Model Governance Index is a procurement-grade reference for AI governance and model oversight. Understand where your program stands against named frameworks (NIST AI RMF, ISO/IEC 42001, IIA’s AI Auditing Framework), learn exactly what to verify before you retain an AI governance or compliance consultant, and explore a sourced reference to the frameworks and real firms active in the space. Procurement support, not a compliance guarantee.https://modelgovernanceindex.com/en-ushttps://modelgovernanceindex.com/frameworks/nist-ai-rmf/https://modelgovernanceindex.com/frameworks/nist-ai-rmf/The NIST AI RMF provides voluntary guidance to help organizations that design, develop, deploy, or use AI systems manage risks to individuals, organizations, and society. It is intended for use across sectors, use cases, and organization sizes, and is not tied to any specific technology. The framework organizes AI risk management around four functions, Govern, Map, Measure, and Manage, oriented toward seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed.https://modelgovernanceindex.com/frameworks/iso-iec-42001/https://modelgovernanceindex.com/frameworks/iso-iec-42001/ISO/IEC 42001:2023 specifies requirements, with guidance, for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within an organization. It is the first international management-system standard written specifically for AI and is designed for any organization, of any size or sector, that provides or uses AI-based products or services. It addresses AI-specific concerns such as algorithmic bias, transparency, and lifecycle impacts rather than treating AI as generic IT.https://modelgovernanceindex.com/frameworks/eu-ai-act/https://modelgovernanceindex.com/frameworks/eu-ai-act/The EU AI Act is a binding EU regulation establishing harmonised rules for the development, placing on the market, and use of AI systems across the European Union. It applies a risk-based approach: it bans certain 'unacceptable risk' AI practices, imposes detailed obligations on 'high-risk' AI systems, sets lighter transparency duties on limited-risk systems, and adds separate obligations for providers of general-purpose AI (GPAI) models. It applies to providers and deployers of AI systems placed on the EU market or whose AI output is used within the EU, regardless of where the provider is established.https://modelgovernanceindex.com/frameworks/iia-ai-auditing-framework/https://modelgovernanceindex.com/frameworks/iia-ai-auditing-framework/The IIA's AI Auditing Framework gives internal auditors principles-based guidance for assessing an organization's AI governance, risk management, and controls. It covers AI risk from strategy and governance through model development, deployment, and monitoring, including generative AI and large language models. It is intended for internal audit functions, chief audit executives, and audit committees performing assurance or advisory engagements on AI use, and it is explicitly structured around the IIA's Three Lines Model.https://modelgovernanceindex.com/frameworks/iia-three-lines-model-ai-governance/https://modelgovernanceindex.com/frameworks/iia-three-lines-model-ai-governance/The IIA's Three Lines Model is a governance and risk-management model that assigns distinct roles to a governing body, management (split into first-line and second-line roles), and an independent internal audit function, the third line. Internal audit practitioners and the IIA apply this same structure to AI governance: first-line roles build, deploy, and operate AI systems and own the resulting risk; second-line roles provide AI-specific risk expertise, monitoring, and challenge; and internal audit provides independent assurance that AI risk is being governed and managed effectively. It is a principles-based model meant to be adapted to an organization's structure rather than a prescriptive control checklist.https://modelgovernanceindex.com/guides/ai-governance-audit/https://modelgovernanceindex.com/guides/ai-governance-audit/What an independent AI governance audit actually covers, how it differs from self-assessment, the IIA and NIST frameworks it should cite, and RFP questions for hiring an auditor.https://modelgovernanceindex.com/guides/llm-security-testing/https://modelgovernanceindex.com/guides/llm-security-testing/How to vet LLM security and AI red-team testing vendors: what prompt-injection and adversarial testing actually covers, what to verify, and RFP questions before you sign.https://modelgovernanceindex.com/guides/ai-governance-consultants/https://modelgovernanceindex.com/guides/ai-governance-consultants/How to evaluate an AI governance consultant or firm: what a program-design engagement should cover, real firms active in the space, and RFP questions before you retain one.https://modelgovernanceindex.com/guides/ai-compliance-consultants/https://modelgovernanceindex.com/guides/ai-compliance-consultants/How to evaluate an AI compliance consultant or platform for a specific regulatory requirement (EU AI Act, ISO 42001), real vendors active in the space, and what to verify before you retain one.