NIST AI RMF or ISO 42001: differences, overlap and how to combine them

Anyone working on AI governance soon meets two names: the NIST AI Risk Management Framework and ISO/IEC 42001. The question is often which of the two to choose. They do not do the same thing, so the answer starts with what you want to achieve.

What the NIST AI RMF is

AI RMF 1.0 was published on 26 January 2023 and is a voluntary framework from the US NIST. It is not legally required and it cannot be certified. The core consists of four functions: Govern, Map, Measure and Manage. Govern covers culture, roles, policy and accountability and runs through the other three. Map sets out the purpose, context and potential impact of an AI system. Measure analyses, tests and monitors risks using qualitative and quantitative methods. Manage prioritises the risks and decides how to treat them.

The framework also describes the characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. Around it sit a Playbook and the Generative AI Profile (NIST AI 600-1, 26 July 2024). On its website NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan. It names no new version or date.

What ISO/IEC 42001 is

ISO/IEC 42001:2023 is a management system standard for AI. It sets requirements for an AI management system (AIMS) in clauses 4 to 10, built like ISO 27001, and contains 38 controls in Annex A. An accredited certification body can assess whether an organisation meets those requirements. More on the standard is in ISO 42001 explained.

The standard asks for an AI risk assessment (clause 6.1.2), risk treatment (6.1.3) and an AI system impact assessment (6.1.4). It prescribes no method: the organisation sets its own risk criteria. The impact assessment has a separate standard, covered in ISO 42005 and the AI impact assessment.

Where they differ

The NIST AI RMF helps you think about AI risk: which properties to assess, when, and what to do with the outcome. ISO 42001 is about what an organisation must set up and be able to demonstrate: policy, roles, objectives, internal audit, management review and corrective action. The first is a way of thinking, the second a system with requirements you can be tested against.

That difference is practical for an auditor. An auditor can establish conformity with ISO 42001 because the standard sets requirements. The AI RMF sets no testable requirements, so you cannot be certified against it. An auditor can, however, test whether an organisation carries out its own AI RMF-based process as it has documented it.

Where they overlap

Both are risk-based, cover the whole lifecycle of an AI system and place responsibility with management and the organisation. NIST's AI Resource Center lists crosswalks that map the AI RMF to other sources. The one for ISO/IEC 42001 was submitted by Microsoft, not by NIST itself, and NIST notes that listing a crosswalk does not mean it endorses the mapped resource. For ISO/IEC 23894 (guidance on AI risk management) and ISO/IEC 42005 (AI impact assessment), crosswalks were submitted by INCITS/AI in August 2025. Treat them as an aid, not as an official NIST position.

Which to choose

If you mainly want a grip on AI risk and need no certificate, the AI RMF is a low-threshold starting point. If you must set up AI governance demonstrably and have it assessed, for customers or clients for example, ISO 42001 fits. If customers or clients refer to the AI RMF, you can use it as the risk model inside your AIMS.

For the EU AI Act the same applies to both: ISO 42001 is not a harmonised standard and so gives no presumption of conformity with the law, and the AI RMF is a voluntary US framework. They can provide structure, but they do not replace the legal requirements. How to determine a system's risk class is covered in risk classification under the EU AI Act.

Combining them in practice

Roughly, the functions line up with parts of the standard. Govern fits leadership, policy and roles. Map fits understanding the context and the impact assessment. Measure fits monitoring and performance evaluation, and Manage fits risk treatment. You then use the AI RMF as the working method for the risk assessment that ISO 42001 requires, while the standard forms the management system around it.

Pay attention to documentation when you combine them. ISO 42001 expects documented information, and a risk process that exists only in the team's heads produces no evidence. Record which parts of the AI RMF you use, which risk criteria you apply and who signs off the outcomes. Let those choices show up in the risk assessment and in the statement of applicability.

Both start in the same place: knowing which AI you use. Without an overview, including AI features in existing software, there is little to assess. See shadow AI and the AI inventory. To work this out for your organisation, see our compliance work.