Industry standards and frameworks
The standards that shape how organisations govern AI, manage risk, and prove their controls work. Each entry maps the framework's own language back to the ATLAS risk and control model.
Seven frameworks covering vulnerability standards, threat intelligence, risk management, regulation, and industry practice. Select by category or compare across domains.
Vulnerability standard
A widely used community-driven reference for identifying and mitigating security risks in applications powered by large language models, published by the OWASP GenAI Security Project.
Threat framework
A globally recognised knowledge base of adversary tactics, techniques and case studies for AI systems, modelled after MITRE ATT&CK and maintained by the MITRE Corporation.
Vulnerability standard
A community-driven reference for the security risks of agentic AI systems, where LLMs plan, execute multi-step tasks, invoke tools and operate with delegated authority.
Regulation
The European Union's comprehensive regulatory framework for artificial intelligence, establishing a risk-based classification system with escalating obligations for providers and deployers of AI systems.
Management standard
The first international standard specifying requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation.
Industry framework
A conceptual framework from Google for securing AI systems across their lifecycle, built on six core elements that extend familiar security principles into the AI domain.
Risk management
The U.S. National Institute of Standards and Technology framework for managing risks in the design, development, use and evaluation of AI products and services.
Start with the risk you care about in the Risk Catalogue, find the control that mitigates it in the Controls Catalogue, then return here to see which framework demands evidence for that control.
Risk → Control → Framework → Evidence. That is the operational reading ATLAS was built for.
