# Choose the layer and map your rules

Lesson 1 of [Evaluate and buy AI governance software](https://aigovernancetools.fyi/academy/evaluate-ai-governance-software.md), 15 minutes.

Choose the right kind of tool first. Then choose the vendor.

## Name the layer

Decide which of the four layers you need: a governance platform, guardrails, red teaming and evaluation, or monitoring and observability. Many programs need several. In that case, choose tools that can send their results to one governance record.

## List the rules that apply to you

Write down each rule. Then ask each vendor to show how the product supports it.

- **EU AI Act**: Article 50 transparency duties apply from 2 August 2026. Annex III high-risk duties apply from 2 December 2027, after the Digital Omnibus on AI.
- **ISO/IEC 42001**: a management system standard for AI.
- **NIST AI RMF**: a voluntary framework with four functions: govern, map, measure and manage.
- **US banking**: SR 26-2 replaced SR 11-7 on 17 April 2026. Generative AI and agentic AI models are outside its scope.
- **Hiring in New York City**: Local Law 144 requires a bias audit of an automated employment decision tool no more than one year before an employer uses it.

## Ask for one control mapped to many rules

A good platform maps one control to several frameworks at once. Then one piece of evidence serves several rules. Ask the vendor to show this with your own example.

## Check that the mapping is current

Rules change. Ask how fast the vendor updates a mapping when a rule changes, and ask for a recent example with a date. A mapping that still shows 2 August 2026 as the Annex III date is out of date.

## Sources

- Article 50 and Article 113, Regulation (EU) 2024/1689 as amended, via artificialintelligenceact.eu
- ISO/IEC 42001:2023, International Organization for Standardization
- AI RMF Core, NIST Trustworthy and Responsible AI Resource Center
- SR 26-2: Revised Guidance on Model Risk Management, Federal Reserve Board, 17 April 2026
- Automated Employment Decision Tools, NYC Department of Consumer and Worker Protection
- AIGovernanceTools buyer guide: How to choose an AI governance platform, updated 2026-10-29

Also on the [web page](https://aigovernancetools.fyi/academy/evaluate-ai-governance-software/choose-the-layer-and-map-your-rules).