Ghani Governance · Microsoft Purview
AI security and compliance frameworks
AI security and compliance frameworks such as ISO/IEC 42001, the EU AI Act, the NIST AI Risk Management Framework and the OWASP Top 10 for LLM Applications set out what organisations must govern when they use AI. Ghani Governance maps those requirements to Microsoft Purview controls and evidence, alongside ISO 27001, NIST CSF 2.0, NIS2, DORA and Cyber Essentials, so one set of data controls supports several frameworks.
Information security frameworks
ISO 27001 defines an information security management system (ISMS). ISO 27001 certification is awarded by an accredited certification body after an ISO 27001 audit; we do not certify, but Annex A controls such as A.8.12 Data Leakage Prevention, A.5.34 Privacy and protection of PII and A.8.11 Data Masking map directly to Purview DLP, labels and retention. The NIST Cybersecurity Framework (NIST CSF, now NIST CSF 2.0, published in February 2024 with a new Govern function) is a common outcome-based alternative. SOC 2 reports, Cyber Essentials and Cyber Essentials Plus are often asked for in UK supply chains; Purview evidence helps with the data-handling parts but does not replace them.
AI governance frameworks
ISO/IEC 42001
The AI management system standard (ISO 42001:2023). ISO 42001 certification follows the same audit model as ISO 27001. Its Annex A covers AI policy, AI risk management, data management and incident handling.
EU AI Act
Regulation (EU) 2024/1689. It entered into force on 1 August 2024. Prohibited practices and AI literacy duties have applied since 2 February 2025, general-purpose AI model obligations since 2 August 2025, and the general date of application was 2 August 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I regulated products. It applies to UK organisations that place AI systems on the EU market or whose AI outputs are used in the EU.
NIST AI RMF
The NIST AI Risk Management Framework (NIST AI RMF 1.0, published January 2023) organises AI risk into Govern, Map, Measure and Manage. It is voluntary and widely used as an AI governance framework.
OWASP LLM Top 10
The OWASP Top 10 for LLM Applications (often searched as OWASP LLM Top 10) lists risks such as prompt injection (LLM01:2025) and sensitive information disclosure (LLM02:2025). It sits alongside the better-known OWASP Top 10 for web applications.
MITRE ATLAS and ATT&CK
MITRE ATT&CK (searched as MITRE ATT&CK) catalogues adversary techniques; MITRE ATLAS extends that to attacks on AI and machine-learning systems, such as prompt-injection-led data exfiltration.
NIS2 and DORA
NIS2 (Directive (EU) 2022/2555 on network and information security) and the DORA regulation (Regulation (EU) 2022/2554 on digital operational resilience for the EU financial sector, applying since 17 January 2025) bring governance and incident duties that data controls support.
EU AI Act news and updates
People search for “EU AI Act news today”, “EU AI Act updates today” and “EU AI Act implementation news today” because the timetable keeps moving. Searches for “EU AI Act news today October 2025” and “EU AI Act news today December 2025” reflect the debate that followed the Commission’s November 2025 Digital Omnibus proposal; the resulting Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and amends the high-risk timetable. We do not run a news feed. When we scope work we check the current text in the Official Journal and the European Commission’s AI Act pages on the day, and we record the date we checked. As of October 2026, AI regulation in the UK has no single AI statute: existing regulators apply cross-sector principles within their remits, alongside existing law such as UK GDPR.
How Purview supports framework evidence
Compliance Manager includes assessment templates for many of these frameworks; DLP, labels, Insider Risk, audit and retention produce the evidence. Our Compliance Manager work turns that into an evidence map. See also AI data security threats and Policy to Microsoft Purview design.
Framework questions
Can you get us ISO 42001 or ISO 27001 certified?
Certification is issued only by an accredited certification body. We help with the Microsoft Purview controls and evidence auditors ask about; we do not certify and do not claim accreditation.
Does the EU AI Act apply to a UK business?
It can, if you provide or deploy AI systems in the EU market or AI outputs are used in the EU. Take legal advice on scope; we handle the data controls.
Book a discovery workshop
A scoping conversation about what you need to protect, what is already configured, and what must not break.