policy document. Organisations frequently begin with an AI policy because it is the artefact that can be produced fastest and shown to a board soonest. It is also the artefact that carries the least weight with an auditor, an underwriter or a procurement team, all of whom read it as a statement of intention and then ask what actually happens. Write it after the six items above, when it can describe practice rather than aspiration.

Related analysis

• ISO/IEC 42001 for global operators. What the standard covers and what certification does and does not say.
• The NIST AI RMF and reasonable care. Why a voluntary framework still shapes liability.
• Global AI regulation status tracker. Where each jurisdiction stands, and what has been verified at source.
• Prompt change control as certification evidence. agentcertified.eu. What artefact six looks like when it is done properly.
• Retroactive dates and prior acts. agentinsured.eu. Why the same evidence changes what an insurer will write.