Two of the best-known AI governance standards, the NIST AI Risk Management Framework and ISO/IEC 42001, are voluntary, and most companies file them under "nice to have." This briefing explains why that treatment is a costly mistake, and why the people most likely to expose it are not regulators. They are plaintiffs' attorneys and insurance underwriters.

The standard of care is a negligence principle that judges a company against what a reasonable peer would have done. Once a practice becomes common, courts and insurers begin to treat it as the benchmark for reasonable conduct, and for AI that benchmark is taking shape now. This briefing covers what the two standards actually are, how the risk arrives through ordinary negligence and discrimination claims and through underwriting, what a 1932 tugboat case still teaches about reasonable precau ...