Which AI governance framework should an enterprise adopt first?

Pick by what forces the deadline. If a regulator does, start with the regulation: the EU AI Act if you place systems on the EU market, sector rules if you are in financial services or healthcare. If a customer does, start with ISO/IEC 42001:2023, because it is the only certifiable AI standard and a certificate is what clears security review. If neither does, start with NIST AI RMF, because it is a process you can run in weeks rather than a program you staff for a year.

The practical answer for most enterprises is not a choice at all. Adopt NIST AI RMF as the operating model and treat ISO 42001 as the audit wrapper you layer on when a deal requires it. The two are compatible by design, and the work you do under GOVERN, MAP, MEASURE, and MANAGE maps cleanly onto ISO clauses and Annex A controls without rework.

What does not work is adopting a framework before you have a system inventory. Every framework assumes you can enumerate your AI systems, and the enumeration is the hard part. Programs that skip it produce a risk register describing four approved systems while the organization runs forty.

The second failure is choosing a framework to satisfy the board rather than to constrain deployment. If no agent has ever been blocked or delayed by your governance process, the framework is documentation.

Akto Atlas and Akto Argus supply the inventory and runtime evidence these frameworks assume you already have, covering employee AI usage and homegrown agentic applications respectively.

Inventory first. The framework is how you organize what you find.