AI Accountability Framework: GAO, NIST, OECD Compared

Search for an AI accountability framework and you will mostly find the frameworks themselves: a GAO report, a NIST standard, an OECD principle, an NTIA policy paper, each a long PDF describing its own slice of the problem. None of them lays the others alongside. This piece does. It explains what an accountability framework has to contain, compares the five reference documents on one table, shows how they fit together into a single chain, and ends with the question a smaller jurisdiction actually faces: which parts can be borrowed without building a new bureaucracy to run them.

What an AI accountability framework is

Start with the word. The OECD, in the commentary on its accountability principle, separates three terms that are usually blurred. Accountability is the expectation that an organisation can explain why a decision was taken and, after a bad outcome, act to make the next one better. Liability is the adverse legal consequence of an action or inaction. Responsibility is the causal link between an actor and an outcome, used in both legal and moral senses. The OECD chose "accountability" deliberately, and asks that it be demonstrated through documentation of key decisions across the system's lifecycle and, where justified, through audit.

An AI accountability framework, then, is the machinery that turns that expectation into something checkable. Whatever its author, it has to answer four questions:

1. Who answers? Named owners, not "the organisation".
2. For what? The data, the model's performance, its effects on people, and its behaviour over time.
3. With what evidence? Documentation, logs, test results, records of human oversight.
4. With what consequence? A finding, a correction, a fine, a withdrawal, a lawsuit.

A document that answers only the first two is an ethics statement. One that answers all four is a framework.

The five reference frameworks

GAO: governance, data, performance, monitoring

The phrase "AI Accountability Framework" belongs, in search and in substance, to the US Government Accountability Office. GAO built it after a Comptroller General forum in September 2020 and published it in June 2021, organised around four complementary principles: governance, data, performance and monitoring. Each principle carries key practices; each practice carries questions for the entity, plus procedures and types of evidence for auditors. GAO's own summary of the auditor's role is "trust but verify".

What makes it unusually rigorous is its threshold. In the full report, a practice only counts as "key" if at least two independent sources described it as important, and the governance principle alone holds nine of them, ranging from clear goals to transparency towards external stakeholders. Its stated audience is broader than federal agencies: state and local governments, industry, civil society, academia and research institutions.

NIST AI RMF: govern, map, measure, manage

The NIST AI Risk Management Framework was released on 26 January 2023 for voluntary use, followed by a generative AI profile in July 2024 and, in April 2026, a concept note for a profile on critical infrastructure. Its core is four functions, GOVERN, MAP, MEASURE and MANAGE, with GOVERN applying across the whole lifecycle.

Strictly, it is a risk framework rather than an accountability framework, but accountability sits inside it as one of the characteristics of trustworthy AI, with a sentence worth quoting: "Accountability presupposes transparency." NIST is also candid about its limits. Using the framework alone, it says, will not change an organisation's incentives; that takes commitment at senior levels and sometimes cultural change.

OECD Principle 1.5: traceability across the lifecycle

The OECD principle is the shortest of the five and the one most governments have already signed. It asks AI actors to be accountable according to their role and context, to ensure traceability of datasets, processes and decisions, and to apply systematic risk management at every phase. Its companion report, Advancing accountability in AI, reduces that to four steps drawn from NIST, ISO 31000 and the OECD's due diligence guidance: define scope and criteria, assess risks, treat them, and govern the process. It is principle-level guidance. It tells you what good looks like, not what an auditor should ask for.

NTIA: accountability as a chain

The US National Telecommunications and Information Administration's AI Accountability Policy Report contributes the most useful mental model in the literature. It treats accountability as a chain: information flow (documentation, disclosure, access) feeds independent evaluation (red-teaming, audits), which feeds consequences (liability, regulation). A break anywhere breaks the whole. From public comments it derived eight recommendations in three groups: guidance, support and regulation.

EU AI Act: the binding one

The other four are voluntary. The EU AI Act is law, and it is the only one with a price attached: for prohibited practices, fines of up to 35 million euro or 7% of worldwide annual turnover, whichever is higher. The Act became generally applicable, with enforcement powers, on 2 August 2026, and its rules for high-risk uses in areas such as employment and biometrics follow on 2 December 2027. For the distinction between this kind of instrument and the voluntary ones, see our piece on AI governance vs AI regulation.

Side by side

Read the table vertically and the pattern is plain. The voluntary frameworks are strong on the first three questions (who, for what, with what evidence) and silent on the fourth. The one binding instrument supplies the consequence but leaves most of the practice to standards still being written.

How the pieces stack into one chain

They are not competitors. Used together, they form the chain NTIA describes:

• Principle: OECD 1.5 states the obligation and who carries it.
• Practice: NIST tells an organisation how to run risk management day to day; GAO tells it which practices it will be asked to evidence.
• Evidence and audit: GAO's questions and audit procedures say what a reviewer should collect. NTIA's recommendations add the areas an audit should cover at minimum (risk management, data quality, documentation and disclosure, process controls) and propose public registries of high-risk deployments, adverse incidents and disclosable audits.
• Consequence: the EU AI Act, sector regulators and ordinary liability law. That last link is where the hardest questions sit, covered in our piece on who is responsible when AI gets it wrong.

An organisation that adopts NIST and stops has a well-run risk process and no external check. A regulator that copies the EU's penalties without GAO-style evidence requirements has a fine it cannot fairly impose. The framework is the whole chain, not any one document in it.

What small states can borrow

Large jurisdictions can afford to write all four links themselves. A small state, an island administration or a regional government usually cannot, and should not try.

Singapore's model framework

Singapore is the clearest worked example. Its Model AI Governance Framework launched in January 2019 at the World Economic Forum in Davos, and covers four areas: internal governance, the level of human involvement in AI-assisted decisions, operations management, and communication with stakeholders. It is voluntary, explicitly described as accountability-based, and comes with a self-assessment guide (ISAGO) and a compendium of real use cases. Two design choices stand out. Adopting it does not exempt anyone from existing law, but it helps an organisation demonstrate accountability under that law. And an algorithm audit is to be conducted only when necessary and only at a regulator's request, which keeps the audit burden proportionate.

The generative AI edition puts accountability first among nine dimensions and borrows a solution from cloud computing: a shared responsibility model that allocates duties by the level of control each party has, upfront, with indemnity, insurance and liability law as the safety net afterwards.

A minimum viable framework

From those pieces, a small jurisdiction can assemble something workable without inventing anything:

1. Adopt, do not draft, the principle. OECD 1.5 is already a political commitment for most governments.
2. Point organisations at NIST for practice. It is voluntary, not sector-specific and designed for organisations of all sizes, so the regulator does not have to maintain its own standard.
3. Borrow GAO's questions as the audit checklist. They were written for public auditors and are free to reuse.
4. Use Singapore's proportionality. Self-assessment by default, external audit on a regulator's request, so smaller firms are not priced out. NTIA's own evidence shows why this matters: commenters argued that mandatory audits impose costs that fall hardest on smaller businesses while standards are still immature.
5. Keep a register. Even a simple public list of high-risk deployments and reported incidents, as NTIA proposes, closes the information link that every other link depends on.
6. Test before legislating. A bounded jurisdiction can trial the regime with real operators first. We look at that model in islands as regulatory sandboxes for AI.

Whether such a regime ever needs a statute behind it is the question behind the AI Accountability Act and similar proposals. For the underlying concept on its own, see what accountability in AI means.

Where this gets argued in public

Every framework above was written by one kind of institution for another: auditors for agencies, standards bodies for companies, a ministry for its regulators. The people who will live under the resulting rules rarely sit in the same room as those who write them. That is why the EX Future Summit programme runs a Government track alongside an AI Ethics track, Research and Finance, rather than in a separate policy wing. The summit runs 18 to 20 November 2026 as a continuous thirty-hour broadcast between Las Palmas and Bali, with free online attendance for verified researchers and students, so a regulator drafting a framework and a founder who will have to comply with it can be in the same conversation from different timezones.

FAQ

Is the GAO AI Accountability Framework mandatory?

No. It is a set of key practices, questions and audit procedures written to help managers and auditors assess AI systems. Agencies and other entities use it as a reference; it creates no legal obligation of its own.

What is the difference between AI accountability and AI liability?

Accountability is the expectation that an organisation can explain its decisions about an AI system and correct course after a bad outcome. Liability is the legal consequence, such as damages or a fine, when an action or omission causes harm.

Do AI accountability frameworks require third-party audits?

Mostly not yet. NTIA recommends requiring independent evaluations for high-risk systems, while Singapore's model limits algorithm audits to cases where a regulator asks for one. The EU AI Act phases in its high-risk rules on its own timeline.

Which framework should a startup start with?

The NIST AI RMF, because it is voluntary, not sector-specific and built for organisations of any size. If the product is sold into the European Union, map it against the EU AI Act risk classes as well.