Start from the person asking
A US business customer usually asks for SOC 2. A European or global customer usually asks for ISO 27001. If you take card payments, your bank or payment provider will ask about PCI DSS. If you handle US health information for a covered entity, HIPAA applies.
Personal data brings its own laws: the GDPR for people in the EU and UK, and the CCPA for Californians once you pass its thresholds.
Some sectors have their own rules: CMMC for US Defense contractors, NIS2 for essential and important entities in the EU, and DORA for EU financial firms and their ICT providers.
For AI, ISO 42001 is the certifiable management system, the EU AI Act sets legal duties (Article 50 covers transparency), and the NIST AI RMF is the voluntary US framework buyers often ask about.
If you are not sure
Your first assessment is free on any standard. Run the one your largest customer asked about, and the gap list will show how far the others are.