ISO 42001 and SOC 2 answer different questions. One certifies how you manage AI; the other attests that your controls work. Here is when a customer needs which, and the lakehouse evidence that serves both.
A decision-stage comparison of the NIST AI RMF and ISO/IEC 42001 for mid-market companies: what each one is, who asks for which, what each costs in effort, and how one set of lakehouse controls produces evidence for both.
MCP lets an AI agent call your tools and read your data through one standard interface. Securing it is an identity, gateway and logging job on the data platform, not a patch cycle.
A subcategory-level map from the NIST AI RMF and its Generative AI Profile to concrete lakehouse controls a 400-person company can run, with the evidence each control produces.
Unity AI Gateway is the Databricks AI gateway for models, agents and MCP servers. Here is what governed means in practice, and which parts are GA and which are still Beta.
The OWASP Top 10 for Agentic Applications names ten agent risks. Each one maps to a concrete control in identity, data access, orchestration or audit logging, and most of those controls live in the data layer.
ChatGPT agent mode acts through connectors and a browser within the user’s own permissions. Here is what it can reach at work, which admin controls matter, and how to hand it governed data instead of raw systems.
AI agents inherit the access of the person using them, so shadow AI is really an oversharing and inventory problem. Here is the control stack that fixes it without banning the tools.
A practical AI governance framework a mid-market team can run on Unity Catalog and the lakehouse, mapped to the NIST AI RMF functions and to the evidence several new rules ask for.