Standards Without Teeth: EU AI Act, NIST, ISO — and What Actually Gets Enforced

“Aligned with NIST AI RMF” has become boilerplate on AI vendor pages, alongside ISO 42001 and IEEE 7010 badges that read like compliance but mostly aren't, yet. Of the frameworks most commonly cited, only the EU AI Act has binding legal force with real penalties attached, and even that is phasing in provision by provision rather than landing all at once. NIST's framework is explicitly voluntary. The ISO standards are certifiable, but certification is opt-in and, so far, sparsely adopted.

That gap between “aligns with” and “is required to comply with” is where a lot of quiet risk sits. A vendor can accurately claim alignment with five respected frameworks while facing zero binding consequences for actually failing any of them, because the enforcement mechanism doesn't exist yet for most of the list. It's not dishonest, exactly — it's citing frameworks that are real and well-constructed. It's just that “aligned with” is doing a lot of quiet work to sound more binding than it is. We think this is precisely the gap independent evaluation is built to fill in the meantime. A voluntary framework with no enforcement still benefits from an external party actually checking whether a system meets it, rather than relying on self-attestation. Our standards-alignment table exists for that reason — not to claim we're a substitute for regulation, but to give buyers and regulators alike a documented, independent read against those frameworks before the legal enforcement machinery catches up.

The EU AI Act's next major phase-in deadline is the one to watch this year — it's the only item on the list with real teeth, and how strictly it's enforced in its first cases will likely set the tone for how seriously the rest of the list gets taken.