The Real Standards Governing AI and Machine Learning: ISO/IEC SC 42, NIST AI RMF, MLCommons, and ONNX

AI and machine learning moved fast enough that formal standards are still catching up, but a real governance and benchmarking layer already exists, and it’s a genuinely useful way to separate durable, cross-vendor technical ground from any one company’s marketing claims. Here is what actually exists today and who runs it.

The formal international standards committee

ISO/IEC JTC 1/SC 42 is the joint ISO/IEC technical committee dedicated specifically to artificial intelligence, covering foundational concepts, trustworthiness, risk management, and use case documentation at the international standards level. This is the closest thing AI has to the kind of formal, internationally-recognized standard that already exists for information security (ISO/IEC 27001) or cloud computing (ISO/IEC 17788).

The US government’s risk management reference

NIST AI Risk Management Framework (AI RMF 1.0), published as NIST AI 100-1, is a voluntary, sector-neutral framework for managing risk across an AI system’s lifecycle. NIST has continued extending it, including a dedicated Generative AI Profile (NIST AI 600-1) addressing risks specific to large language models, and in 2026 launched an AI Agent Standards Initiative through its Center for AI Standards and Innovation (CAISI), aimed specifically at the kind of autonomous, multi-step agentic systems covered in the automation content on this site.

Engineering ethics and technical standards from IEEE

IEEE Standards Association maintains the IEEE 7000 series, a family of standards addressing ethical considerations in autonomous and intelligent systems design, alongside its longer-running work on the underlying compute and networking standards (802.11, 802.3) that AI infrastructure runs on regardless of which specific model or framework is in use.

Where practical benchmarking and interoperability actually live

• MLCommons: an open engineering consortium that runs MLPerf, the industry-standard benchmark suite for measuring machine learning hardware and software performance across vendors, the closest thing ML has to a fair, apples-to-apples speed comparison between different accelerators and frameworks.
• ONNX (Open Neural Network Exchange), governed under the Linux Foundation’s AI & Data umbrella: an open format for representing machine learning models so they can move between frameworks (train in PyTorch, deploy via a different runtime) without a full rewrite, meaningfully reducing vendor lock-in at the model level.

Why this layer matters even though AI feels unregulated

The perception that AI has “no standards” is mostly a statement about binding regulation, not about the existence of technical reference points. When evaluating a vendor’s AI claims, tying the conversation back to something concrete, does this system have a documented NIST AI RMF risk assessment, is the model portable via ONNX, what MLPerf category (if any) was it benchmarked against, gets you a far more grounded answer than accepting a vendor’s own performance claims at face value.

Frequently asked questions

Is ISO/IEC JTC 1/SC 42 a binding regulation, or is it voluntary like the NIST framework?
Like most ISO/IEC standards, it’s technically voluntary unless a specific jurisdiction’s law references it directly. Its actual value is providing a shared, internationally-recognized technical vocabulary and set of practices that organizations can adopt and be audited against, similar in spirit to how ISO/IEC 27001 works for information security.

Do I need to understand ONNX if I only use commercial AI APIs and never train my own models?
Not for API-only usage, since the provider handles the model format internally. It becomes directly relevant the moment you’re deploying your own model (open-source or custom-trained) and need it to run efficiently across different hardware or serving frameworks, at which point ONNX compatibility is often the deciding factor in how much rework that migration requires.