NIST AI RMF vs ISO 42001: Which AI Governance Framework Should You Adopt First?

NIST AI RMF vs ISO 42001 is really a question about who you need to convince. The NIST AI Risk Management Framework is free and voluntary, and it gives your team a shared way to find and treat AI risk. ISO/IEC 42001 is a standard you can be audited and certified against, which is what procurement teams and boards usually want to see. If you can only start one this quarter, start with the one your most demanding stakeholder will accept. Most organisations that sell into regulated markets end up running NIST AI RMF and ISO 42001 side by side.

TL;DR

• NIST AI RMF 1.0 was published on 26 January 2023. It’s voluntary and free, and nobody certifies you against it. It has four functions: Govern, Map, Measure and Manage.
• ISO/IEC 42001:2023 was published in December 2023. It’s the first international standard for an AI management system, it has 38 controls in Annex A, and accredited bodies certify against it.
• Neither one is the law. NIST AI RMF and ISO 42001 are both voluntary; the EU AI Act is binding. A framework helps you meet the Act; it doesn’t replace it.
• Our rule of thumb: US public sector, or a programme in its first year? Start with NIST. Selling B2B in Europe and answering supplier questionnaires? Start with ISO 42001. Pressed from both sides? Use NIST as the method inside an ISO management system.

Why does this question keep coming up now?

Because buyers moved faster than most AI programmes. A year or two ago, a supplier questionnaire might ask whether you “use AI responsibly”, and a paragraph of good intentions would do. Now the question is more pointed: do you hold ISO/IEC 42001, and if not, which framework do you follow and how do you prove it?

Updated 11 November 2026

That catches teams out in both directions. The ones who adopted NIST early have a solid risk method and no certificate to show for it. The ones who rushed to certification sometimes have a tidy management system sitting on top of very thin risk work. Neither position holds up well when an auditor or a large customer starts asking for evidence on a specific system.

The EU calendar adds pressure. The Digital Omnibus on AI, Regulation (EU) 2026/1744, came into force on 27 July 2026 and moved the obligations for high-risk systems listed in Annex III to 2 December 2027. That’s about 13 months from today. It sounds generous until you try to fit an AI inventory, a risk classification for every system and a year of evidence into it. We broke down the new dates in what still applies after the EU AI Act delay.

What is the NIST AI RMF, and how is it different from ISO 42001?

The NIST AI Risk Management Framework is a voluntary guide for managing the risks of AI systems from design to retirement. A risk framework is simply a structured way of finding, measuring and dealing with risk, so everyone in the organisation uses the same words and the same steps.

NIST splits the work into four functions. Govern sets the policies, roles and culture. Map works out the context of each AI system and what could go wrong. Measure tests and tracks those risks. Manage decides what to do about them, in order of priority. Around this sits a free Playbook of suggested actions, plus profiles for particular technologies. The Generative AI Profile, NIST AI 600-1, arrived on 26 July 2024 and lists 12 risks that generative models create or make worse, from confabulation to data privacy.

The catch is proof. There is no NIST certificate. You can self-attest, or commission an independent assessment, and the buyer has to take the report on trust. For a US federal supplier that is often enough. For a hospital group in Europe running a formal tender, it usually isn’t.

What is ISO/IEC 42001, in plain terms?

ISO/IEC 42001:2023 sets out the requirements for an AI management system, often shortened to AIMS. A management system is the set of policies, roles, processes and records an organisation uses to keep an activity under control, and to show an auditor that it does. If your organisation already holds ISO/IEC 27001 for information security, the shape will feel familiar: context, leadership, planning, support, operation, performance evaluation and improvement.

Annex A holds 38 controls under nine objectives. They cover AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems and third-party relationships. You don’t have to apply every control, but you do have to justify the ones you leave out.

Certification works the way it does for other ISO standards. An accredited body audits you in two stages, issues a certificate valid for three years, and comes back for a surveillance audit every year. It costs money and time, mostly in the internal work of writing policies and gathering evidence. Teams with a working 27001 system tend to move faster, because so much of the management machinery is shared.

NIST AI RMF vs ISO 42001: side-by-side comparison

Criterion	NIST AI RMF 1.0	ISO/IEC 42001:2023
Publisher	NIST (United States)	ISO and IEC (international)
Published	26 January 2023	December 2023
What it is	Risk management framework	Management system standard
Status	Voluntary	Voluntary, often required by contract
Certification	None	Yes, by accredited bodies
Structure	4 functions: Govern, Map, Measure, Manage	Clauses 4 to 10, plus 38 Annex A controls
Price of the document	Free	Paid
Audit cycle	None	3-year certificate, yearly surveillance audits
Strongest at	Finding and measuring risk	Accountability, records, continual improvement
Best first step for	Teams starting an AI risk programme	Suppliers who must prove governance to buyers

The good news in the NIST AI RMF vs ISO 42001 debate is that the two agree on most of the substance, and you don’t have to map them by hand. NIST’s AI Resource Center hosts an official crosswalk from the AI RMF to ISO/IEC 42001, contributed by Microsoft and written against the final draft of the standard. Broadly, Govern lines up with the ISO clauses on leadership and planning, while Map, Measure and Manage line up with operation, performance evaluation and the controls.

Will NIST AI RMF or ISO 42001 make you compliant with the EU AI Act?

No, and it’s worth being blunt about this because vendors sometimes blur it. The EU AI Act sets legal obligations. Neither framework gives you a presumption of conformity with it. That status is reserved for harmonised standards, which CEN and CENELEC are still drafting through Joint Technical Committee 21.

There’s also a mismatch of scope. ISO/IEC 42001 certifies an organisation. Most of the Act’s duties for high-risk AI attach to a specific system: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness. A certificate on the wall won’t answer an auditor who asks how one particular credit-scoring model is overseen.

The stakes are real. Under Article 99 of the Act, prohibited practices can cost up to €35m or 7% of worldwide annual turnover, and most other breaches up to €15m or 3%. So treat the frameworks as scaffolding and the Act as the building code. You need both, and only one of them is enforced.

How do you choose between NIST AI RMF and ISO 42001?

Take a hypothetical mid-sized insurer. In its first year with AI in production, the risk team adopts NIST AI RMF because it’s free and fast to start. They build an inventory of every model and automation, give each an owner, and score each against the Map and Measure functions.

In year two, a large corporate client adds an ISO/IEC 42001 clause to its supplier contract. The insurer doesn’t throw anything away. It wraps the NIST risk method in an ISO management system, adds the missing policies and records, and books a certification audit. The risk work done in year one becomes the evidence base for year two.

That’s the pattern we’d recommend to most teams: start where you can make progress this month, and design the work so it carries forward.

How do you run NIST AI RMF and ISO 42001 together?

1. Ask who needs proof. A regulator, a customer, your board, internal audit? If anyone outside the organisation needs it, plan for ISO/IEC 42001.
2. Build one AI inventory. Every model, agent and automation, including the ones teams built for themselves, each with an owner and a risk class.
3. Run one risk process. Use NIST’s Map, Measure and Manage as the method inside the ISO planning and operation clauses.
4. Write each control once and tag it three times: its NIST subcategory, its ISO Annex A reference and the AI Act article it supports.
5. Collect evidence while you work. Approval records, test results and incident logs captured at run time are far more convincing than documents written the week before an audit.

Step five is where most programmes struggle, and it’s where tooling earns its keep. Planet Crust @Human is an open-source, self-hosted AI platform that classifies every system against the EU AI Act and ISO/IEC 42001. It keeps accountable roles, signed approval gates, risk scenarios and a sensitive-data register in the same place you build your agents, automations and applications, so the evidence is recorded as things happen. @Human gives you the controls and the evidence; the certificate still comes from your auditor. Our Every Law, Every Regulation page explains how it works.

Frequently asked questions

Is ISO 42001 mandatory?

No. ISO/IEC 42001 is voluntary. It becomes a requirement only when a customer, a tender or a regulator writes it into their terms, which is happening more often in B2B contracts.

Can you get certified against the NIST AI RMF?

No. NIST does not run a certification scheme for the AI RMF. You can self-attest, or pay an independent firm to assess you, but there is no certificate to hang on the wall.

Is NIST AI RMF or ISO 42001 better?

Neither is better in general. NIST AI RMF is better for building a risk method quickly and for free. ISO/IEC 42001 is better when an outside party needs independent proof. Most regulated organisations use both.

How is ISO 42001 different from ISO 27001?

ISO/IEC 27001 covers information security. ISO/IEC 42001 covers how you develop and use AI systems, including their impact on people. They share the same clause structure, so you can run them as one integrated management system.

Does ISO 42001 certification cover the EU AI Act?

No. It supports your compliance work, but the EU AI Act puts duties on individual high-risk systems that an organisation-level certificate does not prove on its own.

Does the EU AI Act delay change which framework to pick?

Not much. The Digital Omnibus moved the Annex III high-risk deadline to 2 December 2027, which gives you time to build an ISO/IEC 42001 management system properly. It does not give you a reason to wait.

What to do next

Pick the framework your most demanding stakeholder will accept, then start the inventory this month. Whichever way the NIST AI RMF vs ISO 42001 decision goes, the inventory is the same. If you’d like to see classification and evidence working inside a live platform, book a free @Human walkthrough. A real person replies within one working day.

This article is general information, not legal advice.

Sources

• NIST, AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023
• NIST, Generative AI Profile, NIST AI 600-1, July 2024
• NIST AI Resource Center, NIST AI RMF to ISO/IEC 42001 Crosswalk
• ISO, ISO/IEC 42001:2023 Artificial intelligence: Management system
• Regulation (EU) 2024/1689, the EU AI Act, Articles 40 and 99
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force 27 July 2026
• Orrick, EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes, 29 July 2026