Skip to content

Frameworks

Three trusted labels, one body of evidence

Every Z2O engagement runs on the same assessment engine. You choose the lens your board, auditors or regulator recognise: NIST AI RMF, ISO/IEC 42001, or the CBN and NDPA requirements in force in Nigeria today.

Policy packs

The three policy packs in depth

Each pack draws on the same evidence and scoring, then reports through the framework your audience trusts.

NIST AI RMF Readiness

A gap assessment against the US NIST AI Risk Management Framework, organised around its four functions: GOVERN, MAP, MEASURE and MANAGE. Z2O scores your governance against each function and shows exactly where the gaps sit.

Published by the US National Institute of Standards and Technology, the AI RMF is the label to choose when your board, auditors or international partners want AI risk management assessed against a widely recognised reference.

In the pack

  • Gap assessment across GOVERN, MAP, MEASURE and MANAGE
  • Domain scoring across Z2O's assessment areas
  • Prioritised recommendations, reviewed and approved by a Z2O consultant
  • Evidence mapped to the framework's four functions

ISO/IEC 42001 Readiness

A gap assessment against ISO/IEC 42001, the international AI management-system standard. Z2O assesses your governance against the standard's clause themes and control areas and reports what stands between you and certification readiness.

The label for organisations that want an internationally recognised management-system standard behind their AI governance. Z2O positions you as certification-ready — formal certification itself comes from an accredited certification body, not from Z2O.

In the pack

  • Gap assessment against the standard's clause themes and Annex A control areas
  • Domain scoring across Z2O's assessment areas
  • Prioritised recommendations that build towards certification readiness
  • Evidence mapped to the standard's clause themes

CBN + NDPA Compliance

Local focus

The same evidence, mapped to exactly what the Central Bank of Nigeria and the Nigeria Data Protection Act require. This is the local pack — and the urgent one, because both regimes are in force now.

The CBN requires AI models used for anti-money-laundering to be validated at least annually for accuracy and bias, with independent review and tamper-proof audit trails. The NDPA requires NDPC registration, DPIAs before high-risk processing, and human review of automated decisions about individuals.

In the pack

  • Gap assessment against CBN and NDPA requirements
  • Domain scoring across Z2O's assessment areas
  • Recommendations prioritised against what is already in force
  • Evidence mapped to exactly what the CBN and the NDPA require

Crosswalk

How Z2O's assessment areas map

Nine assessment areas sit behind every Z2O engagement. Here is where each one lands in the NIST AI RMF and in ISO/IEC 42001.

Scroll sideways for the full table →

Crosswalk mapping Z2O assessment areas to NIST AI RMF functions and ISO/IEC 42001 clause themes
Z2O assessment areaNIST AI RMFISO/IEC 42001
Governance & policiesGOVERNContext, leadership & policy (cl. 4–5)
AI system inventoryMAPAI system inventory & impact scoping (cl. 6, 8)
Risk assessmentMAP / MEASURERisk & impact assessment (cl. 6, 8)
Data protection & privacyMAP / MANAGEData management controls (Annex A)
Testing & monitoringCBN mandateMEASUREPerformance evaluation (cl. 9)
Human oversightGOVERN / MANAGEOperational controls & oversight (cl. 8, Annex A)
Incident managementMANAGEImprovement & incident response (cl. 10)
Vendor governanceGOVERN / MAPThird-party & supplier controls (Annex A)
Training & awarenessGOVERNCompetence & awareness (cl. 7)

Clause references are indicative themes, not a clause-by-clause mapping — this is a control-objective-level crosswalk. The highlighted row is the one the CBN's annual model-validation mandate points at: independent testing of models for accuracy and bias sits under Testing & monitoring.

A readiness service, stated plainly. Every Z2O pack is a readiness and gap service — not a certified conformity statement. Formal ISO/IEC 42001 certification can only be issued by an accredited certification body. Z2O is the readiness partner that gets you there.

Choose the label your audience trusts.

One engagement produces the evidence; the framework lens is yours to choose. Tell us which audience you need to satisfy — board, auditors or regulator — and we will scope from there.

Book a consultationRead the regulatory picture