The most common mistake in AI governance procurement is treating these as substitutes. They are not, and the differences are structural rather than a matter of emphasis:
You cannot opt out of a regulation. The EU AI Act applies to systems in its scope regardless of whether you have adopted anything. Nothing else on this page has that property. You cannot be certified against a regulation. Certification is something an accredited body does against a standard. There is no "EU AI Act certificate", from us or anyone else, and a vendor offering one is describing something that does not exist. A management-system standard certifies your organisation, not your model. ISO/IEC 42001 and ISO/IEC 27001 describe systems an organisation operates. "This model is ISO 42001 compliant" is a category error in the same family as "this laptop is ISO 9001 certified". An attestation is an opinion about a defined scope over a defined period. A SOC 2 report tells you what an auditor tested and what exceptions they found. It does not tell you the organisation passed, because there is no pass mark. Voluntary guidance is genuinely voluntary. NIST AI RMF and CSA AICM confer nothing and require nothing. That is their strength — no certification theatre — and their weakness, in that a document with no deadline attached tends not to get revisited.What they have in common is the underlying work. A team that writes down an intended purpose, assesses risk, governs its data, defines human oversight, logs what happens and monitors the result is doing most of what all six ask for. That is why this tool keeps a canonical control layer and maps out of it, rather than maintaining six parallel checklists that would say the same thing six times.