No single legal test defines "trustworthy AI." The term comes from voluntary documents: NIST, the U.S. standards agency, lists seven characteristics in its AI Risk Management Framework, the European Commission's expert group listed seven requirements in 2019, Canada published a six-principle code of conduct for generative AI in September 2023, and ISO/IEC 42001 sets requirements for an organization's AI management system. Each document answers a different question, so a claim that a product is "trustworthy" means little until the claimant names which one it follows.
Key takeaways
- NIST AI RMF 1.0 was released on January 26, 2023 and is intended for voluntary use; it names seven characteristics of trustworthy AI.
- The EU's Ethics Guidelines for Trustworthy AI date from April 8, 2019 and list seven requirements; they are guidance, and the assessment checklist that followed came in July 2020.
- Canada's Voluntary Code of Conduct on advanced generative AI rests on six principles and applies only to organizations that sign it.
- ISO/IEC 42001:2023 describes a management system for an organization, not a quality mark for a single model.
- NIST says trustworthiness involves tradeoffs and depends on context, so no checklist produces a pass or fail answer.
Four documents, four meanings of trustworthy
The table compares the main reference documents. It is a simplified orientation, and each issuer's own text controls.
| Document | Issuer and date | Nature | What it lists |
|---|---|---|---|
| AI Risk Management Framework (AI RMF 1.0) | NIST, United States, January 26, 2023 | Voluntary framework | Seven characteristics, from valid and reliable to fair with harmful bias managed |
| Ethics Guidelines for Trustworthy AI | High-Level Expert Group on AI, European Commission, April 8, 2019 | Guidelines with a later self-assessment list | Seven requirements, from human agency and oversight to accountability |
| Voluntary Code of Conduct for advanced generative AI systems | Innovation, Science and Economic Development Canada, September 2023 | Voluntary commitment by signatories | Six principles, from accountability to validity and robustness |
| ISO/IEC 42001:2023 | ISO and IEC, December 18, 2023 | International standard for a management system | Requirements for setting up, running, and improving an AI management system |
NIST's seven characteristics and the tradeoffs between them
The AI RMF 1.0 groups trustworthiness into seven characteristics. Validity and reliability form the base, with safety, security and resilience, privacy enhancement, and fairness with harmful bias managed built on top, and explainability and interpretability beside them. The framework treats an inaccurate or poorly generalized system as untrustworthy whatever else it offers. Accountability and transparency run through every other item.
The document is frank that the list does not add up to a score. It says addressing the characteristics one at a time will not ensure trustworthiness, that tradeoffs are usually involved, and that trustworthiness "is only as strong as its weakest characteristics." Its examples are concrete: optimizing for interpretability can conflict with privacy, predictive accuracy can conflict with interpretability, and privacy-enhancing techniques can reduce accuracy when data are sparse. It also says analysis can reveal a tradeoff but cannot decide it, because the decision depends on the values at stake in a given setting. NIST's own page on the framework says a revision is under way in connection with the White House AI Action Plan, so the current version should be checked there.
What the EU guidelines add: lawful, ethical, and technically sound
The European expert group framed trustworthy AI as three things at once: lawful, ethical, and sound both technically and in its social setting. Its seven requirements are human agency and oversight, technical robustness and safety, privacy and data governance, transparency, diversity, non-discrimination and fairness, societal and environmental well-being, and accountability.
Two features set this list apart from the NIST one. Human agency and oversight comes first, which puts the role of people ahead of model performance. Societal and environmental well-being extends the scope beyond the individual user. The group presented its final Assessment List for Trustworthy AI in July 2020, a self-assessment checklist for developers and deployers. The guidelines were issued before the EU AI Act was negotiated, and they are not the same thing as that regulation, whose obligations come from its own text and timetable.
Canada's code and the ISO standard
Canada's Voluntary Code of Conduct targets advanced generative systems and uses six principles: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. Organizations choose to sign it, and signing is a commitment, not a license or a legal finding.
ISO/IEC 42001:2023 works at a different level. Its scope is the organization: it specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system, for any organization that provides or uses AI-based products or services. A company can follow it and still ship a model with weak accuracy, because the standard governs how decisions about AI are made and reviewed, not the measured quality of a particular system.
Questions to ask when a product claims to be trustworthy
- Which framework or standard is the claim based on, and who assessed it?
- Is the evidence about the model, about the organization's process, or only about a stated intention?
- Which of the seven NIST characteristics were measured, with what data, and in which settings?
- Where did the developer decide that one characteristic outweighs another, and who approved the choice?
- Is there a path for a person affected by an output to ask for review?
This article gives general information about voluntary frameworks. It is not legal advice and does not state what any law requires of a particular organization; a qualified professional and the primary documents in the Sources list are the places to confirm obligations.
FAQ
Is trustworthy AI a legal requirement?
Not as a phrase. The frameworks above are voluntary or are guidelines. Legal duties come from separate statutes and regulations, such as privacy, consumer protection, and sector rules, and these differ by country, province, and state.
Can an AI model be certified as trustworthy?
The documents reviewed here do not certify a model. NIST's framework is guidance for managing risk, and ISO/IEC 42001 concerns an organization's management system. Any claim of certification should name the scheme and the body that issued it.
Is explainability the same as trustworthiness?
No. In NIST's framework explainability and interpretability are two of seven characteristics. A system can be easy to explain and still be inaccurate, and NIST places validity and reliability at the base for that reason.
Which framework applies to a Canadian organization?
All of them can be used as references, and none is mandatory by itself. Canada's code applies to organizations that signed it. Other obligations depend on the sector and the jurisdiction.
Related reading
- Ethics questions in AI-generated art
- Where AI principles conflict
- Why simple test problems mislead
- How to read an AI institute's reports
More in AI Policy and Ethics.
Last verified: October 2026
Sources
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, 2023
- AI Risk Management Framework page, National Institute of Standards and Technology, 2026
- Ethics Guidelines for Trustworthy AI, High-Level Expert Group on AI, European Commission, 2019
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, Innovation, Science and Economic Development Canada, 2023
- ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, IEC webstore, 2023