NIST AI RMF vs ISO/IEC 42001: which to use, and how they fit together

Two different kinds of document

The NIST AI Risk Management Framework (AI RMF 1.0, published as NIST AI 100-1 on 26 January 2023) is a voluntary framework from the US National Institute of Standards and Technology. It describes what good AI risk management achieves, organized into four functions: Govern, Map, Measure and Manage. A companion Generative AI Profile, NIST AI 600-1, was released on 26 July 2024.

ISO/IEC 42001:2023, published in December 2023, is an international standard that specifies requirements for an AI management system, or AIMS. It has been adopted in Europe as EN ISO/IEC 42001:2026. It is certifiable: certification bodies, themselves accredited under ISO/IEC 42006:2025, can audit an organization and issue a certificate.

The difference is the one between a guide to being healthy and a medical examination. The first tells you what to work on. The second produces a result that someone else will accept.

Side by side

Neither is law. Both are voluntary, and both are widely used as evidence that an organization governs AI seriously.

What NIST AI RMF asks for

The four functions describe a complete programme.

• Govern. Establish AI risk policies, roles and accountability.
• Map. Inventory AI systems and document their context, intended use and impacts.
• Measure. Assess and track AI risks, including validity, bias, security and privacy.
• Manage. Prioritise and treat risks, and monitor deployed systems.

Each function breaks down into categories, 19 in all. The framework does not tell you how to achieve each outcome; that flexibility is its strength for a team starting out, and its weakness when a customer wants proof.

The Generative AI Profile adds risk actions for generative systems, addressing confabulation, information integrity, intellectual property and data privacy.

A note on versions: NIST has signalled that a revision is under way, but no successor to AI RMF 1.0 has been published. Reports of an "AI RMF 2.0" draft could not be verified against NIST sources. Work from 1.0.

What ISO/IEC 42001 asks for

ISO/IEC 42001 follows the management-system pattern familiar from ISO 27001. In outline, an organization must:

• define the scope of its AIMS, an AI policy, roles and objectives;
• perform AI risk assessments and AI system impact assessments;
• implement the applicable controls from Annex A, of which there are 38, and maintain a statement of applicability that records which apply and why;
• run internal audits and management reviews, and pursue continual improvement.

The emphasis is on the system around the AI: that policies exist and are followed, that assessments happen on a schedule, that problems are found and corrected, and that management is involved. An auditor samples evidence that this machinery operates.

Where they overlap

For the people doing the work, most of the content is shared.

An inventory built for one serves the other. So does a risk assessment, provided it is documented per system with evidence.

What ISO/IEC 42001 adds is formality: defined scope, documented procedures, internal audit, management review and corrective action. What NIST AI RMF adds is depth on the substance of AI risk, particularly in Measure and in the Generative AI Profile.

Which to start with

Start with NIST AI RMF if you are building a programme from nothing, your pressure comes mainly from US customers or regulators, or you need a common vocabulary quickly. It is free, readable and unintimidating, and its four functions are a workable way to divide responsibilities.

Go to ISO/IEC 42001 if customers are asking for a certificate, you already run ISO 27001 and have the management-system habits, or you sell into markets where ISO certificates are the expected form of assurance.

For most organizations, the answer is a sequence. Use NIST AI RMF to structure the first year: build the inventory, assess the important systems, write the policy. When a certificate becomes commercially necessary, the same evidence is most of what an ISO/IEC 42001 audit will examine, and what remains is the management-system layer around it.

How they relate to law

Neither framework is a legal requirement, and following either does not by itself satisfy a law. They are, though, the practical route to being able to show how you manage AI risk.

The EU AI Act's obligations for high-risk Annex III systems, which begin on 2 December 2027, cover risk management, data governance, logging and human oversight. An organization with an operating AI management system will find it already holds much of the evidence those obligations call for. See the EU AI Act overview for the timeline.

Common mistakes

Treating either as a checklist. Ticking every category in a spreadsheet, with no per-system evidence behind it, fails the first sampling question.

Assessing the organization and not the systems. Both frameworks expect risk to be assessed for each AI system in its context. A single organization-wide assessment hides the hiring tool behind the grammar checker.

Starting with documents. Policies written before the inventory describe an imagined company. Find out what you have first.

Running them as separate projects. Two teams, two inventories and two risk registers double the cost and guarantee inconsistency. Use one set of records.

Working on both in GhostAudit

GhostAudit has assessments for both: NIST AI RMF categories across all four functions, and ISO/IEC 42001 clauses and Annex A control areas, each answered per system with evidence and a remediation plan. Both draw on the same inventory.

Two document templates turn the results into the artefacts each framework expects: a NIST AI RMF gap analysis rating all 19 categories against your evidence, and an ISO/IEC 42001 statement of applicability covering all 38 Annex A controls. GhostAudit is not a certification body, and you will need your own licensed copy of the ISO standard. More on the NIST AI RMF and ISO/IEC 42001 pages.