统一人工智能治理框架协调三大风险体系

arXiv:2608.07515v1 Announce Type: new Abstract: Artificial intelligence governance is consolidating around three structurally heterogeneous instruments: ISO/IEC 42001:2023, the first certifiable Artificial Intelligence Management System (AIMS) standard; the United States NIST AI Risk Management Framework (AI RMF 1.0), a voluntary, socio-technical risk model; and the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689), a binding, risk-tiered law. Although these instruments share the goal of trustworthy AI, they differ fundamentally in legal status, governance subject, and conception of risk, so that the control-level crosswalks now common in practice are both incomplete and, in places, misleading. Drawing on document analysis of the official standards and frameworks and on comparative governance literature, this article reconciles the three instruments into a Unified AI Governance Taxonomy (UAGT) organized as five analytical layers -- normative purpose, governance subject, risk logic, control architecture, and evidence and assurance -- bound by a traceability spine and expressed through eight regulation-stable governance domains. The taxonomy is deliberately current, incorporating the May 2026 Digital Omnibus amendments to the AI Act and the 2024 NIST Generative AI Profile. A four-step implementation model and two worked high-risk examples -- an AI-enabled clinical decision-support system and an AI credit-scoring system -- show how organizations can operate a single control library and evidence base that supports ISO/IEC 42001 certification, NIST AI RMF adoption, and EU AI Act compliance without duplicative effort. We are explicit about where unification breaks down: the non-fungibility of legal conformity and voluntary certification, the mismatch between list-based and contextual risk ontologies, enforcement asymmetry, and the widening gap between all three instruments and general-purpose and agentic AI.