Comparison
NIST AI RMF vs ISO/IEC 42001
Written with AI from the sources below and checked against our facts sheet. Last checked . How this site is made · Spot an error?
Part of: NIST AI Risk Management Framework, ISO/IEC 42001
The one-line rule
ISO/IEC 42001 sets auditable requirements for an AI management system, and you can be certified against it. The NIST AI RMF offers voluntary risk outcomes under GOVERN, MAP, MEASURE and MANAGE, with no certification.
Side by side
| NIST AI RMF | ISO/IEC 42001 | |
|---|---|---|
| What it is | A risk management framework (NIST AI 100-1) | A standard setting requirements for an AI management system (AIMS) |
| Published by | NIST, a US federal agency, January 2023 (version 1.0) | ISO and IEC jointly, December 2023 |
| Legal status | Voluntary | Voluntary, unless a contract or customer requires it |
| Certifiable? | No | Yes, by accredited certification bodies after an external audit |
| Structure | Four functions (GOVERN, MAP, MEASURE, MANAGE), 19 categories, 72 subcategories | ISO harmonized structure (clauses 4 to 10), Plan-Do-Check-Act, and Annex A with 38 controls in nine areas |
| Style | Outcome statements; organizations pick the ones that fit their context | Mandatory "shall" requirements an auditor checks |
| Key outputs | Profiles (current versus target), Playbook actions, the Generative AI Profile | AI policy, risk assessment and treatment, AI system impact assessment, Statement of Applicability, internal audit, management review |
| Cost to access | Free to download | Paid standard, plus audit fees for certification |
When each applies
The NIST AI RMF fits an organization that wants a flexible method for finding and treating AI risk. NIST says it is "intended for voluntary use" and it is sector and use-case agnostic. GOVERN is cross-cutting and runs throughout. MAP, MEASURE and MANAGE can be applied in any order and repeated. It also names seven characteristics of trustworthy AI, from valid and reliable to fair with harmful bias managed. NIST states that AI RMF 1.0 is being revised under the White House AI Action Plan; 1.0 remains current.
ISO/IEC 42001 fits an organization that needs to prove its AI governance to outsiders, such as customers, partners or investors. It covers the organization's whole AI management system, whether it builds AI, uses it or both. It follows the same structure as ISO/IEC 27001, so it can sit beside an existing security program. Certification depends on continual improvement through the Plan-Do-Check-Act loop, not a one-time snapshot.
They work together. ISO/IEC 42001 requires AI risk assessment and AI system impact assessment but does not prescribe one method. The RMF's MAP and MEASURE outcomes can supply that method. ISO/IEC 42005 adds guidance on impact assessments.
Neither one is law, and neither proves conformity with the EU AI Act. The Act runs on its own harmonised standards and conformity assessment.
Worked example
Tessaro Payments, a fictional US fintech, runs a fraud-scoring model and sells it to European banks.
Its risk team adopts the NIST AI RMF first. GOVERN assigns an accountable executive and sets the company's risk tolerance. Under MAP, the team documents the model's purpose, users and affected cardholders. Under MEASURE, it tests false-positive rates across customer groups and monitors for drift. Under MANAGE, it routes borderline cases to analysts and plans for incidents.
Then bank customers start asking for independent assurance. A self-declared "we follow NIST" statement does not satisfy their procurement teams. Tessaro implements an ISO/IEC 42001 management system. It includes an AI policy, a Statement of Applicability for the Annex A controls, internal audits and management reviews. It reuses its RMF risk work as evidence for the 42001 risk and impact assessment requirements. An accredited certification body audits the system and issues a certificate.
Tessaro now uses both. The RMF shapes how it analyzes risk. The 42001 certificate shows outsiders that a working management system exists.
The exam trap
The classic trap is an answer offering "NIST AI RMF certification." No such certificate exists. The reverse trap calls ISO/IEC 42001 "guidance." It is a requirements standard, and certification is its point.
The tell:
- A stem about independent assurance, a third-party audit, customer due diligence or a certificate points to ISO/IEC 42001.
- A stem about functions, profiles, the Playbook or trustworthy characteristics points to the NIST AI RMF.
- "Implementation tiers" belong to the NIST Cybersecurity Framework, not the AI RMF.
- A 42001 certificate is evidence of good governance, not EU AI Act conformity.
Practice the ISO trio in lesson II.D.4 and the RMF functions in lesson II.D.2.
Frequently asked questions
Can you get certified against the NIST AI RMF?
No. The NIST AI RMF is voluntary and has no certification scheme. Organizations can say they align with it or have mapped their program to it, but no accredited body issues an AI RMF certificate. For third-party certification of AI governance, the relevant standard is ISO/IEC 42001.
Is ISO 42001 mandatory?
No law makes ISO/IEC 42001 mandatory on its own. It is a voluntary international standard. In practice, customers and partners can require certification through contracts or procurement. Certification also does not prove compliance with the EU AI Act, which relies on its own conformity assessment and harmonised standards.
Which is better, NIST AI RMF or ISO 42001?
They do different jobs, so many organizations use both. The AI RMF is a free, flexible method for identifying, measuring and treating AI risks. ISO/IEC 42001 wraps AI governance in an auditable management system that can be certified. A common pattern is to run the RMF's risk activities inside a 42001 management system.
Is the NIST AI RMF still version 1.0?
Yes, as of November 2026. NIST released AI RMF 1.0 on 26 January 2023. NIST says it is being revised under the White House AI Action Plan, but no new version has been published. The Generative AI Profile (NIST AI 600-1, July 2024) adds guidance for generative AI.